$\mathbf{S^2LM}$: Towards Semantic Steganography via Large Language Models

Huanqi Wu; Huangbiao Xu; Yongliang Xu; Jiaxin Cai; Xiao Ke; Hang Cheng

cs.CVNov 7, 2025

$\mathbf{S^2LM}$ : Towards Semantic Steganography via Large Language Models

Authors: Huanqi Wu, Huangbiao Xu, Yongliang Xu, Jiaxin Cai, Xiao Ke, Hang Cheng

Organizations: College of Computer and Data Science, Fuzhou University, Fuzhou 350108, China

Abstract

Despite remarkable progress in steganography, embedding sentence-level information into cover media remains challenging. In this work, we present the concept of Semantic-Payload Steganography, which aims to hide semantically meaningful and structured content, such as sentences, in cover media. Based on this concept, we present Sentence-to-Image Steganography as an instance that enables the hiding of sentence-level messages within a cover image. To accomplish this feat, we propose Semantic-Payload Steganographic Language Model ( $\mathbf{S^2LM}$ ), which leverages large language models to embed high-level textual information into images. $\mathbf{S^2LM}$ redesigns the entire pipeline, involving the LLM throughout the process to enable the hiding and recovery of sentences. To evaluate semantic-payload steganography methods, we establish a benchmark named Invisible Text (IVT), comprising a diverse set of corpus as secret messages. Experimental results demonstrate that $\mathbf{S^2LM}$ effectively recovers natural-language messages while maintaining high visual quality. The source code will be released at https://github.com/aoli-gei/S2LM.

Figures & tables

Fig. 1: Overview of our $\mathrm{S^{2}LM}$ framework vs. existing frameworks. We divide the pipeline in three processes and show the difference between the existing methods and our $\mathrm{S^{2}LM}$ framework.

Aspect	Semantic Steganography (Bai [ 52 ] )	Semantic-Payload Steganography (Ours)
Payload	Bitstream	Natural-language message
Role of semantics	Carrier property	Payload content
Cover media	Natural-language text	Images/other cover media
Specific task	Linguistic steganography	Sentence-to-image steganography

TABLE I: Comparison of prior semantic steganography and our semantic-payload steganography.

Fig. 2: Pipeline of the $\mathrm{S^{2}LM}$ framework. We use an embedding prompt to guide the LLM to encode the secret message into secret message embeddings (SMEs). The token-to-patch MLP maps the SMEs to a patch representation, which is reshaped into an image embedding and added to the cover image to form the stego image. The patch-to-token MLP converts patches of the stego image into token embeddings. We use a decoding prompt to guide the same LLM to autoregressively recover the secret message from these embeddings.

Fig. 3: Prompt templates used in the embedding and decoding procedures of

\mathrm{S^{2}LM}

Fig. 4: Two-stage training strategy for $\mathrm{S^{2}LM}$ .

Methods	IVT-S						IVT-M						IVT-L
	Secret/Recovery				Cover/Stego		Secret/Recovery				Cover/Stego		Secret/Recovery				Cover/Stego
	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM
StegaStamp (CVPR 20)	0.994	0.002	0.002	0.120	40.4	0.927	-	-	-	-	-	-	-	-	-	-	-	-
FPGP (TCSVT 26)	0.150	0.882	0.925	0.914	43.5	0.954	0.958	0.096	0.069	0.124	36.4	0.885	-	-	-	-	-	-
LanNet (AAAI 23)	0.004	0.906	0.997	0.996	42.1	0.951	0.244	0.698	0.836	0.787	41.3	0.949	0.995	0.031	0.088	0.130	40.9	0.941
CRMark (ICCV 25)	0.003	0.904	0.994	0.994	47.3	0.985	0.185	0.724	0.862	0.894	40.5	0.914	0.972	0.042	0.105	0.169	37.6	0.825

TABLE II: Quantitative results on the IVT-S, IVT-M, and IVT-L benchmarks.

Fig. 5: Qualitative results of $\mathrm{S^{2}LM}$ -Qwen2.5-0.5B on different lengths of secret messages.

Methods	IVT-S	IVT-M	IVT-L
$\mathrm{S^{2}LM}$ -Qwen2.5-0.5B	89.5%	83.6%	81.8%
StegaStamp	0.0%	-	-
FPGP	76.2%	0.0%	-
LanNet	92.2%	36.8%	0.0%
CRMark	93.7%	32.3%	0.0%

TABLE III: Exact recovery rate on IVT-S, IVT-M, and IVT-L.

