Auto-Stega: Adaptive Text Steganography

• Auto-Stega is an agent-driven text steganography framework that dynamically evolves its embedding strategies at inference time to encode hidden messages.
• The system integrates multiple LLM-based modules—including generation, evaluation, and decoding—to achieve high embedding rates and semantic control.
• Empirical evaluations on diverse datasets show competitive performance using metrics like embedding rate, perplexity, and semantic similarity while ensuring low detectability.

Searching arXiv for recent and foundational papers on Auto-Stega and closely related generative steganography. Auto-Stega denotes an LLM-based text steganography framework in which steganographic strategy design is itself treated as an adaptive inference-time process rather than a fixed embedding rule. In the specific formulation of "Auto-Stega: An Agent-Driven System for Lifelong Strategy Evolution in LLM-Based Text Steganography" (Zhou et al., 8 Oct 2025), the system uses multiple LLM-based agents and a persistent strategy library to discover, retrieve, compose, evaluate, summarize, and update steganographic strategies over time. More broadly, the term also sits within a larger lineage of automatic or coverless steganography in which hidden information is embedded by synthesis rather than by modifying a preexisting carrier, as in automatic audio generation-based steganography (Yang et al., 2018), autoregressive image steganography (Zhang et al., 2021), black-box LLM text steganography (Wu et al., 2024), and optimized-distribution LLM steganography (Huang et al., 2024).

1. Conceptual scope and historical placement

Auto-Stega belongs to the generative or coverless branch of steganography. In this branch, the sender does not begin with a preexisting cover and perturb it; instead, the sender generates a new carrier whose generative decisions encode the message. This contrast is explicit in AAG-Stega, which frames automatic generation-based steganography as a move away from the dominant carrier modification paradigm in audio (Yang et al., 2018). Pixel-Stega states the same distinction for images by contrasting cover-modification mappings

$$\mathcal{M} \times \mathcal{C} \times \mathcal{K} \rightarrow \mathcal{S}$$

with generative mappings

$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$

where the stego object is synthesized directly from the secret message under a learned model (Zhang et al., 2021).

Within text steganography, earlier neural generative methods typically embed bits by coding the conditional probability distribution of each generated token. Graph-Stega identifies this family explicitly and criticizes it on two grounds: text quality degrades as embedding rate rises because lower-probability words are selected more often, and the semantic expression of the final steganographic text is not controllable (Yang et al., 2020). Later LLM-era methods diversified this design space. LLM-Stega moved to a black-box UI-based regime in which keyword tuples rather than token probabilities carry the payload (Wu et al., 2024). OD-Stega retained arithmetic-coding-based token generation but introduced per-token distribution optimization under a KL-divergence budget (Huang et al., 2024). Auto-Stega extends this progression by making the strategy itself adaptive and persistent across requests, corpora, and styles (Zhou et al., 8 Oct 2025).

This suggests a useful conceptual distinction between two layers. One layer concerns how bits are mapped into local generation choices, such as arithmetic coding, Huffman coding, keyword selection, or parity-constrained token selection. The other concerns how the system chooses among such mechanisms under changing constraints. Auto-Stega is primarily a contribution at the second layer (Zhou et al., 8 Oct 2025).

2. Core architecture of Auto-Stega

Auto-Stega is defined as an agent-driven, self-evolving framework for LLM-based text steganography that operates entirely at inference time and optionally includes a plug-in encoder called PC-DNTE for better distributional alignment at high embedding rates (Zhou et al., 8 Oct 2025). The framework uses specialized components with distinct roles: a web searcher, a steganography LLM, an evaluation module including a detection LLM and scorer LLM, a summarizer LLM, and a decoding LLM (Zhou et al., 8 Oct 2025).

On the sender side, the process begins with a request $M$. The system consults a lifelong evolving strategy library $L$, filters entries using the Applicable Scenarios field, retrieves and ranks candidate strategies, generates stego text $T_s$, evaluates the result using metrics such as embedding rate, perplexity, semantic similarity, and anti-steganalysis indicators, and either accepts the result or retries with another strategy. Successful observations are then abstracted by the summarizer LLM into structured strategy entries, and entries whose score exceeds threshold $S_T$ are admitted into the library after deduplication (Zhou et al., 8 Oct 2025).

