Semantic Steganographic Communication

• Semantic Steganographic Communication (SemSteCom) is a technique that embeds covert messages within the semantic content of text, images, or video using AI-driven models.
• It utilizes methods such as entropy-constrained token selection, semantic-space mapping, and coverless generative models to enhance security and capacity.
• SemSteCom achieves robust performance in adversarial environments by maintaining high semantic fidelity and reducing detection accuracy through advanced encoding techniques.

Semantic Steganographic Communication (SemSteCom) refers to information-hiding schemes that operate at the semantic layer of carrier signals, embedding secret content in such a way that covert information is indistinguishable from normal carrier semantics. Unlike classical steganography, which manipulates symbols or bits, SemSteCom leverages advanced probabilistic modeling, LLMs, generative AI, and invertible or semantic-aware encoders to encode and recover information embedded in the meaning structures of natural language, images, or video. SemSteCom enables robust, high-capacity, and imperceptible covert channels—even in adversarial environments such as wireless networks subject to eavesdropping or semantic analysis. Core approaches include entropy-constrained token selection, semantic-space mapping via ontology trees, coverless generative models, and invertible neural networks. Recent work demonstrates state-of-the-art resilience to both statistical and semantic steganalysis, with applications spanning covert social media messaging, secure wireless infrastructure, and AI-driven intelligent communications (Qin et al., 2024, Bai et al., 2024, Meng et al., 23 Jan 2026, Wu et al., 7 Nov 2025).

1. Foundational Principles and Taxonomy

SemSteCom generalizes traditional steganography by shifting the embedding from the symbol space (tokens, pixels, bits) to semantic abstractions—the entities, attributes, and structural meaning embedded within the carrier signal. In formal terms, a semantic steganographic scheme is defined by cover space $\mathcal{C}$, message space $\mathcal{M}$, encoder $E:\mathcal{C}\times\mathcal{M}\to\mathcal{C}$, and decoder $D:\mathcal{C}\to\mathcal{M}$, with strict semantic distortion constraints $\Delta_{sem}(c,E(c,m))\leq\epsilon$ governing perceptual indistinguishability (Figueira, 2022).

SemSteCom methods are categorized by modality (text, image, video), embedding principle (token-level, entity-level, latent semantic, generative synthesis), and stego extraction mechanism. Taxonomically, approaches split into:

• Linguistic:
  • Syntactic (grammar modification)
  • Semantic (synonym/paraphrase; probabilistic token/phrase substitution; semantic-class sampling)
• Statistical:
  • Random text generation, n-gram mimic, Markov chain or Huffman tree encoding
• Coverless/Generative:
  • Diffusion/invertible models synthesizing carriers with embedded semantics, bypassing cover-lookup constraints (Gao et al., 5 Sep 2025, Meng et al., 23 Jan 2026).

These approaches are unified by the requirement that covert payloads are invisible at both the symbolic and semantic levels.

2. Entropy-Constrained Semantic Embedding

A key innovation in SemSteCom is the control of information entropy in token selection during text generation. The ADLM-stega algorithm constrains the entropy $H(X)$ of the candidate token pool $\mathcal{V}$ such that $|H(X)-H'(X)|\leq\epsilon$, where $H'(X)$ is a reference entropy derived from natural cover text. Letting $p(x)$ be the model probability for $x\in\mathcal{V}$,

$H(X) = -\sum_{x\in\mathcal{V}} p(x) \log p(x)$

Upper and lower bounds $H_{min}=\alpha\log|\mathcal{V}|$, $H_{max}=\beta\log|\mathcal{V}|$ are used to maintain semantic coherence (low entropy) while ensuring lexical diversity (high entropy). ADLM-stega employs adaptive candidate-pool truncation such that at each generation step, only tokens consistent with $H_{min}\leq H(X)\leq H_{max}$ are considered. This provably enhances imperceptibility and detection resistance (Qin et al., 2024).

Experimental results with GPT-2 XL (cover text length $\approx100$ tokens, bits-per-word $=1$ to $4$) show that ADLM-stega achieves lower perplexity, controlled diversity, and $10\%$ reduced steganalysis accuracy compared to RNN-stega or PPLM-stega baselines, enabling robust, semantic-preserving covert text channels.

3. Semantic Space Mapping and Entity-Level Embedding

SemSteCom frameworks leveraging LLMs encode information not in the choice of individual tokens, but in the meaning structure—i.e., the specific semantic classes, entities, and types instantiated within generated sentences. The construction proceeds via an ontology–entity tree $\mathcal{T}$, where leaf nodes correspond to entities (places, objects, etc.), and internal nodes represent classes/attributes.

Secret bits are mapped to semantic equivalence classes $C(T)$, where $T$ indexes multi-sets of entities. The embedding proceeds via arithmetic coding in the ontology tree, with the payload determined by which semantic path is traversed during generation. A Feedback Chain-of-Thought prompting mechanism—using LLM generation and verification agents—ensures that the output text realizes the intended entity set, preserving both semantic fidelity and robustness to channel noise or semantic transforms.

Capacity analysis demonstrates average embedding rates of $28.5$ bits/sentence and $0.396$ bits/token, up to $10\times$ that of token-level symbolic coding approaches. Robustness remains high ($>80\%$ decoding success with $5\%$ token error), and semantic similarity metrics (Dist-3, fluency scores) show near parity between stego and cover distributions (Bai et al., 2024).

