cs.CRAug 29, 2026
SaveA Comprehensive Survey on Linguistic Steganography: Methods, Countermeasures, Evaluation, and Challenges
Organizations: Graduate School of Informatics, Kyoto University · School of Cyberspace Security, Beijing University of Posts and Telecommunications
Abstract
Linguistic steganography hides secret messages in natural language text. Large language models (LLMs) have reshaped the field, but a systematic account of how these scattered advances collectively reshape the field in this new era is still missing. We provide one along four axes: 148 steganographic methods, 60 linguistic steganalysis countermeasures, 23 evaluation metrics, and 9 open challenges, each with taxonomies, reviews, and adoption analyses. Cutting across these axes, we identify five specific paradigm shifts in the LLM era: (1) from covertext modification to prompt-only generation, (2) from heuristic to provable security, (3) from white-box symmetric LMs to black-box or asymmetric access, (4) from security-centric designs to joint optimization, and (5) from text-quality concerns to engineering issues. The survey aims to serve as both a reference and a roadmap for practical and responsible linguistic steganography in the LLM era.
Figures & tables
Figure 1: An overview of how to achieve linguistic steganography based on two main frameworks.
| Survey | Year | Steganographic methods | Steganalysis methods | Evaluation metrics | |||
| Number | Categories (L1/L2/L3) | Number | Categories (L1/L2) | Number | Categories (L1/L2) | ||
| Majeed et al. (2021) | 2021 | 50 | 3 | – | – | – | – |
| Xiang et al. (2022b) | 2022 | 37 | 4/11/– | – | – | 11 | 4/– |
| Badawy et al. (2023) | 2022 | 18 | – | – | – | 12 | 3/– |
| Wu et al. (2024a) | 2023 | 28 | 2/4/8 | 29 | 2/7 | 8 | – |
| Ours | 2026 | 148 | 2/6/17 | 60 | 2/8 | 23 | 3/6 |
Table 1: Quantitative comparison of this survey with existing surveys, in which “–” indicates that relevant information on this dimension is not substantially or formally provided in the survey, and “L1/L2/L3” denotes the layer 1st/2nd/3rd for categorization.
| Survey | Steganalysis taxonomy | Evaluation taxonomy | Robustness consideration | Analyses of targeted metrics | Analyses of metric adoption | Analyses of steganalysis adoption | Features of the LLM era |
| Majeed et al. (2021) | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Xiang et al. (2022b) | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Badawy et al. (2023) | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ |
| Wu et al. (2024a) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Ours | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Table 2: Qualitative comparison of this survey with existing surveys.
Figure 4: Modification-based steganographic methods which are categorized into three types, where an example is shown in each type.
Figure 5: Overall framework of generative linguistic steganography, in which the example is operated autoregressively based on the Huffman coding.
| Method | Dist. unchanged (KL = 0)? | Complexity (per token) | Mode |
| ADG Zhang et al. (2021b) | ✗ | Stream | |
| Meteor Kaptchuk et al. (2021) | ✗ | , with reorder | Stream |
| iMEC de Witt et al. (2023) | ✓ | Block | |
| Discop Ding et al. (2023) | ✓ | , with reorder | Stream |
| SparSamp Wang et al. (2025a) | ✓ | Block | |
| RRC Yan and Murawaki (2026) | ✓ | , with reorder | Block |
Table 3: Methodology features of provably secure linguistic steganographic methods. The Dist. unchanged (KL = 0) column marks whether the method keeps the original distribution at each generation step. In the complexity column, denotes the number of candidate tokens considered at each step; denotes the entropy of the next-token distribution ; denotes the block size used by block-mode methods.
| Method | Strict 100% correctness? | Dist. unchanged (KL = 0)? | Complexity (per token) |
| Basic Nozaki and Murawaki (2022) | ✓ | ✗ | |
| MWIS Yan et al. (2023) | ✓ | ✗ | |
| All-case verification Yan et al. (2024a) | ✗ | ✓ | |
| SyncPool Qi et al. (2025a) | ✓ | ✓ | |
| Stepwise verification Yan and Murawaki (2025) | ✓ | ✗ | |
| ReTokSync Wang et al. (2026a) | ✗ | ✓ |
Table 4: Methodology features of methods to tackle tokenization inconsistency. Strict 100% correctness column marks whether the method can 100% eliminate extraction errors caused by tokenization inconsistency. The Dist. unchanged (KL = 0) column marks whether the method keeps the original distribution at each generation step. In the complexity column, denotes the number of candidate tokens considered at each step; denotes the number of generated tokens in the real-time sequence.
