This paper studies secret-key-assisted subliminal channels in standardized ML-DSA (FIPS 204). It makes explicit the byte-level embedding surface created by two properties of the standard: accepted signatures allow recovery of the hidden commitment vector from public signature data given the signing-equivalent secret component s1, and the standardized BitPack/BitUnpack mapping for the approved gamma1 values has full support on a fixed-length packed byte representation. Based on these properties, the paper presents a packed-domain embedding and extraction construction, derives covert capacities of 2,272 bytes for ML-DSA-44, 3,168 bytes for ML-DSA-65, and 4,448 bytes for ML-DSA-87, and reports implementation and validation results from a patched C library. The relevant threat model is kleptographic / algorithm-substitution-style secret sharing rather than public tagging, since extraction requires signing-equivalent secret material.
Mounir IDRASSI (Tue,) studied this question.