Koch Laboratory

Provably-secure steganography over an owned generative channel

Four directions where steganographic security reduces to sampler fidelity rather than an arms race with detectors — including a published negative result on classical image steganography.

Koch Laboratory — provably-secure steganography over an owned generative channel

This direction approaches steganography from the opposite side to classical hiding in finished files (LSB/DCT in an image), which modern CNN steganalysis wins today. The starting point is the Hopper–Langford–von Ahn model: cryptographically secure steganography exists as soon as one has a faithful sampler of the channel distribution. If you own the generator yourself (generative audio; a deterministic document renderer), you own the sampler — so security reduces to the fidelity of the channel model, not to an arms race with the detector. The key boundary observation: a deterministic renderer has zero capacity against an adversary who knows the generator — the carrier is not determinism but keyed non-determinism: the set of render-invariant, legal choices the generator makes anyway, steered by the ciphertext instead of by randomness.

Method. As in the rest of the lab: problem → hypothesis → falsifiable criterion → method → result with boundary conditions. With one twist: here the negative result is often stronger than the positive one, because it settles the channel’s viability before a single payload bit is written.

Publication note (IP). For patentable directions we publish the problem, the state of the art and the success criterion — not the solution’s construction. Where “Construction: withheld” appears, the technical detail is retained as filing material.

1. Decisive test: does the carrier have a defensible channel?

Research question. Before hiding anything: is the “natural” output of my generator (with random tie-break resolution) distinguishable from a corpus of real files declaring the same toolchain/producer? If so, the channel is dead regardless of cryptography. Why it is hard. Security is relative to a specific producer profile, not to “files in general”. The generator must be indistinguishable from the output distribution of the named toolchain it impersonates. The determinism trap: if the impersonated engine resolves ties deterministically, the “free choice” does not exist in the target distribution. Method. A classifier (gradient boosting on structural features + a byte-level CNN) and a two-sample test (C2ST / MMD) of “natural-G vs producer corpus”. Control test: the same with no payload (random tie-break vs corpus) — separating channel-model failure from steganography failure. Success criterion (asymmetric). AUC ≈ 1 falsifies the channel (hard). AUC ≈ 0.5 does not prove security — only “indistinguishable against adversary class A at sample budget B”. The result generalizes both ways. Status: design (baseline experiment not run).

2. Direction 1 — undetectable channel over generative audio

Research question. What is the real throughput of secure embedding over a generative-audio sampler, and how does it trade against sampler fidelity? Why it is hard. The capacity↔fidelity trade-off is not known in advance; audio is, however, a genuine high-entropy sampler with no determinism trap — the clean HLvA case. State of the art (published). HLvA (CRYPTO 2002); Meteor (CCS 2021) — steganography over LLM output; iMEC (ICLR 2023) — perfect security ⟺ a coupling, optimal capacity ⟺ a minimum-entropy coupling (collapsing the cryptographic question onto channel fidelity); Discop (IEEE S&P 2023) — practical, ~0.95 of the limit. Success criterion. Indistinguishability against adversary class A at budget B; measured capacity R bits/unit at fidelity ε — as a testable property. Construction (channel decision points, distortion costs, integration of keyed sampling): withheld (patent option kept open). Status: design.

3. Direction 2 — per-recipient watermark of generated documents

Research question. Can an invisible, per-recipient mark be embedded in a generated document (“who leaked it”) when the publisher controls detection? Why it is hard — and the core of the topic. Undetectability wants sub-threshold perturbations; robustness (Ghostscript re-save, print-to-PDF, even print-scan-OCR) wants supra-threshold ones — the goals are mutually exclusive. This trade-off curve is the actual publishable result. Add the determinism trap: in deterministic PDF the “free entropy” of microtypography is free only against an adversary who cannot reproduce the toolchain — the revision structure is more defensible (real documents carry an unforgeable edit history). Capacity↔collusion tension (quantitative). The bare recipient index = log₂(N) bits (~14 for 10⁴) — fits. Collusion resistance (Tardos / Boneh–Shaw codes) = O(c²·log(N/ε)) → on the order of 10⁵–10⁶ bits → does not fit in a short document. A project boundary, not a detail. State of the art (published). Syndrome-trellis codes (minimum distortion, TIFS 2011); Tardos (STOC 2003) and Boneh–Shaw (CRYPTO 1995) — collusion-resistant codes; Brassil–Low–Maxemchuk — a print-surviving mark. Construction (embedding surface, per-choice distortion cost, per-recipient fingerprint layer): withheld (patent option kept open — direction flagged as sensitive). Branch: a digital-only variant (survives re-save) and a physical one (survives print-scan) have different threat models. Status: design.

4. Negative result (published): generic image steganography

Thesis. Classical embedding into a finished image (LSB, DCT) is a losing game: CNN steganalysis detects most classical embeddings today, and the attacker holds the structural advantage in the cat-and-mouse race. The lab deliberately does not pursue this as a core — value lies only in steganography over a channel one owns (directions 1–2). Why we publish the negative. It is a reasoned scoping decision: it shows where the adversary has the advantage and why the reframing onto the HLvA model is the only defensible path. Status: closed (negative result, published).