Maybe pedantic but: it's not that the LLM *is* the PRF, but that we hijack the PRF that you throw into the LLM's token generation. One interesting detail is, apparently (I am very far from an LLM expert so had to double check this) you can do 'greedy decoding' and just sample the most likely token at every step. "Bland but deterministic". An interesting side story is: that's what you're always hunting for when you're looking for a practical stego technique: randomness input to the protocols. Think IVs in stream ciphers, or nonces in digital signatures (see Gustave Simmons "subliminal channel").