Linguistic steganography is the art of hiding secret information inside innocuous-looking text. In a typical covert communication scenario, a sender embeds a hidden message into seemingly normal sentences and transmits the resulting stegotext over a public channel, where the intended recipient recovers the payload. Unlike older modification-based approaches that alter existing documents, generative linguistic steganography embeds information directly during text generation, so that the statistical distribution of the stegotext remains close to that of ordinary language model output. This distribution-preserving property has become a foundational principle of provably secure linguistic steganography, because a message that leaves no statistical fingerprint cannot, in principle, be detected.

The new work targets a specific and increasingly important class of text generators: diffusion language models. Rather than predicting tokens one after another from left to right, as autoregressive models do, diffusion models progressively denoise noisy token states over many inference steps. At each denoising step, the model produces a token-level probability distribution for every position in the sequence. The researchers recognized that this iterative process exposes a whole trajectory of intermediate distributions, each one a potential embedding opportunity with its own entropy characteristics. Previous diffusion-based steganography methods, however, largely ignored this trajectory-level structure.

The team’s motivational study revealed the core problem. Analyzing candidate embedding positions across diffusion trajectories under their default settings, they found that embedding opportunities are highly sparse: the majority of denoising timesteps provide no valid candidates at all, and candidate-rich timesteps occur only occasionally. Existing token-level diffusion steganography methods such as STEAD perform embedding independently within each isolated timestep, which means that when a single step lacks enough compatible candidates, otherwise usable positions are simply wasted. This timestep-local design, the authors argue, is the fundamental bottleneck limiting embedding capacity.

TE-CSA’s answer is an accumulate-then-trigger strategy. Instead of consuming candidates immediately, the framework continuously extracts candidate positions from every denoising timestep and stores them in a global pending pool. When the pool contains at least three compatible positions, the framework constructs an embedding group from the three highest-capacity candidates. Because the same secret bit segment is redundantly embedded across the three positions, the effective capacity of each group is determined by its weakest member, the minimum capacity among the three. This group constraint is central to the paper’s theoretical analysis, in which the authors derive a trajectory-level capacity bound and prove that sorting candidates by capacity and grouping them consecutively attains that bound when the complete retained candidate set is available.

The second key ingredient is entropy-aware filtering. From an information-theoretic standpoint, not all candidate positions are equally valuable. Positions whose token distributions are highly concentrated, meaning the model is already nearly certain which token to place there, carry almost no usable uncertainty and act as bottlenecks: if such a low-capacity position joins an otherwise high-capacity group, it caps the group’s payload. Computing full Shannon entropy for every candidate would be expensive, so the framework uses a min-entropy-inspired approximation based on the maximum token probability, which requires only identifying the most probable token in each local distribution. Candidates whose estimated capacity falls below a threshold are removed before group construction. The strongest filtering configuration, TE-CSA-τ3, retains only positions with capacity of at least 4.

Embedding itself proceeds through distribution-preserving probabilistic sampling. The secret bit sequence is mapped into a continuous value in the interval from 0 to 1 using binary fraction encoding, and the token probability space at each candidate position is partitioned into cumulative intervals. The value falls into one interval, and the corresponding token is sampled under constraints that keep the selection consistent with the original diffusion distribution. Crucially, the authors emphasize that cross-step aggregation and entropy filtering only decide which candidate positions participate in embedding; they do not modify the token probabilities themselves. The security property is therefore inherited from the underlying interval-based embedding mechanism, a point the authors frame as conditional distribution-preserving security rather than unconditional provable security. During extraction, the receiver reconstructs the same candidate sets, filtering decisions, groups, and intervals to recover the message without altering the received text.

The experimental results are striking. Under the default generation setting of length 256, temperature 1.3, and top-p 0.98, the STEAD baseline achieved only 25.30 bits of embedding capacity, while TE-CSA variants reached 469.90 bits without filtering and 470.50 bits with the strongest filtering, an 18.60-fold improvement. The embedding rate rose from 0.09 to 1.84 bits per token, a 20.40-fold gain. Importantly, the improvement does not come from creating new entropy but from converting a far larger fraction of the embedding opportunities already scattered across the diffusion trajectory into effective embedding groups. Runtime overhead remained modest: encoding took 51.53 seconds for TE-CSA-τ3 versus 49.76 seconds for STEAD, because the framework requires no extra denoising iterations or auxiliary neural networks.

