Rank-Token Mapping Steganography in LLM Chatbots: Evaluating Capacity and Performance Across Multiple LLMs

Abstract

This paper presents a new steganographic algorithm capable of concealing information within generated text by leveraging conditional probability distributions of tokens and mapping token ranks to encoded data. The proposed solution is implemented as a chat-based graphical user interface (GUI), enabling seemingly standard, natural conversations while simultaneously transmitting hidden secrets within the chatbot’s responses. The study evaluates steganographic capacity and functional performance across various Large Language Models (e.g., LLaMA and Gemma). We investigate how varying the probability threshold and task complexity affects text coherence and code generation using functional correctness benchmarks.

1. Introduction

Steganography is the scientific area connected with concealing not only the content of a secret message but also the existence of the communication itself. Across images, audio, video, and text, the central objective remains the same: to embed information in a carrier medium without raising suspicion. Among these forms, linguistic steganography is particularly difficult because the hidden payload must be represented in natural language that remains fluent, coherent, contextually appropriate, and difficult to distinguish from ordinary text [1].

This challenge has become more relevant with the rise of generative artificial intelligence, which can produce high-quality text through probabilistic token generation. These models create an opportunity for covert communication because the generation process itself can be manipulated to encode information while preserving the apparent normality of the output. As a result, steganographic methods can now be integrated directly into text generation pipelines, turning language models into both generators and carriers of hidden messages [2].

As generative architectures scale in complexity, their potential for information concealment expands accordingly. Recent studies indicate that LLMs can develop covert encoding schemes in controlled settings [3]. Other work has examined whether open-weight models can hide a target text in a different cover text under a same-length constraint [4]. These results motivate systematic evaluation, but they do not imply that every generated carrier is natural or secure with an active adversary.

While early generative methods used mappings based on Huffman or arithmetic coding, more recent work has studied distribution-preserving constructions under explicit security assumptions [5,6]. Entropy-driven rank-token mapping translates secret bits into token ranks to increase embedding capacity when the model distribution permits it [7]. ANStega applies Asymmetric Numeral Systems to the capacity–efficiency–security trade-off [8], while rotation range coding uses interval-based mapping to limit distributional distortion [9]. These methods differ in assumptions, model workloads, and evaluation settings, so their reported numeric results cannot be compared directly.

Despite these advancements, practical implementation faces challenges such as tokenization inconsistency, where mismatched token boundaries between sender and receiver cause decoding errors [10]. The statistical effect of constrained token selection must also be characterized. Binoculars [11], although designed to distinguish machine-generated from human-written text rather than cover text from stegotext, can indicate whether the embedding procedure shifts an output away from the signature expected for ordinary LLM generation. It therefore provides a diagnostic measure in this study, not evidence of steganographic undetectability.

Most prior evaluations of generative linguistic steganography use passive prefix completion on static datasets such as Wikitext or IMDb. This work instead studies an interactive chatbot setting in which instruction-following models answer varied questions through their native chat templates. The objective is not to introduce a new entropy-coding primitive, but to evaluate a lightweight, single-phase adaptation of rank-token mapping and its operational limits in conversational generation. To clarify the nature of our contributions and to distinguish algorithmic design from implementation engineering:

• Algorithmic Adaptation (Stateless Discrete RTM): Rather than introducing a stateful entropy coder or private Huffman trees as in prior rank-token schemes [7], we formulated a simplified, single-phase discrete mapping. The usable step capacity is derived dynamically from a probability-truncated candidate pool ($c=\lfloor {\log }_{2}N\rfloor$), naturally dropping to zero in low-entropy positions ($N<2$) to enforce semantic coherence without managing fractional bits or state dependencies.
• Empirical Evaluation across Modalities and Workloads: We evaluated the operational limits of this mapping across three distinct instruction-tuned models (Qwen 2.5 7B, Llama 3.1 8B, and Gemma 2 9B). Uniquely, we evaluated functional code generation impact via the HumanEval benchmark (Pass@1), self-perplexity, and statistical detectability via Binoculars.
• Interactive GUI Demonstrator: We developed an open-source, chat-based Graphical User Interface (GUI) demonstrator that implements the proposed mapping. The application features token-ID streaming between the client and server interfaces, interactive payload embedding and 100% payload recovery in synchronized token-ID transport in our tested local experimental setup.

The remainder of this paper is organized as follows: Section 2 reviews related generative steganography methods. Section 3 presents the proposed algorithm, research environment, and evaluation metrics. Section 4 presents the benchmarking results across multiple LLMs. Finally, Section 5 discusses the implications of our findings and provides concluding remarks.

2. Related Work

Generative linguistic steganography encodes a payload by choosing the next token. While foundational concepts such as rank-token mapping and entropy-driven signals are thoroughly discussed in the prior literature, the primary contribution of this work shifts the focus from proposing a radically novel cryptographic primitive to providing a comprehensive, multi-model empirical benchmark in an interactive setting.

Two architectural families dominate recent theoretical work. Entropy-driven rank-token mapping, such as (RTMStega) prepares the secret in a private context, typically with a Huffman tree over token ranks [7]. Arithmetic coding, ANStega, and rotation range coding instead maintain a sequential coder state updated at every token. While methods like ANStega achieve near-optimal theoretical capacity using floating-point arithmetic and continuous state machines, they carry strict state dependencies. Consequently, they are highly fragile in practical network environments, where minor tokenization inconsistencies during detokenization and re-tokenization can cause catastrophic cascading decoding failures. Other recent approaches, such as SparSamp, utilize sparse sampling to achieve $\mathcal{O}\left(1\right)$ statelessness and mitigate these strict dependencies.

Direct Comparison with Closest Prior Art

The closest predecessor to our token selection mechanism is the Entropy-driven Rank-Token Mapping (RTMStega) introduced by Jiang et al. [7]. To clarify our technical novelty relative to RTMStega and stateful state-machine methods (e.g., ANStega [8]), we highlight the following four key operational dimensions. Table 1 summarizes the comparison.

Table 1. Taxonomy and operational comparison of generative steganography paradigms.