The receiver side is described more compactly. A decoding LLM recovers the hidden secret under the shared steganographic strategy, and for PC-DNTE the decoding is deterministic under the shared seed-conditioned parity rule (Zhou et al., 8 Oct 2025). The paper states that, when configured with the same steganographic strategy as the encoding side, the decoding LLM can accurately recover the secret information (Zhou et al., 8 Oct 2025).

The structured strategy library is central. It is a key–value store whose keys $\kappa$ are response embeddings used for retrieval. Strategy entries store fields such as strategy name, definition, technique, applicable scenarios, characteristics, examples, and evaluation summaries or scores (Zhou et al., 8 Oct 2025). This persistent memory is what makes the framework "self-evolving" in the paper’s terminology: evolution occurs through retrieval, score-based selection, composition, alternative discovery, summarization, and thresholded admission, not through parameter updates or fine-tuning (Zhou et al., 8 Oct 2025).

A concise view of the main modules is as follows.

Component	Role	Reported function
Web searcher	External knowledge acquisition	Mines recent steganography literature and converts candidate methods into executable entries
Steganography LLM	Sender-side generator	Produces stego text with or without retrieved strategy descriptions
Evaluation module	Multi-objective assessment	Computes embedding rate, perplexity, semantic similarity, and anti-steganalysis indicators
Summarizer LLM	Strategy abstraction	Converts successful observations into structured strategy entries
Decoding LLM	Receiver-side recovery	Recovers the secret under the shared strategy

The architecture is therefore not a single encoder. It is a closed-loop orchestration system that treats steganographic generation as a retrieval-augmented, evaluation-driven search problem (Zhou et al., 8 Oct 2025).

3. Strategy retrieval, lifelong evolution, and inference-time adaptation

The retrieval mechanism is specified by Algorithm 1 in the paper. Given request $M$, library $L$, and shortlist size $k$, the system first generates and evaluates a current response,

$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$0

then embeds the evaluation response,

$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$1

retrieves top-$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$2 similar entries,

$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$3

computes a discrepancy score $$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$4 for each candidate via $$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$5, and chooses the best $$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$6 entries via $$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$7 (Zhou et al., 8 Oct 2025). In the first iteration, when no response is yet available, the generator runs without a steganographic strategy (Zhou et al., 8 Oct 2025).

Strategy evolution then proceeds through several mechanisms: ingestion from the web searcher, warm-up exploration, summarizer abstraction of successful runs, composition of multiple near-matching strategies, and alternative discovery when no candidate surpasses threshold $$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$8 (Zhou et al., 8 Oct 2025). The paper describes this as lifelong learning because the framework adapts across corpora, writing styles, task constraints, and embedding-rate demands using the Applicable Scenarios field and current objective scores (Zhou et al., 8 Oct 2025).

This adaptive design differs sharply from earlier fixed-strategy systems. Graph-Stega, for example, moves the steganographic channel from token probabilities to knowledge-graph paths, thereby improving semantic controllability, but it still relies on a single path-coding design (Yang et al., 2020). LLM-Stega replaces white-box probability control with external keyword coding and prompt-conditioned realization, but its semantic schema is fixed to subject, predicate, object, and emotion (Wu et al., 2024). OD-Stega optimizes per-token distributions, but its strategy class remains arithmetic-coding-based coverless generation with a specific KL-constrained entropy-maximization rule (Huang et al., 2024). Auto-Stega’s contribution is to make the choice and composition of such strategies dynamic at runtime (Zhou et al., 8 Oct 2025).

A plausible implication is that Auto-Stega should be viewed less as a single coding-theoretic invention than as an inference-time control framework over a space of steganographic tactics. The paper itself supports this reading by emphasizing that its novelty is not just a token-mapping scheme but a full framework for strategy evolution (Zhou et al., 8 Oct 2025).

4. PC-DNTE and high-payload token mapping

For high embedding rates, Auto-Stega introduces PC-DNTE, the Parity-Constrained Dynamic Nucleus-Typical Encoder (Zhou et al., 8 Oct 2025). PC-DNTE is training-free and plug-and-play. Its stated purpose is to maintain better alignment with the base LLM’s conditional distribution while supporting high payload (Zhou et al., 8 Oct 2025).