Quality and detectability held up as well. Measured by relative perplexity variation, the no-filter variant perturbed generation by 11.20 percent, but entropy-aware filtering cut that figure in half to 5.60 percent while leaving capacity essentially unchanged, validating the claim that low-entropy positions introduce disproportionate distortion for minimal gain. In steganalysis tests against three neural detectors, FCN, R-BiLSTM-C, and BiLSTM-Dense, detection error rates for TE-CSA-τ3 hovered near the 50 percent random-guessing level, at 50.10, 50.06, and 51.38 percent respectively, suggesting the evaluated detectors could barely distinguish stegotext from normal diffusion-generated text. The authors caution that these results characterize practical resistance under the selected detectors, not universal undetectability, and note that LLM-based steganalysis remains a future evaluation frontier.

The study also situates TE-CSA among competing approaches. GTSD, an earlier diffusion-based method, embeds information through prompt mapping and batch selection, with reported rates of roughly 1.56 to 3.94 bits per token depending on configuration, while CascSamp achieves 3.42 bits per token on an autoregressive backbone. TE-CSA reaches a comparable order of magnitude within the more constrained token-level diffusion setting, without requiring pre-shared prompt tables or external mapping resources. The authors acknowledge limitations: the framework depends on trajectories with sufficient candidate diversity, its fixed thresholds may be suboptimal under dynamic generation conditions, and adaptive parameter selection could further improve the capacity-quality-efficiency trade-off. Future directions include extending the approach to other diffusion architectures, longer texts, and multimodal diffusion generation, as well as testing against more advanced steganalyzers.

Subject of Research: High-capacity distribution-preserving linguistic steganography in diffusion language models using trajectory entropy-aware cross-step aggregation

Article Title: TE-CSA: trajectory entropy-aware cross-step aggregation for improving embedding capacity of distribution-preserving linguistic steganography

Article References: TE-CSA: trajectory entropy-aware cross-step aggregation for improving embedding capacity of distribution-preserving linguistic steganography. (n.d.). https://doi.org/10.1186/s42400-026-00668-2

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00668-2

Keywords: linguistic steganography, diffusion language models, information hiding, entropy, embedding capacity, distribution preservation, cybersecurity, text generation, steganalysis, information theory, covert communication, natural language processing

The work, authored by Rupa Jamatia and Bubu Bhuyan of the Department of Information Technology, addresses one of the oldest tensions in the field. Steganography differs from encryption in a crucial way: cryptography scrambles a message so that intercepted text is unreadable, but the interception itself is obvious. Steganography instead hides the existence of the message. A secret payload is embedded inside an innocuous cover object, in this case a color image, so that anyone observing the traffic sees only an ordinary photograph. The price of that concealment is fragility. If the embedding process disturbs the cover image too much, statistical artifacts appear, and modern steganalysis tools can flag the image as suspicious. The art lies in embedding as much data as possible while leaving the smallest possible fingerprint.

The most straightforward way to hide bits in an image is least significant bit, or LSB, replacement. In a typical 24-bit color image, each pixel stores one byte each for its red, green and blue intensities. Flipping the lowest-order bit of a byte changes the intensity by at most one unit out of 255, a difference far below what the human eye can perceive. Sequential LSB embedding, however, has a well-known weakness: if the sender fills pixel after pixel in raster order, the hidden data occupies a predictable, contiguous region of the image. Steganalysis tools exploit exactly this regularity, scanning for zones where the statistical behavior of the least significant bits deviates from natural image noise. Randomizing where the bits land is therefore a central defense, and it is the pivot of the new study.