Dimension	Stateful Entropy Coders (e.g., ANStega [8], Range [9])	Entropy-Driven RTM (Jiang et al. [7])	Proposed Baseline (This Work)
Coding Mechanism	Continuous interval partition or streaming state machine	Multi-phase rank-token mapping via Huffman-coded rank tables	Single-phase discrete index mapping in a truncated power-of-two pool
Coder State and Memory Overhead	Stateful: requires continuous registers and synchronized numeric precision	Multi-context: requires parallel tracking of private and stego contexts	Memoryless ($\mathcal{O}\left(1\right)$): depends only on candidate pool at step t and shared PRNG seed
Capacity Profile	High to optimal: captures fractional bit distributions near channel entropy	High: variable bit lengths derived from historical rank distributions	Moderate ($0.30$–$0.61$ BPT): constrained by discrete power-of-two integer mapping
Receiver Decoding Complexity	Sequential state-unrolling matching encoder precision	Autoregressive replay of both contexts and rank inversion	Fast single-forward pass option; autoregressive decoding matches encoder generation time
Network Robustness	Highly fragile: any token misalignment causes catastrophic decoding failure	Vulnerable to Byte-Pair Encoding (BPE) tokenization inconsistency on text channels	100% payload recovery (autoregressive); 87.5% in single-forward pass
Operational Regime	Static document and prefix completion (e.g., Wikitext, IMDb)	Static corpora completion with synthetic benchmarks	Interactive multi-turn chatbots; functional code generation (HumanEval)

• Algorithmic Formulation and Complexity: RTMStega pre-constructs a variable-length codebook (e.g., Huffman tree) based on historical rank distributions, which introduces encoder–decoder state synchronization overhead. In contrast, our method is completely memoryless ($\mathcal{O}\left(1\right)$ coder state): the valid pool N is determined solely by an absolute probability threshold $\alpha$, and $c=\lfloor {\log }_{2}N\rfloor$ discrete bits are embedded directly. While stateful coders (ANStega) incur floating-point state management, our mapping requires only integer truncation and PRNG index lookup.
• Embedding Capacity vs. Compute Cost: RTMStega and ANStega prioritize maximizing bits per token (often achieving near-optimal empirical entropy), but sequential state maintenance makes parallel batched extraction computationally intensive. Our power-of-two discretization intentionally accepts a theoretical capacity penalty (averaging $0.30$–$0.61$ BPT across models) in exchange for parallel, single-forward-pass extraction on the receiver side without floating-point drift.
• Text Quality and Functional Preservation: Prior methods validate generation naturalness purely via static corpus perplexity (e.g., Wikitext). We extend evaluation to task-specific functional correctness via HumanEval (Pass@1), uncovering architecture-specific resilience (such as Qwen maintaining code correctness under aggressive truncation conditions) that cannot be detected by perplexity alone.
• Transmission Robustness and Steganalysis: While prior rank-mapping works rely on plaintext cover transmission—making them vulnerable to Tokenization Inconsistency (TI) [10]—our system evaluation explicitly handles this constraint via direct token-ID transport. Furthermore, we characterize distribution shifts using zero-shot cross-perplexity (Binoculars) rather than relying exclusively on domain-trained neural discriminators.

However, the vast majority of these state-of-the-art methods are evaluated primarily on passive prefix completion tasks using static text corpora. They rarely address the dynamic, varied workloads expected of modern conversational AI. In contrast, this paper deliberately adopts a simplified, stateless discrete mapping with an entropy constraint fallback to serve as a robust baseline for evaluating steganography within practical, instruction-tuned LLMs.

By testing this discrete mapping across diverse instruction-tuned architectures, this work focuses on operational trade-offs—measuring how candidate-pool truncation impacts programming reasoning in HumanEval, self-perplexity, and AI detectability during multi-turn generation.

We evaluated two decoding options. Autoregressive decoding requires as many forward passes of the transformer as generated tokens, matching the encoder generation, and achieves 100% payload extraction. In contrast, single-forward pass decoding requires only one transformer forward pass, making it much faster, but achieves an 87.5% extraction rate.

Ultimately, this work aims to bridge the gap between theoretical maximums and applied viability. By evaluating this lightweight system across diverse language models, we provide concrete operational limits, define the practical trade-offs between capacity and text quality, and establish a testing framework for interactive steganographic chatbots.

3. Materials and Methods

This section presents the proposed steganographic algorithm, its parameters, and the methods used to evaluate both the steganographic system and the performance of the language models. Section 3.1 provides information about the research environment and the specific Large Language Models (LLMs) used to evaluate the algorithm. Section 3.2 formalizes the dynamic rank-token mapping procedure, including embedding, extraction, and candidate-pool reduction. Section 3.3 describes the conversational end-to-end evaluation, decoder comparison, baselines and the HumanEval experiment. Section 3.4 defines capacity, recovery, functional correctness, and distributional metrics. Finally, Section 3.5 and Section 3.6 present the GUI demonstrator and show its security scope.

3.1. Research Environment and Models

Two categories of language models were used during the development and evaluation of the steganographic algorithm. The first category includes a lightweight model capable of running locally on a device with limited VRAM. Such a model is well-suited for rapid prototyping and preliminary testing as it eliminates the need for high-end local GPUs or cloud computing resources. Although its generative performance is constrained, it proved sufficient for verifying the steganographic algorithm. Specifically, the TinyLlama-1.1B-Chat-v1.0 model was used for this purpose as it provides reasonable responses to simple prompts, making it a good choice for local testing. The second category consists of larger models, which were used for the evaluation of the algorithm’s performance and steganographic capacity across various parameters. The evaluated models are:

• Qwen/Qwen2.5-7B-Instruct;
• Meta-llama/Meta-Llama-3.1-8B-Instruct;
• Google/gemma-2-9b-it.

These models were downloaded from Hugging Face and quantized using the bitsandbytes library with 4-bit NormalFloat (NF4) precision, incorporating double quantization. The computations were executed in float16 format. Quantization reduced VRAM consumption, allowing models with 7 B to 9 B parameters to fit on a single NVIDIA Tesla T4 16 GB GPU while maintaining numerically stable inference [12]. Benchmarks and tests with bigger models were performed in Google Colab and Kaggle.

3.2. The Proposed Steganographic Algorithm

The goal of the proposed steganographic system is to allow secret data to be passed from a server to a client, where the client sends a prompt to the server and the server generates a response for the user. The two main blocks of the system are the encoder and the decoder. The encoder is part of the server, and its job is to hide the secret in the model’s response. The decoder is part of the client, and it is responsible for extracting the data from the received response. To be able to extract hidden messages, both the encoder and the decoder must:

• Be able to run the same LLM and tokenizer;
• Have access to the entire conversation context;
• Share the same steganographic parameters and PRNG seed.

The main idea for the encoder is to manipulate the next-token selection during the generation of the response by the transformer. When the server receives a prompt, it passes it to the transformer. On the output, the model generates a probability distribution over the entire vocabulary for the next token. By sorting this distribution, we can create a list of top_n most probable next tokens. Selecting a specific token from this list allows secret data to be hidden. When the encoder and the decoder put the same context into the transformer, they receive the exact same probability distribution for the next token. Thus, the decoder can create the same top_n list as the encoder and identify which token was selected. For instance, if there are 4 elements in the token list, selecting the first token can mean the hidden data is 0b00, selecting the second token is 0b01, and so on.