4. Generative Coverless Steganography and Multimodal Embedding

Recent advances have introduced coverless generative models—especially diffusion and invertible networks—that can synthesize stego carriers without reliance on original covers. SemSteDiff applies a conditional diffusion process, where semantic keys (BLIP-generated descriptions and LLM-paraphrased prompts) condition both forward and reverse denoising trajectories. The legitimate receiver, holding both keys, can invert the process to recover hidden images; eavesdroppers recover only semantically unrelated outputs (Gao et al., 5 Sep 2025).

AgentSemSteCom generalizes this approach for wireless networks, employing an autonomous agentic AI that orchestrates semantic extraction, digital-token-based reference generation, coverless diffusion/EDICT sampling, JSCC codecs, and optional enhancement modules. The use of digital tokens replaces static semantic keys, eliminating security vulnerabilities due to key reuse. This design maximizes steganographic capacity, minimizes detectability, and enables adaptive, context-aware protection against semantic eavesdropping (Meng et al., 23 Jan 2026).

Empirical evaluations across open-source datasets indicate that AgentSemSteCom exceeds prior coverless methods in PSNR (+14.3%), SSIM (+8.9%), and error reduction, while showing catastrophic reconstruction degradation for unauthorized receivers. The digital token mechanism provides dual-stage protection—seed initialization and latent-space perturbation.

5. Semantic Steganography in Vision and Multimodal Pipelines

Semantic steganographic embedding is extended to image, caption, and video modalities. S²LM and ICStega demonstrate that LLMs (with LoRA adapters or conditional sampling via CLIP) can encode sentence-level or multi-sentence secret messages into image or caption carriers. These frameworks involve token-to-patch mappings, mask-induced selective injection, and reciprocal encoder/decoder pipelines.

Evaluation on IVT benchmarks and MS-COCO datasets yields low word and sentence error rates (WER, BLEU, BERTScore), high image fidelity (PSNR, SSIM), and superior resistance to non-semantic payload degradation. Steganalysis models yield near-random detection (AUC $\approx0.5$ at $\leq2$ tokens/patch), with semantic capacity saturating near $2$ tokens/patch. Security against keyless or LLM-query attacks necessitates adversarial loss augmentation or mutual information regularization (Wu et al., 7 Nov 2025, Wang et al., 2023).

SemCovert further generalizes semantic-level hiding to video modalities, employing deep temporal attention–convolutional architectures for both semantic fusion (hiding) and extraction. A randomized hiding pattern stochastically selects embedding locations, thwarting framewise statistical detectors. Metrics (MSE, cosine similarity, Wasserstein distance) confirm covert semantic blending, while secret and cover fidelity remains high under both clean and adversarially perturbed channels (Cao et al., 23 Dec 2025).

6. Security, Robustness, and Capacity Characterization

Security metrics for SemSteCom center on mutual information $I(S;Z)$ between hidden payload $S$ and observed carrier $Z$, targeting $I(S;Z)\approx0$ for perfect secrecy. Robustness is demonstrated against token-level noise, semantic-preserving transforms, and adversarial machine learning attacks (Bai et al., 2024, Tang et al., 29 Mar 2025).

Key results across modalities:

• Image transmission (INN-based): Legitimate receivers achieve host/private image PSNR exceeding $32.85$ dB/$32.85$ dB; unauthorized eavesdroppers are confined to PSNR $<10$ dB for secret recovery (Facial Privacy Eavesdropping Success Rate $=0\%$) (Tang et al., 2024, Tang et al., 29 Mar 2025).
• Text channels: Detector accuracy is reduced 10–20% below chance through entropy-constrained adaptive sampling; semantic distortion is quantified via perplexity and semantic similarity metrics, remaining close to cover baseline for practical embedding rates (Qin et al., 2024).
• Coverless image steganography: Imperceptibility is measured in terms of stego-detection AUC and statistical divergence; key-based adversarial scenarios show negligible leakage unless both public and private semantic keys are correctly supplied (Wang et al., 7 May 2025).

Capacity scaling is governed by entropy bounds, binning size in semantic-aware codes, token-pool size per step, and multimodal patch granularity. Increasing embedding rates induces entropy drift, weakening semantic fidelity; optimal tuning maintains statistical similarity and naturalness.

7. Limitations, Open Problems, and Future Directions

SemSteCom schemes require accurate estimation of cover-text entropy and robust modeling of semantic distributions. Limitations include:

• Sensitivity to cover domain shifts and entropy misestimation (Qin et al., 2024).
• Degraded performance for non-semantic payloads (random bitstrings; digits) due to LLM reliance on language structure (Wu et al., 7 Nov 2025).
• Key-management and resource constraints for entity-tree construction or multimodal schema (Bai et al., 2024, Yang et al., 2022, Wang et al., 2023).
• Vulnerability to advanced attacks leveraging GAI-driven steganalysis and semantic eavesdropping unless adversarial defenses are integrated (Wang et al., 7 May 2025, Meng et al., 23 Jan 2026).

Active directions include:

• Information-theoretic quantification of semantic steganographic capacity, e.g., $C_{steg} = \max I(S;Y)$ subject to semantic-fidelity and detectability constraints (Wang et al., 7 May 2025).
• Multimodal generalization (audio, video, cross-modal hiding) via unified semantic spaces and attention-based encoders (Cao et al., 23 Dec 2025).
• Integration of homomorphic encryption with semantic steganography for compound protection (Wang et al., 7 May 2025).
• Development of error-correcting or watermarking schemes robust to semantic editing and channel noise (Figueira, 2022, Bai et al., 2024).

Collectively, these approaches position SemSteCom as the foundational covert communication paradigm in AI-driven, bandwidth-constrained, and adversarial environments.