Jamatia and Bhuyan’s framework uses the XORShift64 generator, a pseudorandom number generator introduced by George Marsaglia in 2003, to decide which pixels receive secret bits. XORShift64 belongs to a family of generators prized for their extreme simplicity: the state is updated by a handful of bitwise exclusive-OR and shift operations, which modern processors execute in a few nanoseconds. The authors emphasize that the generator itself is a commonly used primitive; their contribution lies in how it is integrated into the embedding strategy. By seeding the generator and using its output to select pixel positions unpredictably, the scheme ensures that an adversary who does not know the seed cannot reconstruct the sequence of modified pixels, and the scattered, irregular pattern of changes minimizes the detectability of the resulting stego image. The computational overhead, they note, is minimal, which matters for practical deployment on constrained devices.

Capacity is the second pillar of the method. Rather than embedding a single bit per pixel, the XS-RPVI approach writes message bits into the least significant bits of all three color channels, red, green and blue, achieving three bits per pixel. That tripling of payload means a cover image can carry substantially more secret data before the sender must reach for a larger photograph, and larger covers themselves can attract attention. The trade-off, of course, is that modifying three bits per pixel distorts the cover more than modifying one, so the scheme must demonstrate that the resulting images still look and measure as natural. The authors report that the approach balances imperceptibility, visual fidelity and embedding capacity, preserving the perceptual quality of the original images even at the full three-bit payload.

Measuring that preservation requires standardized image quality metrics, and the study leans on the established toolkit of the field. Peak signal-to-noise ratio, or PSNR, quantifies the numerical difference between the cover and stego images, with higher values indicating smaller distortion; values above roughly 40 decibels are conventionally considered evidence that modifications are visually negligible. The structural similarity index, SSIM, goes further by modeling how human vision judges changes in luminance, contrast and structure, while the feature similarity index, FSIM, compares low-level visual features. The literature the authors cite, including comparative studies of these metrics and analyses of their use specifically in steganography evaluation, reflects a consensus that imperceptibility must be assessed both numerically and perceptually, since a stego image that passes one metric can still fail another.

Imperceptibility alone is not enough, because a hidden message that survives human scrutiny may still betray itself to statistical analysis. The authors evaluated their scheme against three classic detection tests. Visual inspection confirmed that stego images show no discernible artifacts. Histogram analysis examined the distribution of pixel intensities: natural images have characteristic, often smooth histograms, and naive embedding tends to produce telltale pairing effects in which adjacent intensity values converge in frequency. Chi-square distance tests, rooted in the statistical method Karl Pearson developed in the nineteenth century, compare the observed distribution of least significant bit values against the expectations of a natural image, flagging images whose bit planes look artificially uniform. The experimental evaluations showed that the proposed method withstands detection through all three tests, and comparative analyses with existing techniques further validated its robustness and reliability in concealing information while preserving visual fidelity.

The design choices sit within a rich research lineage that the paper’s bibliography traces in detail. Early combinations of cryptography and pseudorandom numbers for steganography date back more than a decade, and subsequent work refined random pixel selection, explored interpolation-based embedding, pursued lowest-distortion LSB schemes, and brought in error-correcting codes such as Hamming codes to raise capacity adaptively. More recent contributions have applied genetic algorithms to cover image selection, combined random pixel and bit selection for high payloads, and embedded encrypted text within color images using randomized pixel ordering. Parallel work in the same journal has explored chaotic maps for image ciphering and new high-capacity, high-security steganographic schemes. Against this backdrop, the Shillong study’s use of a lightweight, well-understood generator like XORShift64 is a pragmatic argument: security through unpredictability does not require exotic mathematics, only a well-integrated source of pseudorandomness and careful attention to where the bits go.

The practical implications extend to any scenario in which the confidentiality of transmitted images is paramount. The authors point to sensitive image exchange and information protection as the applications where the technique’s strong concealment capability and computational efficiency show the most promise. In an era when the paper’s own framing describes escalating cybersecurity threats driven by increasingly sophisticated attack techniques and a growing reliance on the internet for extensive data sharing, covert channels embedded in ordinary media offer a complementary layer of defense: even if an encrypted file is intercepted, an observer cannot be sure that a routine photograph does not also carry a hidden payload. The method’s low computational cost makes it suitable for embedding and extraction on everyday hardware, and its three-bit-per-pixel capacity reduces the number of cover images needed for a given volume of secret data.