A fundamental limitation of relying exclusively on a fixed-size candidate pool (e.g., a constant top_n) is that the probability distribution of the tokens predicted by the language model varies significantly across generation steps. Frequently, the model predicts a specific token with an very high probability (e.g., 99.9%), indicating a low-entropy state where only one semantically and syntactically reasonable continuation exists. In such scenarios, forcing the model to select a different, low-probability token to encode the secret bits would result in severe semantic or grammatical inconsistencies. This degradation in text quality introduces statistical anomalies, compromising the imperceptibility required in a secure steganographic system. In contrast, in high-entropy situations where multiple tokens share relatively high probabilities, it is advantageous to dynamically expand the candidate pool. Considering as many viable tokens as possible allows the algorithm to maximize the embedding capacity, hiding more information in a single step without sacrificing the naturalness and coherence of the generated response.

Strict probability maximization (e.g., greedy decoding or temperature zero) can produce bland or repetitive text [13], which is why standard generation often uses temperature or nucleus sampling. This observation motivates comparison with a stochastic baseline, but it does not establish that payload-driven selection is harmless. Steganographic selection may choose lower-probability tokens more often than ordinary sampling and can either increase diversity or introduce semantic and statistical anomalies. Its effect must therefore be measured.

The core of the proposed steganographic encoder relies on a deterministic, autoregressive token selection mechanism. As illustrated in Figure 1, the message embedding process is executed step-by-step during the text generation phase. For each generation step (transformer forward pass), the algorithm performs the following operations:

Figure 1. Flowchart of the proposed steganographic embedding process.

• Probability Prediction: The LLM receives the current context and outputs a probability distribution over the vocabulary for the next token. Subsequently, the algorithm selects the top_n tokens with the highest probabilities to form an initial subset.
• Candidate Pool Truncation: The algorithm filters these top_n tokens by rejecting all whose predicted probability is below the predefined threshold parameter. The remaining N tokens determine the valid candidate pool for the current step.
• Dynamic Capacity Calculation: To ensure that the embedded bits map cleanly to the available tokens, the step capacity k (in bits) is calculated as the largest power of two that does not exceed the size of the candidate pool:

  $$k=\lfloor {\log }_2\left(N\right)\rfloor$$

  (1)
  If fewer than two tokens remain, the operational embedding pool is empty, k is set to zero, and no secret bits are embedded in that step. The model instead emits the highest-probability non-EOS fallback token. This rule covers both one-token and, after filtering, empty candidate sets. The discrete capacity calculation avoids fractional bits and the state management required by continuous entropy coders such as arithmetic coding.
• Pseudorandom Permutation: The candidate pool is shuffled using Python 3.13’s deterministic Mersenne Twister PRNG initialized with a shared seed. This prevents a fixed payload pattern from always selecting the same probability rank. The benchmark uses integer seeds directly. In the GUI demonstrator, a password is hashed with SHA-256, and the first 64 bits of the digest are converted to the seed; no nonce or session-specific derivation is used. Mersenne Twister is not a cryptographically secure generator, so the permutation should not be interpreted as message encryption or a formal security guarantee.
• Token Selection (Mapping): The encoder extracts exactly k bits from the secret message and converts them into a decimal integer value i. The algorithm then selects the token located at index i from the shuffled candidate pool. This token is appended to the generated text, hiding k bits of information.
• Autoregressive Continuation and Termination: This process loops autoregressively until the entire secret message, including the End-of-Message (EOM) marker (e.g., \x04), is completely embedded. To prevent premature termination of the text during this active embedding phase, the language model’s native End-of-Sequence (EOS) token is explicitly masked and removed from the candidate pool. Once the EOM marker is successfully embedded, the encoder ceases data hiding and transitions into a natural text closure phase, where the EOS token is restored to the vocabulary. If the primary objective is strictly to conceal the payload without generating excessively long text, the system can forcefully terminate the generation as soon as the predicted probability of the EOS token exceeds a predefined eos_threshold.

The decoder operates symmetrically to the encoder. After receiving the carrier token IDs, it reconstructs the token probability distributions, repeats the same filtering and capacity calculation, and determines the index of each observed token in the pseudorandomly permuted pool. Correct extraction requires identical model weights, numerical settings, context, token IDs, parameters, and PRNG state at both endpoints.

Two decoder implementations were evaluated. The autoregressive decoder reproduces the encoder’s step-by-step forward passes on the growing prefix. This is the reference implementation because its execution pattern matches the encoder. The evaluated implementation recomputes the prefix and does not use a key–value cache. The single-forward decoder feeds the complete prompt and carrier sequence to the model once and extracts the logits for all carrier positions in parallel. It is computationally attractive, but the resulting logits can differ slightly from the stepwise computation because the execution path and numerical accumulation are not identical. Candidate filtering is discontinuous around the probability threshold; consequently, a small logit difference may change a pool and desynchronize all subsequent bit assignments. The experiments compared both implementations. In either mode, extraction stops when the EOM marker is reconstructed and ignores the natural closure tokens that follow it.

3.3. Evaluation Procedure and Benchmarks

The truncation mechanism is controlled by the probability threshold $\alpha$. A higher threshold excludes more low-probability tokens and generally reduces embedding capacity, whereas a lower threshold admits a larger candidate pool and permits more payload choices. The resulting quality–capacity relationship is empirical and may differ across models, prompts.

The main conversational evaluation used Qwen2.5-7B-Instruct, Meta-Llama-3.1-8B-Instruct, and Gemma-2-9B-IT with 4-bit NF4 quantization, float16 computation, double quantization, and scaled dot-product attention (SDPA). The implementation used Python, PyTorch, bitsandbytes, and the Hugging Face Transformers and datasets libraries on NVIDIA Tesla T4 GPUs. The generation notebook constrains Transformers to versions from 4.44 up to, but excluding, 5.0; Binoculars scoring uses version 4.57.5, huggingface-hub 0.36.0, accelerate versions from 0.33 up to 1.0, and bitsandbytes 0.43.1 or newer. Twenty prompts were manually selected from the Databricks Dolly-15k training split [14]. Selection favored short prompts that invite sentence-level responses without long supplied contexts while covering factual, explanatory, advisory, and descriptive requests. Their dataset indices were 3400, 3012, 2950, 3150, 2550, 56, 12041, 8563, 12728, 5040, 8783, 419, 4304, 4329, 5217, 5517, 133, 2830, 8948, 4624. Each prompt was formatted with the evaluated model’s native chat template and the suffix “Please keep your answer brief.”

