Correct decoding is achieved by handling collision cases — where multiple candidate bit-string messages map to the same candidate token — through a dynamic collision set that is maintained and strategically expanded within a bounded size range across generation steps.

The scheme's core mechanism samples a candidate set of tokens at each generation step and constructs a bijective map from possible message bit strings to those tokens. Selecting the output token via this map provably preserves the original model's sampling distribution, yielding output that is computationally indistinguishable from unmodified model output.

Abstract / core mechanism defense

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

Abstract / §1 Introduction defense

Across three real-world text datasets and three large language models, the adaptive dynamic sampling scheme achieves efficiency and capacity comparable to existing PSS methods that require explicit model distributions — confirming that relaxing the distribution-access requirement does not degrade steganographic performance.

Abstract / Evaluation evaluation