STEALTH Makes Steganography Work When Sender and Receiver Don't Share Identical Hardware

Linguistic steganography breaks when GPUs differ. STEALTH uses exponential races and spinal codes to decode hidden messages across model families, precisions, and architectures — with zero failures in testing.

Imagine you and a friend agree to communicate by flipping coins in a specific pattern. The trick only works if your coins are perfectly identical — same weight, same balance, same aerodynamics. If your friend's coin is even slightly heavier on one side, the whole scheme collapses. That's the state of provably secure linguistic steganography today: sender and receiver must reproduce identical token probability distributions, bit for bit. STEALTH shows that requirement is both unrealistic and unnecessary. The core finding is damning for existing schemes. Across three model families, the authors demonstrate that bit-exact steganographic decoding fails almost completely when the receiver uses different floating-point precision, different quantization, a different GPU, or even just processes tokens in parallel instead of sequentially — with everything else held fixed. This isn't a theoretical concern. It's a practical wall that makes deployed steganography fragile to the point of uselessness in heterogeneous compute environments. STEALTH's mechanism is elegant. The sender runs an exponential race for each token position: keyed pseudorandom noise generates competing 'speeds' for every vocabulary entry, and the token whose noise-weighted probability wins the race gets selected. The key insight is that a probability mismatch at the receiver only flips a token when the race was close — when two tokens had nearly identical noise-weighted scores. Far-away winners survive receiver-side perturbation. This transforms the hard problem of exact distribution matching into a soft problem of error tolerance. The error-correction layer is a rateless spinal code decoded by beam search. Rateless means the sender doesn't need to know the receiver's error rate in advance — the code adapts. Beam search at the receiver explores multiple decoding hypotheses simultaneously, absorbing the flips that do occur. The combination means sender and receiver never need to agree on a single probability distribution, which is the entire point. The empirical results are striking in their completeness. STEALTH decoded every message for every receiver in the sender's model family, at every precision level, at every quantization level, on smaller models, and on different GPU architectures. It even decoded every message across entirely different model families with separate vocabularies and tokenizers. The authors report higher payload per token than prior robust schemes, and both trained steganalyzers and targeted statistical tests failed to distinguish STEALTH output from honest model samples. The security proof establishes that stegotexts remain computationally indistinguishable from honest model output under the exponential-race construction. This is provable security, not empirical — the construction inherits its guarantees from the Gumbel-max trick's distribution-preserving properties. The steganographic channel looks exactly like normal language model sampling to any observer without the key. The practical implication is direct: for the first time, you could embed hidden messages in LLM-generated text and have them reliably decoded by a receiver running a different model, on different hardware, at different precision — without any coordination beyond sharing a key. That's the gap between a laboratory curiosity and a deployable communication channel.