For each model, the end-to-end steganographic configuration was evaluated at $\alpha \in \{0.01,0.05,0.1\}$ with random seeds 42 and 100, giving 40 runs per threshold and 120 steganographic runs per model. Every run embedded 16 randomly generated payload bits followed by the 8-bit EOM byte 0x04. The initial candidate list was limited to top_n = 16, and the maximum response length was 256 new tokens. The EOS token was excluded while payload bits remained. After EOM embedding, generation stopped without emitting another token when the EOS probability reached 0.01. Otherwise, it emitted the highest-probability non-EOS closure token and could additionally stop on sentence-ending punctuation after at least 12 closure steps. During decoding, the receiver reconstructs the candidate pools step by step using only the prompt, received token IDs, and the shared seed.

A payload-length sensitivity experiment retained the same prompts, seeds, Qwen model, $\alpha =0.05$, top_n = 16, and 256-token budget. New end-to-end runs used payloads of 8, 32, and 64 random bits plus the 8-bit EOM marker. The corresponding 16-bit Qwen subset was taken from the main experiment. Each length therefore contained 40 runs. Failure to finish the message before the 256-token limit was counted as a failed run.

Two non-steganographic controls were generated for the same conversational prompts. Greedy decoding was run once per prompt (20 runs per model). Sampling at temperature 0.7 was run with both seeds (40 runs per model). Greedy decoding always takes the most probable token. Temperature 0.7 samples from the full vocabulary. The steganographic encoder first filters the candidate list, cuts it to a power of two, shuffles it with a shared seed, and uses the secret bits as an index into that list. For a random payload, every token in the reduced list is equally likely, so encoding random bits is the same as picking a token at random from that shuffled list. Differences from greedy or temperature sampling therefore come from using the filtered list, not from the hidden bits as a separate factor. After the payload is written, the encoder adds a fixed end-of-message marker and then closes the reply. That closing part is not a random selection from the pool.

For a direct but deliberately simple cover-versus-stego test, temperature-0.7 outputs were labeled as covers and compared separately with steganographic outputs for each model and threshold. Every comparison contained 40 covers and 40 stegotexts paired by prompt and seed. A class-balanced logistic regression used character TF–IDF features with 3–5 character n-grams, a minimum document frequency of two, a maximum of 5000 features, and sublinear term frequency. Five-fold cross-validation was grouped by prompt, preventing responses to the same prompt from appearing in both training and test partitions. Reported predictions are out-of-fold. ROC AUC evaluated ranking performance across all thresholds, while accuracy, false-positive rate (FPR), and false-negative rate (FNR) were computed at a standard 0.5 decision threshold. Ninety-five-percent intervals were obtained from 2000 bootstrap resamples of the 20 prompt groups. A separate one-feature logistic regression based only on generated-token count was included to reveal the extent to which response length and stopping behavior provide a detectable signal.

The evaluation consisted of the following components:

• End-to-End Recovery and Capacity: Real payloads were embedded and decoded for all conversational steganographic runs. Recovery rate, bit error rate (BER), EOM detection, candidate-pool size, bits per token, activation frequency, and generation length were recorded. Raw and power of two capacities were computed from the same candidate pools at each context, yielding a paired comparison.
• Payload-Length Sensitivity: Qwen recovery, EOM detection, BER, token count through EOM, and exhaustion of the 256-token budget were measured for 8, 16, 32, and 64 payload bits at $\alpha =0.05$.
• Functional Correctness Benchmark (HumanEval): The official OpenAI human-eval package, containing 164 functional Python programming tasks, was used to assess code generation [15,16]. This experiment sampled uniformly from the candidate pool. After the list is shuffled, that is the same as encoding random bits into the power of two pool. HumanEval does not test message recovery.
• Self-Perplexity: For each conversational response, token log-probabilities in the generating 4-bit model were accumulated to obtain self-perplexity. This measures consistency with the generating model’s own distribution.
• Machine-Generated-Text Signature (Binoculars): Responses were scored with the zero-shot Binoculars detector using falcon-7b as observer and falcon-7b-instruct as performer [11,17]. The Low-FPR decision threshold was 0.8536. This test identifies shifts in the AI versus human detection signal.
• Direct Cover-versus-Stego Classification: Prompt grouped logistic regression was applied to character n-grams, with a length only model as a diagnostic control. This measures whether the temperature-0.7 replies can be told apart from the steganographic replies in this sample.

The independent decoder evaluation replayed all 360 conversational steganographic records. The single-forward decoder received the model identifier, prompt or prompt token IDs, carrier text or carrier token IDs, threshold, top_n, and seed. Secret bits were accessed only after extraction to compute BER and success. Token-ID mode preserved the transmitted sequence, while text-channel mode detokenized and re-tokenized the response to expose tokenization inconsistency.

3.4. Evaluation Metrics

To quantify the performance of the system across the defined benchmarks, several specific metrics were used. While the statistical outcomes and their implications are analyzed in the Results section, the primary metrics of interest are defined as follows:

Bits Per Token (BPT) and Activation Ratio: For a raw threshold-filtered pool of size $N\ge 2$, the available information is ${\log }_2\left(N\right)$ bits. The implemented discrete mapping retains $2^{\lfloor {\log }_{2}N\rfloor }$ candidates and embeds $k=\lfloor {\log }_{2}N\rfloor$ bits. For $N<2$, both raw and operational BPT are defined as zero and the operational embedding pool is empty. Reported BPT was averaged across generation steps before the EOM is completed. The stego activation ratio is the fraction of these steps for which $N\ge 2$ and at least one bit can be embedded.

Recovery Rate, Bit Error Rate, and EOM Detection: A transmission is successful when the EOM marker is detected and every payload and EOM bit preceding it matches the transmitted sequence. Recovery rate is the fraction of successful runs. BER is the number of substituted or missing bits divided by the expected payload and EOM length, capped at one. That length was 24 bits in the main conversational experiment and 16, 24, 40, or 72 bits in the payload-length analysis. EOM detection rate is reported separately because a wrong marker can stop extraction even when some earlier bits are correct.

Functional Correctness (Pass@1): For the HumanEval benchmark, performance was measured using Pass@1, the fraction of generated Python functions that pass all associated unit tests. This metric evaluates functional code generation and syntax under constrained token selection conditions.

Self-Perplexity and Perplexity Delta (ΔPPL): For generated tokens with model log-probabilities ${\ell }_1,\dots ,{\ell }_T$, self-perplexity is $\exp (-T^{-1}{\sum }_{t=1}^T{\ell }_t)$. The delta compares aggregate steganographic self-perplexity with a stated baseline. Lower values indicate greater consistency with the generating model’s own token distribution.