At each generation step, PC-DNTE performs adaptive nucleus selection,

$$\mathcal{M} \times \mathcal{K} \rightarrow \mathcal{S},$$9

constructs a dynamic nucleus candidate set $M$0, applies a local typicality filter to obtain $M$1, partitions the filtered candidates into equal-mass bins

$M$2

with $M$3, reads 5 bits for bin index and 1 parity bit,

$M$4

and constrains token selection to

$M$5

If this set is empty, the nucleus is enlarged and the process retried; if still empty, the system records a no-embed step, defers the bits, and emits the highest-probability token in the selected bin. Otherwise it chooses greedily within the valid subset: $M$6 Near sentence boundaries it applies bounded closure with a small boost to EOS and punctuation, which the paper says does not modify already embedded bits because it affects only the next candidate set (Zhou et al., 8 Oct 2025).

The design rationale is explicit. Dynamic nucleus and local typicality keep generation in the model’s high-probability region; equal-mass bins preserve better alignment to the base conditional distribution; parity-constrained deterministic mapping provides reliable synchronization; and the no-embed fallback prevents forced implausible tokens (Zhou et al., 8 Oct 2025). Unlike OD-Stega, however, PC-DNTE is not derived from an explicit constrained optimization problem in the paper. It is presented algorithmically rather than through a formal theorem (Zhou et al., 8 Oct 2025).

PC-DNTE sits in a broader technical context. OD-Stega formalizes high-efficiency text steganography as entropy maximization under a KL-divergence constraint,

$M$7

and derives the closed-form optimum

$M$8

for an appropriate $M$9 found by bisection (Huang et al., 2024). ADLM-stega, by contrast, uses information entropy of the candidate pool to determine adaptive truncation and stopping when the marginal change in normalized confidence falls below a threshold $L$0 (Qin et al., 2024). PC-DNTE can be read as another attempt to preserve distributional alignment at high payload, but through equal-mass partitioning, typicality filtering, and parity constraints rather than KL-constrained entropy flattening or entropy-thresholded truncation (Zhou et al., 8 Oct 2025).

5. Empirical performance and evaluation criteria

Auto-Stega is evaluated on three corpora spanning different styles: News Category Dataset with 12,300 items, Large Movie Review with 20,000 entries, and Sentiment140 with 20,000 tweets (Zhou et al., 8 Oct 2025). Baselines are ADG, Discop, and LLM-Stega (Zhou et al., 8 Oct 2025). The models used include DeepSeek-V3.2 for the steganography LLM, decoding LLM, and scorer LLM, GPT-4o for the summarizer LLM, GPT-2 for next-token probabilities in PC-DNTE and perplexity evaluation, and Sentence-BERT (roberta-base-nli-mean-tokens) for semantic similarity (Zhou et al., 8 Oct 2025).

At high embedding rates, Table 2 reports that Auto-Stega attains the highest embedding rate on all three datasets. On News it reports $L$1, $L$2, and $L$3; on Movie, $L$4, $L$5, and $L$6; on Sentiment, $L$7, $L$8, and $L$9 (Zhou et al., 8 Oct 2025). The paper further states that on Tweet/Sentiment, despite slightly higher $T_s$0, Auto-Stega achieves a 42.2% relative reduction compared with the SOTA baseline under high embedding rates (Zhou et al., 8 Oct 2025).

At low payload, specifically $T_s$1 bpw, Auto-Stega remains competitive. On News it reports $T_s$2 and $T_s$3; on Movie, $T_s$4 and $T_s$5; on Sentiment, $T_s$6 and $T_s$7 (Zhou et al., 8 Oct 2025). The paper concludes that the system remains effective across both low- and high-payload regimes (Zhou et al., 8 Oct 2025).

For statistical imperceptibility, Table 4 reports that Auto-Stega achieves the lowest KLD on News under both low and high payload and the second lowest KLD on Movie and Tweet (Zhou et al., 8 Oct 2025). For anti-steganalysis, Figure 1 reports detector accuracies of $T_s$8 for LS-CNN, $T_s$9 for BiLSTM-Dense, and $S_T$0 for Bert-FT, and the paper states an average 1.6% reduction relative to the SOTA method (Zhou et al., 8 Oct 2025). Because values near 50% correspond to random guessing, these results are interpreted in the paper as improved security (Zhou et al., 8 Oct 2025).

