Text steganography helps protect citizens' freedom of speech and privacy in cyberspace by constructing innocent-looking texts to evade censorship and surveillance. Existing methods, especially generative ones, rely on delicate character-level manipulations, making them vulnerable to failure even under minor alterations. This paper introduces a novel framework that shifts from character-level to semantic space-based information hiding, which greatly improves improving robustness and reliability. The framework comprises three phases: preparation, where a stable semantic space is designed for hiding information; embedding, where a reversible codebook maps binary messages to semantemes via semantic encoding and source coding; and synthesis, where large language models act as multi-agent systems to produce stegotexts that preserve semantic consistency. Extensive experiments show that our method matches state-of-the-art techniques in hiding capacity and text quality, while significantly surpassing them in robustness-achieving at least an 81.2% higher correct message rate under three types of attacks. These findings highlight the strong potential of semantic-based text steganography.

Steganography, which hides messages within innocent-looking carriers, is an essential technique to protect data privacy. The rapid advancement of generative models makes AI-generated images a potential steganographic carrier. However, the distortion resulting from the embedding of messages makes it difficult for steganographic images to escape deep-learning based detection, especially since such distortion is more pronounced in generative images. To improve the imperceptibility of steganographic generative images, in this paper we propose a cover-source switching based steganographic scheme employing image retouching. Specifically, we utilize an image-adaptive LUTs (LookUp Tables) model to generate the LUT required to retouch the cover image. The generated LUT is then applied to the stego image, effectively obfuscating the steganographic behavior. To ensure accurate extraction, we introduce wet cost to mark ambiguous elements that are strictly prohibited from modification. Experimental results show that our scheme can significantly improve the imperceptibility of the steganographic generative images. Leveraging the reproducibility of generative images, we are able to embed secrets at the pixel level, resulting in higher payload and extraction accuracy compared to existing cover-source switching based steganographic methods.

Linguistic steganalysis is the technology to distinguish whether looking-innocent texts hide covert (possibly hazardous) messages. Traditional methods, dominantly focusing on internal linguistic difference in texts, are seriously challenged by the recent linguistic steganography technology that can reduce the difference to near zero. However, even via the most advanced linguistic steganography methods, due to the random and uncontrollable message bits, steganographic texts may express content against common sense knowledge. To fully employ this defect of linguistic steganography, we propose LINK, a novel Linguistic steganalysis framework with the help of external Knowledge. We link texts to the external knowledge database, and employ Graph Neural Networks (GNNs) to translate linked knowledge into knowledge features, while linguistic features will be captured by the same modules from existing methods. Knowledge features and linguistic features will be combined to make final decisions. Extensive experimental results show that owing to additional external knowledge, the proposed framework can effectively compensate for the shortcomings of existing methods.1

Abstract Bitcoin is a decentralized P2P cryptocurrency. It supports users to use pseudonyms instead of network addresses to send and receive transactions at the data layer, hiding users’ real network identities. Traditional transaction tracing attack cuts through the network layer to directly associate each transaction with the network address that issued it, thus revealing the sender’s network identity. But this attack can be mitigated by Bitcoin’s network layer privacy protections. Since Bitcoin protects the unlinkability of Bitcoin addresses and there may be a many-to-one relationship between addresses and nodes, transactions sent from the same node via different addresses are seen as coming from different nodes because attackers can only use addresses as node identifiers. In this paper, we proposed the evicting and filling attack to expose the correlations between addresses and cluster transactions sent from different addresses of the same node. The attack exploited the unisolation of Bitcoin’s incoming connection processing mechanism. In particular, an attacker can utilize the shared connection pool and deterministic connection eviction strategy to infer the correlation between incoming and evicting connections, as well as the correlation between releasing and filling connections. Based on inferred results, different addresses of the same node with these connections can be linked together, whether they are of the same or different network types. We designed a multi-step attack procedure, and set reasonable attack parameters through analyzing the factors that affect the attack efficiency and accuracy. We mounted this attack on both our self-run nodes and multi-address nodes in real Bitcoin network, achieving an average accuracy of 96.9% and 82%, respectively. Furthermore, we found that the attack is also applicable to Zcash, Litecoin, Dogecoin, Bitcoin Cash, and Dash. We analyzed the cost of network-wide attacks, the application scenario, and proposed countermeasures of this attack.

Ethereum, one of the most popular cryptocurrencies, has attracted increasing attention of people in various fields. As the backbone of Ethereum, its peer-to-peer network has an effect on almost every aspect of the ecosystem. Consequently, it's necessary to understand the topological properties of Ethereum P2P network. In this paper, we conducted a measurement of Ethereum P2P network. Our result shows that the graphs of Ethereum network have a small average shortest path length and a large clustering coefficient, and the degree distribution of nodes does not follow a pure power-law distribution. These indicate that Ethereum network is very close to a small world network. Though there are a large number of stale nodes and useless nodes, Ethereum is still resilient to both random failures and targeted attacks. What's more, we find that there are around one hundred abnormal nodes in the network. The IP addresses of nodes included in the neighbors messages they reply are replaced with their own IP addresses. Those nodes might have a bad influence on network routing.

Tor hidden services (HSs) are used to provide anonymity services to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor HSs use decentralized architecture that makes it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor HSs that allow an adversary with an extremely low cost to block arbitrary Tor HSs. We found that the dominant cost of this attack is IP address resources, the experimental results show that we can use only three IP addresses to eclipse an arbitrary HS with 100% success probability. To understand the severity of the Eclipse attack problems on Tor HSs, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of HSs at any time. Finally, we discuss countermeasures and future works.

Tor hidden Services are used to provide anonymity service to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor hidden services use decentralized architecture making it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor hidden services that allow an adversary with an extremely low cost to block arbitrary Tor hidden services. We found that the dominant cost of this attack is IP address resources. The experimental results show that we can eclipse an arbitrary hidden service with 100% success probability with only 6 IP addresses. To understand the severity of the Eclipse attack problems on Tor's hidden services, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of hidden services at any time.

I2P is a widely used low-latency anonymous network that provides privacy to service providers, such as anonymous web services called eepSites. The large-scale discovery of eepSites allows us to grasp their size, content and popularity. In this paper, three approaches were proposed to discover eepSites: (1) running floodfill routers, (2) gathering hosts.txt files actively and (3) crawling popular portal eepSites. In our nineteen-day real-world experiments, the combination of the three methods in total discovered 1861 online eepSites covering over 80% of all eepSites in I2P network. And the coupon collector's problem was used for theoretical analysis, showing that eepSites discovery based on running floodfill routers is straightforward and efficient with low cost. Besides, the popularity and availability of eepSites were estimated and analyzed.