Binoculars Score and AI Detection Rate: The Binoculars score is calculated as the ratio of performer perplexity to cross-perplexity. The established Low-FPR threshold produces an AI-versus-human label. The score delta and AI detection rate were used here only to identify whether steganographic token selection changes this detector response relative to ordinary generation by the same model.

Cover-versus-Stego Classification: Accuracy is the fraction of correct out-of-fold labels, ROC AUC measures ranking performance across all classification thresholds, FPR is the fraction of covers incorrectly labeled as stego, and FNR is the fraction of stegotexts incorrectly labeled as cover. FPR and FNR are reported at the fixed probability threshold of 0.5. Because classes are balanced, accuracy and balanced accuracy coincided in this experiment.

3.5. Software Implementation and GUI

The proposed steganographic algorithm was implemented as a proof-of-concept chatbot featuring a graphical user interface (GUI). The system architecture, illustrated in Figure 2, follows a client–server model. The client application receives prompts, and the server generates responses containing a payload. The demonstrator uses the User Datagram Protocol (UDP); it illustrates the algorithm and synchronization requirements but is not intended to reproduce ordinary production chatbot traffic.

Figure 2. Chatbot block diagram illustrating the client-server architecture.

A consideration addressed in this implementation is the phenomenon known as Tokenization Inconsistency (TI) or Token Ambiguity [10]. In standard LLM-based steganography, when generated tokens are detokenized into a plaintext string for transmission, the receiver’s tokenizer may re-tokenize the string into a different sequence of token IDs due to the nature of Byte-Pair Encoding (BPE) [7]. This misalignment can break the synchronization required to recover hidden bits. To isolate this problem in the demonstrator, the programs transmit lists of token IDs instead of decoded plaintext strings. This supports reliable reconstruction but makes the transport protocol distinguishable from ordinary text traffic and is not itself a covert network channel.

Furthermore, the steganographic hyperparameters (e.g., threshold and top_n), model and tokenizer versions, context, numerical configuration, and password-derived PRNG seed must be shared by both applications. Matching these values is necessary.

The developed application is shown in Figure 3. One hardware limitation when running both endpoints on a single device is VRAM capacity. Because the processes do not share model weights, two simultaneously resident model instances may exceed device memory. The demonstrator therefore loads weights during the active encoding or decoding phase and releases them afterward. This reduces peak simultaneous allocation at the cost of model-loading latency. No user study, end-to-end latency benchmark, or UDP loss experiment was conducted. The implementation and evaluation suite are available on GitHub [18] (accessed on 25 July 2026).

Figure 3. Graphical user interface of the implemented steganographic chatbot.

The GUI and the large-model benchmark serve different purposes and use different defaults. The GUI uses TinyLlama-1.1B in float16 with top_n = 25, $\alpha =0.1$.

3.6. Security Scope and Threat Model

The sender and receiver are assumed to be trusted and to share the model, tokenizer, complete conversation context, generation parameters, and PRNG seed through a separate channel. Three properties must be distinguished. Reliable extraction concerns whether the receiver reconstructs the embedded bits and is measured directly. Message confidentiality concerns whether an observer can recover the payload; the current Python PRNG, password-to-seed conversion, and embedding procedure do not constitute encryption. A deployment requiring confidentiality would need an independently specified authenticated-encryption and key-management layer. Communication covertness concerns whether an observer can distinguish ordinary output from stegotext or identify a special transport protocol.

The text-level adversary considered in the direct classification experiment observes a complete generated response and attempts to distinguish the thresholded steganographic policy from temperature-0.7 generation by the same model. The adversary is represented only by a character n-gram logistic regression or a length-only diagnostic and is trained and evaluated on the available prompt distribution. It does not observe token IDs, logits, candidate pools, network traffic, or repeated messages with additional keys. At the transport level, an observer who can inspect the demonstrator’s UDP packets can identify that token-ID lists rather than ordinary chatbot text are exchanged. The GUI should consequently be interpreted as a functional demonstrator of synchronized embedding and extraction, not as evidence of a covert network protocol.

During the development of this study, AI-assisted tools were utilized to support software implementation and research workflows. Specifically, the Cursor AI code editor (version 3.0) was used to assist in writing benchmark evaluation scripts, implementing the Chatbot GUI, and developing auxiliary code. Additionally, Gemini (version 3.1 Pro) was used to support literature research and assist with language polishing.

4. Results

This section evaluates the proposed rank-token mapping system across three LLMs. The conversational end-to-end study covers message recovery, payload-length sensitivity, embedding capacity, self-perplexity, changes in the Binoculars machine-generated-text signal, and direct cover-versus-stego classification. HumanEval is reported separately as a controlled functional code-generation experiment because it does not execute the complete encoder–decoder channel.

The conversational study evaluated $\alpha \in \{0.01,0.05,0.1\}$ and reports variation over two seeds and 20 prompts. Steganographic responses were compared with both greedy and temperature-0.7 generation where the metric applies. Raw and power-of-two capacities were calculated in identical contexts. Unless stated otherwise, dispersion refers to the sample standard deviation across individual runs rather than variation among only the two seed means.

4.1. End-to-End Message Recovery

Three recovery settings were tested. The two decoders were compared on preserved token IDs (Table 2). The two single-forward channels, token IDs versus re-tokenized text, were compared separately (Table 3).

Table 2. Decoder comparison on preserved token IDs, aggregated over thresholds $\alpha \in \{0.01,0.05,0.1\}$, two seeds, and 20 prompts per model (120 runs per model).

Decoder	Gemma Success	Llama Success	Qwen Success	Overall Success
Autoregressive	100.0%	100.0%	100.0%	100.0%
Single-forward	86.7%	92.5%	83.3%	87.5%

Table 3. Single-forward decoder channel comparison. Both rows use the single-forward decoder. Only the transport representation changes. Aggregation matches Table 2.

Single-Forward Channel	Gemma Success	Llama Success	Qwen Success	Overall Success
Token IDs	86.7%	92.5%	83.3%	87.5%
Re-tokenized text	55.8%	90.8%	55.8%	67.5%

The autoregressive reference decoder recovered the complete 24-bit payload-plus-EOM sequence in all 360 steganographic conversational runs, with BER 0 and EOM detection in every run. This result applies to preserved token IDs and a decoder executed with the same model, context, numerical configuration, parameters, and seed as the encoder.

On the same token-ID channel, the independent single-forward replay was less reliable even though it received the stored token IDs and did not use encoder logits or candidate-pool traces. Token-ID recovery was 87.5% (315/360), with an aggregate mean BER of 0.028 and EOM detection in 91.1% of runs. The decoder comparison is therefore 100% versus 87.5% in identical token-ID transport.