	IVT G -S						IVT G -M						IVT G -L
Methods	Secret/Recovery				Cover/Stego		Secret/Recovery				Cover/Stego		Secret/Recovery				Cover/Stego
	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM	WER	BLEU	ROUGE	BERT-S	PSNR	SSIM
S 2 LM -Qwen2.5-0.5B	0.040	0.911	0.944	0.953	41.6	0.960	0.034	0.933	0.963	0.966	39.1	0.984	0.047	0.916	0.959	0.958	40.2	0.968
S 2 LM -MiniCPM-1B	0.040	0.935	0.972	0.977	42.4	0.988	0.040	0.939	0.973	0.976	42.5	0.987	0.054	0.919	0.963	0.963	42.8	0.984
S 2 LM -Llama3.2-1B	0.037	0.916	0.947	0.961	45.6	0.991	0.039	0.887	0.920	0.938	46.6	0.989	0.040	0.903	0.942	0.914	43.1	0.988
S 2 LM -Gemma3-1B	0.067	0.767	0.819	0.866	43.5	0.980	0.096	0.832	0.857	0.893	43.6	0.977	0.157	0.852	0.864	0.873	39.2	0.932

TABLE IV: Quantitative results on the IVT G -S, IVT G -M, and IVT G -L benchmarks.

Fig. 6: The results of the deep-steganalysis. Note that the closer the accuracy is to 50%, the stronger its resistance to steganalysis.

Methods	WER	BLEU-4	ROUGE	BERT-S	PSNR	SSIM
$\mathrm{S^{2}LM}$ -Qwen2.5-0.5B-8bit	0.201	0.804	0.882	0.907	40.05	0.946

TABLE V: Result on the IVT-L of 8-bit quantized

\mathrm{S^{2}LM}

-Qwen2.5-0.5B.

Fig. 7: The ROC curve produced by StegExpose.

No.	Two-Stage Training	Prompt	Embedding Loss	Mask Strategy	Secret / Recovery				Cover / Stego
No.	Two-Stage Training	Prompt	Embedding Loss	Mask Strategy	WER	BLEU-4	ROUGE-L	BERT-S	PSNR	SSIM
1					0.3162	0.5925	0.6781	0.6816	34.13	0.8156
2	✓				0.2210	0.6819	0.7403	0.8051	32.93	0.8460
3	✓	✓			0.2200	0.7319	0.7965	0.8295	31.41	0.8248
4	✓	✓	✓		0.2139	0.5676	0.6606	0.7465	45.25	0.9839
5		✓	✓	✓	0.2381	0.6703	0.7496	0.8119	34.24	0.7820

TABLE VI: Ablation study of the module in the

\mathrm{S^{2}LM}

framework.

Fig. 8: The Visualization of SMEs w/ or w/o mask strategy, which are enhanced by $5\times$ for better visualization.

Language Model Steganography

See all 23 papers

Style as Cover: Deep Image Steganography via Stylized Transmission
Sep 18, 2026Qi Li, Jidong Yang, Huaike Yu +6
Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Electrical, Electronic and Computer Engineering, The University of Western Australia, Perth, WA 6009, Australia +1
Text Steganography with Dynamic Codebook and Multimodal Large Language Model
Apr 22, 2026Jianxin Gao, Ruohan Lei, Wanli PengLLM Security Language Model Steganography
China Agricultural University Beijing, China
Steganography Without Modification: Hidden Communication via LLM Seeds
Jun 8, 2026Felix Mächtle, Jonas Sander, Sebastian Berndt +3Language Model Decoding LLM Inference
Institute for IT Security, University of Lübeck, Lübeck, Germany · Technische Hochschule Lübeck, Lübeck, Germany

Sep 18, 2026J/K move · Enter open · S save

Style as Cover: Deep Image Steganography via Stylized Transmission

Qi Li, Jidong Yang, Huaike Yu, Chunpeng Wang+5

Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Electrical, Electronic and Computer Engineering, The University of Western Australia, Perth, WA 6009, Australia+1

Open paper AskPDF arXiv

Image steganography hides secret message within normal images, with most existing works relying on cover-preserving transmission. However, such a paradigm becomes vulnerable once the original cover is exposed or can be reliably approximated. In this paper, we propose StyleStegaNet, a stylized image hiding framework that replaces cover matching with style-concealment transmission. Instead of transmitting a cover-like stego image, StyleStegaNet generates stylized stego images conditioned on publicly available style references, redefining steganography invisibility from cover-preserving concealment to behavior-level camouflage based on style transformation. Such a setting poses a substantial challenge to reliable secret recovery, since neural stylization can significantly alter the feature statistics exploited by deep hiding methods. To address this challenge, StyleStegaNet decouples the overall task into four coordinated stages: stego generation, stylized transmission, structure-preserving reconstruction, and secret recovery. Moreover, StyleStegaNet is optimized with a progressive three-stage training strategy, in which wavelet-domain constraints and perceptual supervision guide the recoverable information toward structural representations. We further provide an analysis showing that secret recoverability is largely restricted to the normalized structural subspace, offering a mechanistic explanation for why directly stylized baselines fail and why a reconstruction-guided recovery path is necessary. Extensive experiments on DIV2K and MS-COCO datasets demonstrate the effectiveness of StyleStegaNet. And few-shot image steganalysis with two deep detectors further shows detection accuracy near random guessing, approximately 51%.

Abstract

Language Model Steganography

Explore similar work

Style as Cover: Deep Image Steganography via Stylized Transmission

Text Steganography with Dynamic Codebook and Multimodal Large Language Model

Steganography Without Modification: Hidden Communication via LLM Seeds