[Reading list](https://steganography.live/reading-list/) / Guides

THE METHODS

# Neural text steganography methods

Compare vocabulary bins, Huffman coding, patient-Huffman, arithmetic coding, self-adjusting arithmetic coding, and minimum entropy coupling, with primary papers and implementation context.

By Yuntian Deng · Published November 8, 2026 · Updated November 8, 2026

**Neural text steganography**, also called **neural linguistic steganography**, hides a message in text generated with a neural language model. The model supplies a probability distribution over the next word or token. A coding method uses the secret message to choose among those continuations, and a receiver reverses that choice to recover the message.

LSTMs, recurrent neural networks, GPT-2, and newer large language models describe the generator. Vocabulary bins, Huffman coding, arithmetic coding, and coupling describe the information-hiding method. Comparing neural text steganography methods requires keeping these two choices separate.

[Six methods](https://steganography.live/reading-list/guides/neural-text-steganography-methods/#methods) · [Choosing a method](https://steganography.live/reading-list/guides/neural-text-steganography-methods/#choosing) · [Recovery and security](https://steganography.live/reading-list/guides/neural-text-steganography-methods/#reliability) · [Reading path](https://steganography.live/reading-list/guides/neural-text-steganography-methods/#reading)

## Six methods for turning secret bits into text

### 1. Vocabulary bins: choose a word from the indicated group

[Generating Steganographic Text with LSTMs](https://steganography.live/reading-list/papers/fang-2017/) by Tina Fang, Martin Jaggi, and Katerina Argyraki (2017) partitions the vocabulary into bins associated with secret bit blocks. The LSTM selects the next word from the indicated bin; the receiver recovers the block from that word’s bin. More bins increase nominal bits per word while restricting the words available at each step.

This gives a direct relationship between a bit block and a word group. Evaluate how those restrictions change the generated text and its probability distribution. [Read the binning construction and experiments.](https://aclanthology.org/P17-3017.pdf)

### 2. Fixed-length and Huffman coding: assign codes to candidate words

[RNN-Stega](https://steganography.live/reading-list/papers/rnn-stega/) by Zhong-Liang Yang and colleagues (2019 journal issue; first published online in 2018) builds codes over candidate words using a recurrent language model’s conditional probabilities. Fixed-length codes consume a fixed number of message bits; Huffman codes assign different bit lengths to different words. The mapping is rebuilt as the context changes.

The Huffman tree connects probable words with short codewords. Uniform message bits give a word with codeword length `l` probability `2^-l` under the Huffman tree. Comparing that induced distribution with the language model reveals the encoding distortion. RNN-Stega evaluates embedding capacity, text quality, efficiency, and resistance to tested steganalysis methods. [Read the comparison of Huffman coding in Neural Linguistic Steganography, Sections 2 and 4.](https://aclanthology.org/D19-1115.pdf)

### 3. Patient-Huffman: wait before embedding

[Towards Near-imperceptible Steganographic Text](https://steganography.live/reading-list/papers/dai-cai-2019/) by Falcon Z. Dai and Zheng Cai (2019) compares the Huffman-induced distribution with the base language model at each step. When total variation distance or KL divergence exceeds a chosen threshold, the encoder samples from the base model without consuming message bits. It waits for a later step where the distributions are close enough.

This adds a distribution check to the coding decision. The threshold controls when embedding happens, so throughput depends on the distributions encountered during generation. [Read the paper and patient-Huffman algorithm.](https://aclanthology.org/P19-1422/)

### 4. Arithmetic coding: refine probability intervals

[Neural Linguistic Steganography](https://steganography.live/reading-list/papers/neural-linguistic-steganography/) by **Zachary M. Ziegler*, Yuntian Deng*, and Alexander M. Rush** (EMNLP-IJCNLP 2019; * equal contribution) combines arithmetic coding with large pretrained language models. The secret bitstream selects intervals in the model’s cumulative next-token distribution. Repeated interval refinement turns the bits into a reversible token sequence.

The paper develops the method, analyzes the induced distribution, and evaluates payload capacity, statistical divergence, and human judgments of contextual continuations with GPT-2. It also demonstrates encoding natural-language messages into unrelated cover text. Its first arXiv submission was September 3, 2019; publication followed in November 2019.