A second comparison, restricted to the single-forward decoder, measures the effect of sending text instead of token IDs. After detokenization and re-tokenization, recovery fell to 67.5% (243/360), with mean BER of 0.106 and EOM detection in 69.7% of runs. Llama was less affected by the text round trip than Gemma or Qwen in this sample. This drop is relative to single-forward token-ID decoding, not to the autoregressive decoder.

Single-forward failures consisted of missing or incorrect EOM reconstruction, preceding bit errors, or both. The token-ID mode produced 45 failed transmissions, while the re-tokenized text mode produced 117. Candidate-pool misses were uncommon in token-ID decoding but occurred more often after text round trips for Gemma and Qwen, indicating that tokenization changes and single-forward numerical differences are separate sources of desynchronization. In token-ID mode, Llama recovery ranged from 90.0% to 97.5% across thresholds, Gemma from 85.0% to 90.0%, and Qwen from 80.0% to 85.0%. After text re-tokenization, Llama remained between 87.5% and 95.0%, whereas Gemma and Qwen fell as low as 47.5% and 45.0%, respectively. These results support autoregressive reconstruction with preserved token IDs as the reference decoder.

4.2. Payload-Length Sensitivity

Table 4 reports the Qwen sensitivity experiment at $\alpha =0.05$. The reference autoregressive token-ID decoder recovered all 8-, 16-, and 32-bit payloads. For 64-bit payloads, 37 of 40 runs (92.5%) were completed and recovered successfully. The other three runs reached the fixed 256-token limit before the payload and EOM were completely embedded; they were prompt indices 0, 4, and 17 with seed 42. Thus, these failures reflect exhaustion of the carrier budget rather than disagreement between encoder and reference decoder after a completed embedding.

Table 4. Qwen payload-length sensitivity at $\alpha =0.05$, two seeds, 20 prompts, and a fixed limit of 256 generated tokens. The 8-bit EOM is excluded from the payload column but included in total bits. Tokens through EOM are calculated over runs in which EOM was detected.

Payload	Total Bits	Recovery	EOM Detection	Mean BER	Tokens Through EOM
8 bits	16	100.0%	100.0%	0.0000	$35.1\pm 14.8$
16 bits	24	100.0%	100.0%	0.0000	$54.5\pm 24.0$
32 bits	40	100.0%	100.0%	0.0000	$81.4\pm 35.1$
64 bits	72	92.5%	92.5%	0.0125	$137.7\pm 31.6$

Mean tokens through EOM increased from 35.1 for an 8-bit payload to 137.7 among successful 64-bit transmissions. The large standard deviations show that the required carrier length depends on the generated context rather than payload length alone. The fixed EOM also represents half of the embedded bits in the 8-bit condition but only one ninth in the 64-bit condition, so payload-only efficiency increases with message length even though the probability of exhausting a fixed carrier budget also rises.

4.3. Functional Code Generation

The models’ performance on programming tasks was evaluated using HumanEval. Figure 4 presents Pass@1 at different thresholds, with and without the power-of-two cut. After the list is shuffled, sampling from the power-of-two pool is the same as encoding random bits. The raw-pool plots skip that cut. Message recovery is measured separately in Section 4.1.

Figure 4. HumanEval Pass@1 evaluation across three models (Qwen, Gemma, Llama) at varying probability thresholds (0.01, 0.05, and 0.1). (a) Raw-pool ablation without power-of-two reduction. (b) Implemented power-of-two discrete pool. Dotted horizontal lines represent the baseline performance of each model without constrained token selection.

4.4. Self-Perplexity

The impact of steganographic embedding on consistency with each generating model’s token distribution was evaluated using self-perplexity. Figure 5 illustrates the obtained values at $\alpha \in \{0.01,0.05,0.1\}$ in comparison with non-steganographic generation.

Figure 5. Self-perplexity in the generating model for greedy, temperature-0.7, and steganographic generation. Bars show means and error bars show sample standard deviations over 20 greedy or 40 temperature/steganographic runs per model and configuration.

Across all three models, mean self-perplexity was higher for steganographic generation than for the greedy and temperature-0.7 controls. The largest mean occurred for Gemma at $\alpha =0.01$ ($4.362\pm 8.794$), where the standard deviation indicates that a small number of prompts strongly affected the aggregate. For Llama and Qwen, increasing $\alpha$ was associated with a lower mean self-perplexity. Gemma did not follow a strictly monotonic pattern, reinforcing that the threshold effect is prompt- and model-dependent.

4.5. Binoculars Response

Figure 6 presents the response of the Binoculars zero-shot AI-text detector. Differences from greedy and temperature-sampled controls indicate that constrained token selection can alter the detector’s AI-versus-human signal.

Figure 6. Binoculars scores for greedy, temperature-0.7, and steganographic generation. Bars show means and error bars show sample standard deviations over 20 greedy or 40 temperature/steganographic runs per model and configuration. The dashed Low-FPR threshold classifies machine-generated versus human-written text. It is not a steganographic detection boundary.

Binoculars responses varied across architectures. At $\alpha =0.01$, the AI-label rate was 45.0% for both Gemma and Qwen, compared with 75.0% and 85.0% in greedy decoding, respectively. Llama changed from 95.0% in greedy decoding to 72.5% at $\alpha =0.01$. At higher thresholds, the rates generally moved closer to their non-steganographic controls, although neither the score nor the binary rate was monotonic in every case. These shifts show that embedding can affect an AI-text detector, but they do not reveal how accurately a steganalysis adversary could separate cover and stego outputs.

4.6. Direct Cover-Versus-Stego Classification

The prompt-grouped character n-gram classifier asks whether the available temperature-0.7 and steganographic responses can be separated. Table 5 reports out-of-fold results at the fixed 0.5 decision threshold. Figure 7 shows the corresponding ROC AUC for the length-only and character-feature models. ROC AUC ranged from 0.553 to 0.633 for Gemma, from 0.681 to 0.751 for Llama, and from 0.576 to 0.813 for Qwen. The group-bootstrap intervals are broad because only 20 unique prompts were available. Each comparison used 40 covers and 40 stegotexts, so each training fold contained 16 prompts; with this sample the classifier may be underpowered and unstable. A low AUC therefore does not imply undetectability, and a high AUC should not be read as a robust detection result. Several conditions particularly Qwen at $\alpha =0.10$, nonetheless show distinguishability above chance within this sample.

