Steganeur accomplishes this by encoding a secret message into the token choices of a language model, producing cover text that reads like a normal sentence. A recipient recovers the message using only the cover text and the model. With the rejection method, the output is statistically identical to normal generation, not just something that looks similar.
The interesting problem I hit: steganeur reads the model's logprobs directly, and three of the four methods need them to come out exactly the same on encode and decode. On GPU reductions are non-deterministic, so the logprobs drift between runs, which is enough to corrupt the bits. Only one method (block) survives on GPU, because it bins tokens by their id rather than by probability. So block works on any server, the other three need CPU.
Written in Rust, dual-licensed MIT/Apache-2.0, targets llama.cpp (the server must return top_logprobs with token id fields)