> The keyed 3-way character split feels more like a fragile checksum than a channel. It is trying to be a channel, not a checksum. A checksum tells you whether the message survived, while this kind of partitioning is the actual carrier, the key decides which surface forms stand for bits and the LLM is just providing cover text so the signal looks like ordinary token choice. What people used before in text stego was usually either hand-built synonym swapping or classic covertext schemes, and both run into the same problem, tiny alphabets and very obvious statistical footprints. The annoying part here is less the split itself than the detector model, once the adversary knows you're biasing token selection by character class, the security story becomes about how much that bias moves under the language model distribution, not whether the mapping feels fragile.