Like all spatial-domain LSB methods, the approach inherits the field’s standing caveats. The study reports resistance to visual, histogram and chi-square analyses, but the steganalysis arms race continues, with machine-learning detectors constantly improving at recognizing even faint embedding traces, and robustness against image transformations such as compression or resizing remains a separate question from undetectability. The authors’ contribution is nonetheless a clear demonstration of a principle that has governed information hiding since Claude Shannon laid the mathematical foundations of communication theory in 1948: uncertainty in the mind of the adversary is a resource, and it can be manufactured cheaply. By spending a few bitwise operations per pixel to decide where each secret bit lands, the XS-RPVI framework turns one of the oldest tricks in digital steganography into a harder target for the tools that hunt it, and it does so while leaving the photograph, to every eye and every standard test, exactly what it seems.

Subject of Research: Image steganography using XORShift64-based random pixel selection for secure data hiding in color images

Article Title: Image steganography: emphasizing bit encoding positions for secure communication

Article References: Jamatia, R., & Bhuyan, B. (2026). Image steganography: emphasizing bit encoding positions for secure communication. Multimedia Tools and Applications, 85(10), Article 806. https://doi.org/10.1007/s11042-026-21962-8

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21962-8

Keywords: steganography, image steganography, LSB embedding, XORShift64, pseudorandom number generator, information hiding, steganalysis, chi-square test, PSNR, SSIM, data security, spatial domain

The dominant way organizations let AI query their databases is a technique called Text-to-SQL. The language model receives the full schema definition of the database, including every table and column name, and then writes SQL queries directly against it. The problem is that this approach hands the model everything: cryptic column identifiers, proprietary encoding schemes, and business logic embedded in the schema itself. In a credit rating context, transmitting such details to an external API endpoint constitutes exactly the kind of cross-boundary data transfer that network segregation laws are designed to prevent. The proposed alternative is a Semantic Layer, an abstraction interface borrowed from business intelligence architecture that sits between the model and the database, exposing only curated business concepts such as dimensions and measures while supposedly keeping raw schema details hidden inside the organization.

The intellectual pedigree of this idea traces back to David Parnas’s celebrated 1972 principle of Information Hiding, which holds that software modules should conceal their internal implementation details behind minimal, stable interfaces. In theory, a Semantic Layer instantiates this principle at the AI boundary: the model sees concepts like region and average salary, never the underlying physical columns they map to. But Yang’s study delivers a striking and cautionary finding. Whether the abstraction actually hides anything depends on an implementation detail that a schema-level analysis alone cannot reveal: whether the mapping from business concepts back to physical SQL is itself included in the prompt sent to the model.

The initial implementation examined in the study, labeled v1, looked entirely reasonable on paper. Its prompt contained elegant, human-readable concept definitions in which raw identifiers like A3 and A11 were replaced with meaningful names. But the same prompt also included a SQL mapping reference translating each concept back to its physical expression, along with a listing of physical table and column names needed to compose valid joins. When Yang performed an exhaustive verification of the complete payload actually transmitted to the model, checking every token across all benchmark questions, the result was damning: all fifteen sensitive column identifiers that the concept layer was nominally designed to hide were present in the prompt. Measured at the payload level, v1 achieved precisely zero reduction in schema exposure compared with raw Text-to-SQL.

The corrected implementation, v2, takes a fundamentally different approach. The model receives only concept names, their descriptions, and concept-level join relationships, and is instructed to respond using abstract concept references rather than physical SQL. A local compiler, running inside the organization and never exposed to the model, resolves those references into physical SQL after the API response returns. Verified exhaustively across the full benchmark, v2 removes all fifteen designated schema identifiers from the LLM-facing payload. The lesson Yang draws is pointed: information hiding at an AI interface is achieved by the complete prompt an implementation sends, not by the presence of concept-level names somewhere within it, and verifying it requires payload-level auditing rather than inspection of the abstraction layer’s design in isolation.

