Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

The scheme's core mechanism samples a candidate set of tokens at each generation step and constructs a bijective map from possible message bit strings to those tokens. Selecting the output token via this map provably preserves the original model's sampling distribution, yielding output that is computationally indistinguishable from unmodified model output.

Abstract / core mechanism defense

Correct decoding is achieved by handling collision cases — where multiple candidate bit-string messages map to the same candidate token — through a dynamic collision set that is maintained and strategically expanded within a bounded size range across generation steps.

Abstract / §3 defense

Across three real-world text datasets and three large language models, the adaptive dynamic sampling scheme achieves efficiency and capacity comparable to existing PSS methods that require explicit model distributions — confirming that relaxing the distribution-access requirement does not degrade steganographic performance.

Abstract / Evaluation evaluation

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape

BM-Net achieves a 97.5% macro-F1 score for fine-grained classification of three modulation geometries (sinusoidal, square-wave, triangular) from noisy exit-side Tor observations using only 201 labeled test samples collected across cross-continental Tor paths. Residual errors concentrate between natural traffic and square-wave modulation, as abrupt low-rate transitions are partially smoothed by Tor multiplexing and network jitter. Per-class F1 is 95.7% for square-wave, the hardest class, versus 99.0% each for sinusoidal and triangular.

2026-fan-activeflowmark-assessing-tor §VI-D, Table V flow-correlationml-classifiertraffic-shape

The host-profiling censor (passive traffic analysis: count connections per server, block those exceeding a threshold τ within a window w) blocks essentially all circumvention user traffic within 30 time steps for all classifier qualities tested (ρ_TP ∈ {0.9, 0.95, 0.99}), while causing far less collateral damage than zig-zag (never exceeding ~30% innocent server blocking). Snowflake resists this attack well: with w=3, τ=3, over 94.48% of users receive a proxy within 2 steps even with worst-classifier rules, and final unblocked server rates are 91.24–99.04%. The host profiling approach is feasible for passive censors who cannot enumerate the distribution channel.

2026-fares-game §5.2, Table 2, Table 3 traffic-shapeml-classifier