[Read the published paper](https://aclanthology.org/D19-1115/), follow the [arithmetic-coding walkthrough](https://steganography.live/reading-list/guides/arithmetic-coding/), or [try the accompanying STEGASURAS demo](https://steganography.live/).

### 5. Self-adjusting arithmetic coding: adapt the candidate pool

[Self-Adjusting Arithmetic Coding (SAAC)](https://steganography.live/reading-list/papers/saac/) by Jiaming Shen, Heng Ji, and Jiawei Han (2020) builds on Ziegler, Deng, and Rush’s arithmetic-coding method. It adapts the number of candidate tokens at each generation step, selecting the smallest pool that meets the required divergence criterion relative to the original language model.

The change is the candidate-selection rule: a fixed top-K cutoff becomes an adaptive cutoff. The paper supplies an imperceptibility analysis and evaluates capacity, divergence, and human judgments. [Read SAAC’s construction and evaluation.](https://aclanthology.org/2020.emnlp-main.22/)

### 6. Minimum entropy coupling: preserve the cover marginal

[Perfectly Secure Steganography Using Minimum Entropy Coupling](https://steganography.live/reading-list/papers/minimum-entropy-coupling/) by Christian Schroeder de Witt and colleagues (ICLR 2023; preprint 2022) constructs a joint distribution coupling the message distribution with the chosen cover distribution. Keeping the cover marginal unchanged gives perfect security in its information-theoretic model. Minimum joint entropy maximizes information throughput among perfectly secure encoders.

The iterative implementation uses an approximate minimum-entropy coupling subroutine while retaining the marginal distributions. Its assumptions include a passive observer and unmodified transmission. [Read the paper’s coupling characterization, algorithm, and assumptions.](https://arxiv.org/abs/2210.14889)

## How to compare neural text steganography methods

- **For the coding mechanism:** compare bins, fixed-length codes, Huffman trees, probability intervals, and couplings. Ask how each secret bit influences the next token and how the receiver reverses it.

- **For distribution control:** compare patient-Huffman’s decision to skip embedding, SAAC’s adaptive candidate pool, and coupling’s preservation of the cover marginal.

- **For capacity and text quality:** compare methods with the same language model, context, and evaluation setup. Ziegler, Deng, and Rush reimplement block and Huffman baselines with GPT-2 alongside arithmetic coding.

## Recoverability and security are separate requirements

For token-by-token arithmetic decoding, the sender and receiver reproduce the model probabilities, context, coding parameters, and token sequence. Retokenization mismatches change the intervals reconstructed by the decoder and lead to extraction errors. [Yan and Murawaki’s tokenization study](https://steganography.live/reading-list/papers/tokenization/) (2025) examines this problem and uses the 2019 arithmetic coder in its steganography experiments. [SyncPool](https://steganography.live/reading-list/papers/syncpool/) addresses ambiguous subword segmentation with synchronized sampling.

Matching a language model’s distribution does not establish indistinguishability from human writing. Report which cover distribution is preserved, the observer’s access, payload rate, text-quality measurements, and exact message-recovery success. See the guide to [capacity, detectability, and security](https://steganography.live/reading-list/guides/capacity-and-security/) for these distinctions.

## A reading path through the methods

Start with [bins](https://steganography.live/reading-list/papers/fang-2017/) and [Huffman coding](https://steganography.live/reading-list/papers/rnn-stega/), then study [distributional analysis](https://steganography.live/reading-list/papers/dai-cai-2019/), [neural arithmetic coding](https://steganography.live/reading-list/papers/neural-linguistic-steganography/), [adaptive truncation](https://steganography.live/reading-list/papers/saac/), and [coupling-based security](https://steganography.live/reading-list/papers/minimum-entropy-coupling/). Each paper page includes authors, publication dates, primary sources, and citation downloads.

[Read this guide as Markdown](https://steganography.live/reading-list/guides/neural-text-steganography-methods/index.md) · [Browse the bibliography](https://steganography.live/reading-list/papers/)