What about accuracy, the other half of the dilemma? Here the results are more nuanced and, in places, genuinely surprising. The study evaluated three conditions, Text-to-SQL, Semantic Layer v1, and v2, across three model tiers spanning a capability range, on two benchmarks. On a purpose-built credit-rating benchmark of sixty questions across six credit risk categories, designed alongside the Semantic Layer specification itself, v2’s accuracy improved steadily with model capability, rising from 38.7 percent at the weakest tier to 60.7 percent at the strongest, where it was numerically the highest of the three conditions, ahead of v1 at 58.7 percent and Text-to-SQL at 52.0 percent. Yang is careful to note that with only sixty questions, this strongest-tier advantage does not reach statistical significance, so the corrected architecture should be read as matching, not definitively beating, its baselines while additionally achieving full schema-identifier removal.

The picture changes dramatically on an externally authored benchmark, the financial subset of the well-known BIRD dataset, evaluated against the same underlying Czech banking schema. There, v2 trailed both baselines at every single model tier, and the gap between the in-specification benchmark and the external one widened as model capability increased. Yang attributes this deficit largely to genuine limitations of the v2 compiler and specification when confronted with question types they were never designed to handle, rather than to simple implementation defects. The author names this pattern selective encapsulation: some concepts benefit enormously from abstraction, particularly those with opaque encodings like single-character loan status codes, while others, such as already-transparent date fields, gain nothing from an extra layer of indirection. Crucially, it is presented as an empirical design lesson rather than a predictive theory.

The failure analysis contains perhaps the most operationally consequential insight of the entire study. At the weakest model tier, nearly half of v2’s outputs failed to compile or execute at all, a highly visible failure mode that falls steeply as capability rises, dropping to just 11 percent at the strongest tier. But the rate of wrong-but-executable results, queries that run successfully yet return incorrect answers, moved in the opposite direction, reaching over a third of generations at the stronger tiers. Unlike compile errors, these silent failures cannot be caught automatically before a result reaches an analyst. In other words, upgrading to a more capable model reduces the visible failure rate while leaving, or even increasing, the invisible one, a counterintuitive trap for any organization deploying these systems in high-stakes settings.

A component ablation added further practical texture. Removing few-shot examples from the v2 prompt caused a significant accuracy decline and nearly doubled the compile-error rate, while removing natural-language business descriptions made no significant difference. The few-shot examples, not the richness of the concept descriptions, emerged as the primary driver of the corrected architecture’s accuracy. Yang also withdrew two claims from the original submission: a purported theoretical extension of Information Hiding, which merely restated a standard engineering requirement, and a characterization of the results as evidence for the so-called Jagged Frontier of AI capabilities, since a smooth decline in accuracy with task difficulty does not establish the irregular capability boundary that concept actually describes.

The study’s practical message for regulated financial institutions is deliberately conditional rather than promotional. A correctly implemented Semantic Layer can achieve full schema-level information hiding without a detectable aggregate accuracy cost, but only when the specification is designed and maintained against the target query workload, and the benefit does not transfer automatically to new question distributions, even on the same database. Yang recommends treating specification design as an ongoing engineering task, including a task-type audit of which query categories are adequately covered, prioritizing compiler engineering for the join-path resolution failures that persist across all model tiers, and establishing human-review protocols specifically aimed at catching wrong-but-executable results. To enable independent scrutiny, the author has released the first domain-specific natural-language-to-SQL benchmark for credit rating contexts, complete with gold queries and an execution-based self-check, alongside all code and consolidated results. Whether these findings, obtained on a single schema with models from a single vendor, extend to proprietary rating databases and other model families remains an open question, but the core warning stands: at the AI boundary, security is not what your architecture looks like, it is what your payload actually contains.

Subject of Research: Semantic Layer architectures for reducing schema identifier exposure in LLM-based database querying in credit rating contexts

Article Title: A semantic layer architecture for removing schema identifiers from external LLM prompts, with model-dependent accuracy trade-offs

Article References: Yang, M. (2026). A semantic layer architecture for removing schema identifiers from external LLM prompts, with model-dependent accuracy trade-offs. Discover Artificial Intelligence, 6(1), Article 1374. https://doi.org/10.1007/s44163-026-02147-6

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02147-6

Keywords: semantic layer, large language models, Text-to-SQL, information hiding, schema identifier exposure, credit rating agencies, data security, selective encapsulation, BIRD benchmark, prompt architecture, model-dependent accuracy, AI compliance