The evaluation protocol itself aligns with prior LLM-based text steganography. LLM-Stega also uses perplexity, semantic similarity, KLD, and detector accuracy, and reports near-chance detector accuracies of $S_T$1, $S_T$2, and $S_T$3 for three steganalyzers (Wu et al., 2024). OD-Stega uses KL divergence to the base LLM distribution and GPT-4 judgment as proxies for imperceptibility and reports 1.25× to 1.5× capacity gains over a truncation baseline at matched stealth levels (Huang et al., 2024). ADLM-stega evaluates PPL, Distinct, and detector accuracy, and attributes improvements to entropy-controlled candidate-pool sizing (Qin et al., 2024). Auto-Stega inherits this empirical, detector-based notion of security rather than offering a full information-theoretic proof (Zhou et al., 8 Oct 2025).

6. Relation to broader automatic steganography and open limitations

Auto-Stega is part of a broader family of systems that encode messages through generative control rather than carrier perturbation. In audio, AAG-Stega generates symbolic music-note sequences with a two-layer LSTM augmented by Lookback and Attention, selects from a top-$S_T$4 candidate pool at each step, and uses a Huffman tree over those candidates so that the secret bitstream determines the emitted note (Yang et al., 2018). In images, Pixel-Stega uses PixelCNN++ to expose explicit per-pixel conditional distributions and then performs "stegosampling based on arithmetic coding," achieving $S_T$5 bpp on MNIST, $S_T$6 bpp on Frey Faces, and $S_T$7 bpp on CIFAR-10, with detector accuracies close to chance (Zhang et al., 2021). In black-box LLM text steganography, LLM-Stega encodes 64 bits per sentence by choosing indices in augmented subject, predicate, object, and emotion keyword sets and uses reject-sampling with extraction verification to ensure accurate keyword recovery (Wu et al., 2024). In image-in-image steganography, StegaVision instead remains within the cover-modification paradigm and studies how channel and spatial attention modules improve encoder–decoder hiding networks, with the best-performing variant being the parallel channel and spatial attention design (Kumar et al., 2024).

These comparisons clarify what Auto-Stega is and is not. It is not primarily a new low-level cover-synthesis mechanism of the Pixel-Stega or AAG-Stega type, nor primarily an attention-module ablation of the StegaVision type. Its distinct contribution is to elevate strategy selection, composition, and persistence to first-class system functions (Zhou et al., 8 Oct 2025).

The framework also inherits substantial limitations. The paper does not provide a formal proof of security for the overall system, does not give a full decoding protocol for every possible evolved strategy, and does not present a detailed ablation isolating each module (Zhou et al., 8 Oct 2025). It also identifies future work on robustness against adaptive steganalyzers and noisy channels, multilingual and multimodal covers, and reduced inference latency (Zhou et al., 8 Oct 2025). These caveats matter because earlier systems reveal how brittle automatic steganography can be under synchronization errors. AAG-Stega requires exact note-level reproduction and identical model parameters at both ends (Yang et al., 2018). Pixel-Stega depends on a lossless channel and exact agreement on the autoregressive model, arithmetic-coding precision, and quantization procedure (Zhang et al., 2021). OD-Stega highlights tokenizer noninvertibility as a concrete failure mode and proposes auxiliary prefix search as a workaround (Huang et al., 2024). LLM-Stega requires shared keyword sets, augmentation rules, prompt conventions, and release-time-based key derivation (Wu et al., 2024). Auto-Stega, which assumes a shared strategy and for PC-DNTE shared seed-conditioned rules, remains subject to the same general synchronization burden (Zhou et al., 8 Oct 2025).

A plausible implication is that Auto-Stega is most compelling in controlled software settings where the inference stack, decoder behavior, and side information can be tightly synchronized. Its principal significance lies in reframing LLM steganography from a fixed encoder design problem into a persistent, adaptive, agent-driven search problem over strategies (Zhou et al., 8 Oct 2025). In that sense, it marks a shift from automatic steganographic generation to automatic steganographic strategy evolution.