Table 5. Out-of-fold character n-gram logistic-regression results for temperature-0.7 cover versus steganographic responses. Each row contains 40 covers and 40 stegotexts in five prompt-grouped folds. AUC intervals are 95% prompt-group bootstrap intervals; accuracy, FPR, and FNR use a 0.5 decision threshold.

Model	α	Accuracy	ROC AUC [95% CI]	FPR	FNR
Gemma	0.01	0.550	0.553 [0.420, 0.683]	0.425	0.475
	0.05	0.513	0.554 [0.436, 0.671]	0.675	0.300
	0.10	0.525	0.633 [0.516, 0.750]	0.525	0.425
Llama	0.01	0.688	0.751 [0.632, 0.858]	0.300	0.325
	0.05	0.663	0.681 [0.563, 0.796]	0.250	0.425
	0.10	0.650	0.714 [0.591, 0.833]	0.400	0.300
Qwen	0.01	0.525	0.576 [0.454, 0.704]	0.700	0.250
	0.05	0.675	0.721 [0.567, 0.847]	0.600	0.050
	0.10	0.700	0.813 [0.718, 0.908]	0.525	0.075

Figure 7. Cover-versus-stego ROC AUC by model and threshold. The left panel uses only generated-token count and exposes length/stopping-policy leakage; the right panel uses character 3–5-g TF–IDF features. Error bars are 95% prompt-group bootstrap intervals. The dashed line denotes chance-level ranking.

The length-only diagnostic reached AUC 0.888 for Qwen at $\alpha =0.10$ and exceeded 0.71 in several Qwen and Llama conditions, demonstrating that response length and termination behavior can be major observable signals. The character model’s FPR and FNR are also asymmetric in several rows, showing that its default 0.5 threshold is not calibrated for a specific operational false-alarm target. These results suggest that some tested configurations can be distinguishable in this small sample, but they do not establish performance against an external, state-of-the-art, or adaptive steganalyst.

4.7. Embedding Capacity

Embedding capacity in bits per token is summarized in Figure 8. Raw and power-of-two BPT values are derived from the same threshold-filtered pools in identical generation contexts. Their paired difference therefore isolates the immediate capacity discarded by discrete mapping, rather than comparing different generated trajectories.

Figure 8. Bits per token from identical pre-EOM contexts, shown separately for each model. Black dashed lines are raw threshold-filtered values and colored solid lines are the implemented power-of-two discrete values. Error bars are sample standard deviations over 40 runs.

Capacity decreased consistently as $\alpha$ increased. For the implemented discrete pool, mean BPT at $\alpha =0.01$ was $1.027\pm 0.301$ for Gemma, $1.038\pm 0.337$ for Llama, and $0.864\pm 0.214$ for Qwen. At $\alpha =0.10$, the corresponding means were $0.394\pm 0.124$, $0.413\pm 0.092$, and $0.353\pm 0.111$.

The numerical results are separated by experimental source. Table 6 retains the controlled HumanEval uniform-selection experiment. Table 7 reports conversational self-perplexity and Binoculars results. Average pool size, activation ratio, and paired BPT values are reported in Table 8.

Table 6. HumanEval Pass@1 when tokens are sampled from the candidate pool. After shuffling, the power-of-two pool is the same as encoding random bits. “Raw pool” skips that cut. Message recovery is measured separately.

Model	Threshold	Raw-Pool Pass@1	Discrete-Pool Pass@1
Gemma	baseline	0.500	0.500
	0.01	0.165	0.165
	0.05	0.287	0.329
	0.10	0.396	0.433
Llama	baseline	0.415	0.415
	0.01	0.091	0.201
	0.05	0.341	0.341
	0.10	0.390	0.415
Qwen	baseline	0.604	0.604
	0.01	0.652	0.713
	0.05	0.665	0.646
	0.10	0.634	0.634

Table 7. Conversational self-perplexity and Binoculars results. Values are mean ± sample standard deviation over 20 greedy runs or 40 temperature/steganographic runs per row. AI rate is the fraction classified as machine-generated at the Binoculars Low-FPR threshold.

Model	Configuration	α	Self-PPL	Binoc. Score	AI Rate
Gemma	Greedy	–	$1.250\pm 0.093$	$0.870\pm 0.321$	75.0%
	Temperature 0.7	–	$1.434\pm 0.279$	$0.879\pm 0.302$	62.5%
	Stego	0.01	$4.362\pm 8.794$	$0.868\pm 0.159$	45.0%
	Stego	0.05	$2.261\pm 1.148$	$0.790\pm 0.120$	75.0%
	Stego	0.10	$2.360\pm 2.033$	$0.759\pm 0.102$	85.0%
Llama	Greedy	–	$1.271\pm 0.123$	$0.652\pm 0.090$	95.0%
	Temperature 0.7	–	$1.505\pm 0.232$	$0.671\pm 0.096$	95.0%
	Stego	0.01	$2.643\pm 1.419$	$0.775\pm 0.118$	72.5%
	Stego	0.05	$1.823\pm 0.356$	$0.694\pm 0.093$	97.5%
	Stego	0.10	$1.659\pm 0.326$	$0.668\pm 0.096$	95.0%
Qwen	Greedy	–	$1.208\pm 0.138$	$0.746\pm 0.106$	85.0%
	Temperature 0.7	–	$1.396\pm 0.300$	$0.793\pm 0.149$	65.0%
	Stego	0.01	$2.266\pm 0.386$	$0.853\pm 0.147$	45.0%
	Stego	0.05	$2.031\pm 0.377$	$0.808\pm 0.126$	57.5%
	Stego	0.10	$1.922\pm 0.408$	$0.741\pm 0.108$	77.5%

Table 8. Paired conversational capacity metrics before and after reduction to a power-of-two pool. Values are mean ± sample standard deviation over 40 runs. Activation is the proportion of pre-EOM steps with at least two valid candidates.