Figure 7: A sketch of how Eve operates steganalysis.
| Method | Training-free? | LoRA-based fine tuning? | Technique keyword |
| Yang et al. (2024a) | ✗ | ✓ | Human-like perception |
| Bai et al. (2024a) | ✓ | ✗ | Few shots; black box |
| Tang et al. (2025) | ✗ | ✓ | Generation-classification hybrid |
| Wang et al. (2025d) | ✗ | ✓ | Knowledge graphs |
| Barlow (2026) | ✗ | ✓ | Multi-feature extraction |
Table 5: Methodology features of linguistic steganalysis methods which are adaptable to LLMs.
| Feature | Steganography | Cryptography | Watermarking |
| Goal | Hide the existence of communication | Protect the content of communication | Assert ownership or authenticity |
| Carrier | Multimedia | Plaintext ciphertext | Multimedia |
| Visibility | Definitely not (ideally undetectable) | Obvious (ciphertext is visible) | Optional (depending on the watermarking type) |
| Adversary | Detect whether a given object contains hidden information | Recover the plaintext or secret key from the ciphertext | Destroy, alter, or remove the embedded watermark without significantly degrading the carrier quality |
| Robustness | Important (but optional in some work) | Strong against brute force | Designed to withstand distortion |
| Uses | Covert messaging, censorship evasion | Secure communication, authentication | Copyright protection, forensic tracking, digital rights management (DRM) |
Table 6: Comparison of steganography, cryptography, and watermarking.
Figure 10: Common procedures of both sides (Alice and Bob) in steganography, cryptography, and watermarking.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 11: Adoption rates of the 15 major evaluation methods in 95 papers on modern generative linguistic steganography, presented in chronological order. Among these 95 papers, 22 were published before 2021, 17 between 2022 and 2023, 20 in 2024, and 36 after 2025.
| Year | Reference | Targeted metric(s) | Scenario(s) | Backbone model(s) | LLM-adaptable? | Training-free? | Asymmetric? | Black-box? |
| 2017 | Fang et al. (2017) | Security | General | LSTM | ✗ | ✗ | ✓ | ✗ |
| 2017 | Luo and Huang (2017) | Efficiency | Lyric | LSTM | ✗ | ✗ | ✗ | ✗ |
| 2018 | Yang et al. (2018) | Security | General | Markov | ✗ | ✗ | ✗ | ✗ |
| 2019 | Yang et al. (2019a) | Security | General | LSTM | ✗ | ✗ | ✗ | ✗ |
| 2019 | Ziegler et al. (2019) | Security | General | Model-agnostic | ✓ | ✓ | ✗ | ✗ |
| 2019 | Dai and Cai (2019) | Security | General | Model-agnostic | ✓ | ✓ | ✗ | ✗ |
Table 7: Taxonomy for generative linguistic steganographic methods based on methodology features.
| Year | Reference | Backbone model | Based on pre-trained model(s)? | LLM-adaptable? | Experiments on IMDB dataset Maas et al. (2011) ? | Experiments on Twitter dataset Go et al. (2009) ? | Experiments on News dataset Kaggle (2017) ? | Experiments on other dataset(s)? |
| 2019 | Yang et al. (2019b) | Feed-forward neural networks | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2019 | Niu et al. (2019) | Bi-LSTMs; CNNs | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ |
| 2019 | Yang et al. (2019c) | Bi-RNNs; LSTMs | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ |
| 2019 | Wen et al. (2019) | Word2vec; CNNs | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2020 | Yang et al. (2020c) | CNNs | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2020 | Yang et al. (2020a) | Bi-LSTMs | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ |
Table 8: Methodology features and experiment datasets of linguistic steganalysis methods.
| Year | Reference | FCN Yang et al. (2019b) | CNN Wen et al. (2019) | R-BiLSTM-C Niu et al. (2019) | TS-RNN Yang et al. (2019c) | TS-CSW Yang et al. (2020c) | Other |
| 2017 | Fang et al. (2017) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2017 | Luo and Huang (2017) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2018 | Yang et al. (2018) | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2019 | Yang et al. (2019a) | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2019 | Ziegler et al. (2019) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2019 | Dai and Cai (2019) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
Table 9: Adopted steganalysis methods to evaluate imperceptibility of the generative linguistic steganographic methods.
| Year | Reference | PPL | KLD (step-level) | KLD (text-level) | BLEU | ROUGE | METEOR | Diversity | Human evaluation | LLM-as-a-judge | Other |
| 2017 | Fang et al. (2017) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2017 | Luo and Huang (2017) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ |
| 2018 | Yang et al. (2018) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2019 | Yang et al. (2019a) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| 2019 | Ziegler et al. (2019) | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ |
| 2019 | Dai and Cai (2019) | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
Table 10: Adopted metrics (excluding steganalysis) to evaluate steganographic security, including the imperceptibility, and the text quality of stegotexts based on generative linguistic steganographic methods.
| Year | Reference | Bits per token | Entropy utilization | Embedding rate | Operation speed | Error rate |
| 2017 | Fang et al. (2017) | ✓ | ✗ | ✗ | ✗ | ✗ |
| 2017 | Luo and Huang (2017) | ✗ | ✗ | ✓ | ✗ | ✗ |
| 2018 | Yang et al. (2018) | ✓ | ✗ | ✓ | ✗ | ✗ |
| 2019 | Yang et al. (2019a) | ✓ | ✗ | ✓ | ✓ | ✗ |
| 2019 | Ziegler et al. (2019) | ✓ | ✗ | ✗ | ✗ | ✗ |
| 2019 | Dai and Cai (2019) | ✗ | ✗ | ✗ | ✗ | ✗ |
Table 11: Adopted metrics to evaluate efficiency and robustness of the generative linguistic steganographic methods.