Model	α	Raw Pool	Discrete Pool	Raw BPT	Discrete BPT	Activation
Gemma	0.01	$3.136\pm 0.789$	$2.268\pm 0.736$	$1.189\pm 0.338$	$1.027\pm 0.301$	$0.636\pm 0.149$
	0.05	$1.951\pm 0.420$	$1.246\pm 0.460$	$0.723\pm 0.276$	$0.623\pm 0.230$	$0.500\pm 0.153$
	0.10	$1.508\pm 0.171$	$0.788\pm 0.249$	$0.448\pm 0.144$	$0.394\pm 0.124$	$0.373\pm 0.117$
Llama	0.01	$3.106\pm 0.980$	$2.262\pm 0.853$	$1.210\pm 0.388$	$1.038\pm 0.337$	$0.661\pm 0.152$
	0.05	$1.901\pm 0.203$	$1.203\pm 0.257$	$0.697\pm 0.150$	$0.600\pm 0.129$	$0.489\pm 0.102$
	0.10	$1.548\pm 0.142$	$0.827\pm 0.184$	$0.475\pm 0.116$	$0.413\pm 0.092$	$0.386\pm 0.087$
Qwen	0.01	$2.711\pm 0.530$	$1.838\pm 0.463$	$1.003\pm 0.253$	$0.864\pm 0.214$	$0.549\pm 0.125$
	0.05	$1.739\pm 0.246$	$1.000\pm 0.297$	$0.577\pm 0.175$	$0.499\pm 0.147$	$0.419\pm 0.119$
	0.10	$1.447\pm 0.153$	$0.705\pm 0.222$	$0.399\pm 0.129$	$0.353\pm 0.111$	$0.332\pm 0.103$

5. Discussion

The results support the expected relationship between the probability threshold and embedding capacity: lower thresholds admit more candidates and provide more opportunities to encode bits, while higher thresholds constrain selection to tokens assigned greater probability by the model. The corresponding effect on self-perplexity and Binoculars is model- and prompt-dependent. Because neither metric directly measures human judgments or cover-versus-stego detection, changes in these values are interpreted as distributional diagnostics. The direct classifier addresses the relevant cover-versus-stego question more closely and finds above-chance separation in several conditions, but its small development sample and simple feature space preclude a general security claim.

Greedy decoding always selects the most probable token. Temperature 0.7 samples from the full vocabulary. The steganographic encoder shuffles a filtered pool and uses the secret bits as an index. For a random payload this is the same as drawing a token at random from that pool. The gap relative to greedy or temperature sampling therefore comes from using the filtered pool.

HumanEval indicates that constrained selection can affect functional Python code generation, but it does not support conclusions about general reasoning. Qwen retained comparatively strong Pass@1 in some low-threshold conditions in the controlled experiment. This resilience may simply reflect a model-specific behavior of Qwen on code-generation tasks. However, our current HumanEval experiments do not include an in depth token-entropy analysis, so this interpretation remains an unverified hypothesis.

On preserved token IDs, autoregressive decoding recovered every completed payload in the main conversational runs. Single-forward decoding recovered 87.5%. These two numbers compare the decoders on the same token-ID channel. A separate single-forward test then compares token IDs with re-tokenized text, where recovery fell to 67.5%. Small differences between the single-forward pass and the stepwise encoder can change the candidate list near the threshold, and later bits then go out of sync. The tests do not pin this down to one numerical cause. When any bit error is unacceptable, single-forward decoding should not replace autoregressive decoding.

Payload length creates a separate operational constraint. At $\alpha =0.05$, Qwen recovered every completed payload, but three 64-bit messages could not be fully embedded before the fixed 256-token limit. Increasing the carrier limit would likely recover some censored cases, but it would also make responses longer and potentially easier to distinguish. The length-only classifier confirms that response length and stopping behavior already expose substantial signal in several configurations. Therefore, the maximum text length is a key security decision, not just a technical setting.

Sending raw token IDs avoids re-tokenization errors, but transferring lists of numbers instead of normal text is easy for network monitors to spot. In contrast, sending normal text is much safer, but the receiver might re-tokenize it differently, which can break decoding. Therefore, developing methods that produce normal, stable text remains a key challenge for real-world use.

No single threshold was optimal for every objective or model. Values near $\alpha =0.05$ provided an intermediate operating point in several tested configurations, but this observation is specific to the three quantized models, selected prompts, payload settings, and metrics used here. Qwen’s character-classifier AUC increased from 0.576 at $\alpha =0.01$ to 0.813 at $\alpha =0.10$, illustrating that restricting the pool did not monotonically improve every detectability criterion. Threshold selection should be treated as a configuration-dependent decision based on the required capacity, recovery method, carrier budget, and acceptable distributional change.

Limitations

The evaluation has some limitations. First, the experiments were scoped to three 7–9 B quantized models and a dataset of 20 conversational prompts evaluated across two random seeds. While this targeted setup allows for a controlled initial comparison, future work should expand the evaluation to larger prompt datasets, additional languages, and broader dialogue domains. Additionally, our downstream task evaluation focuses specifically on Python code generation via HumanEval. Investigating how steganographic constraints affect other reasoning and instruction-following tasks remains an open direction for future research.

Second, self-perplexity was calculated by the same quantized model that generated each response. It measures model-relative statistical consistency and is not an independent fluency evaluation. Cross-model perplexity and human ratings of fluency, coherence, relevance, and suspiciousness are left for future work. Payload-length sensitivity was tested only for Qwen at $\alpha =0.05$, using four lengths, two seeds, and the same 20 prompts. The three 64-bit failures are right-censored by the 256-token limit, and the study does not determine whether larger carriers, other thresholds, other framing overheads, or longer messages would produce the same scaling.

Third, while Binoculars serves as a zero-shot text classifier, it is designed to distinguish machine-generated from human-written text rather than steganographic content specifically. Our direct classification experiment evaluates the complete operational difference between steganographic generation (including candidate filtering and EOS masking) and standard temperature-0.7 sampling. This approach measures the overall policy-level detectability rather than the isolated causal effect of the payload bits. Additionally, the character n-gram logistic regression represents a baseline detection threat; a more advanced or adaptive steganalyst might exploit more complex patterns. Future work could investigate adaptive detectors and larger evaluation datasets to further map these security boundaries.

Fourth, temperature 0.7 does not use the same filtered pool as the encoder. We did not run a separate control that draws uniformly from that pool without a payload because for random bits the encoder already does this. The end-of-message marker is fixed, so that part of each reply is not random. The PRNG is not a cryptographic generator. Test payloads were not compressed or encrypted.

Finally, synchronized extraction is highly sensitive to various runtime environmental factors. Maintaining an identical execution environment between the sender and receiver is therefore necessary to ensure reliable decoding.

Additionally, the GUI demonstrator serves as a functional proof-of-concept. In real-world deployments, network-level issues such as packet loss or latency would need to be handled by a dedicated communication protocol.

6. Conclusions

This study evaluates discrete rank-token mapping in an instruction-following chatbot setting. In synchronized token-ID transport, the decoder achieves perfect recovery of completed payloads. However, using a single-forward pass or decoding from re-tokenized plaintext reduces extraction success. Longer payloads require longer responses, which can exceed the generation budget. Additionally, response length and stopping behavior serve as key indicators for steganographic detection. This implementation serves as a functional framework for studying capacity, synchronization, and text quality, while expanding the evaluation to larger prompt datasets and adaptive detectors remains an open direction for future research.