Deniable Encryption from simple primitives Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known algorithm such as AES (without preprossessing $M$) and such that $|M| \ll \sum_{i=1}^n {|p_i|}$ (since this leaks information about how many false plaintexts there are to a party suspicious their adversary may be using deniable encryption)?

Let me expound a little bit on the motivation for these constraints. Let's say that a soldier of country A were captured and country B wanted said soldier to aid them in deciphering the data on his military issued laptop. Country B is not going to allow the soldier to operate the decryption himself. They are going to take an image of his hard drive and ask which algorithm and key he used. The soldier had better reply with a standard algorithm (not known to be deniable). In addition we would expect every bit of the ciphertext is required to decrypt the plaintext, or else country B may begin to suspect deniable encryption.

This last constraint (pertaining to the ciphertext size) seems information theoretically impossible. So let me ask my question in a less rigorous way:
Most deniable encryption systems seem to me to be heuristic engineering solutions. Out of purely academic interest: What scholarly work has been done on deniable encryption that meets the motivation for my formulation?
Deniable encryption is a topic that has been worked on for a while, but recently (in the last year or two), I have seen many more papers. 

I haven't kept up with the area but can make a few comments:


The schemes are typically built with public key primitives instead of symmetric key ones (the distinguishing feature not being the symmetry of the keys, rather the use of a clean mathematical structure instead of non-linear block cipher design)
Most schemes encrypt the message bit-by-bit. This means you only have to embed two possible plaintexts (0 and 1) and it is easy to open a message to any possible message.


Scheme based on Elgamal

There is only one scheme that I know that comes close to fitting your scenario. It is from this paper (sorry, couldn't find a non-gated version) and is based on Elgamal. 

Properties


The scheme only allows opening to two possible messages however this should be sufficient for your motivating example. 
Instead of recovering the different messages using, simply, different keys, it uses two different decryption algorithms. Using the standard Elgamal decryption will give you one message (the fake one) and using a special decryption algorithm will give you the real message. Schemes like these are sometimes called multi-distributional instead of fully-deniable. (Aside: To me, this is reminiscent of steganography: hiding a secret message in innocuous looking data). 
This is a plan ahead scheme meaning you have to know what fake message you want to open the ciphertext up to ahead of time
The scheme is receiver-deniable, meaning the receiver of the message (the person performing decrypt) can deny the true plaintext value. For reasons we will see, the sender cannot. 
Despite being based on Elgamal, the scheme is actually symmetric key; the consequences we will see.


Construction

Recall normal Elgamal, where Alice sends a message to Bob. Bob has a secret key $x$ and a public key $y=g^x$ (for some generator $g$). To encrypt message $m$, Alice chooses a random value $r$ and computes $\langle c_1, c_2 \rangle = \langle g^r, my^r \rangle$. To decrypt, Bob uses secret key $x$ to compute $c_{1}^{-x}c_2$. 

Let's generalize slightly: replace in the ciphertext $g^r$ with some arbitrary value $a$ and $y^r$ with some value b. Then the ciphertext is $\langle a, mb\rangle$. There are lots of a values of $a$ and $b$ that will decrypt to $m$, not just $g^r$ and $y^r$. In fact, any $a$ and $b$ such that $b=a^x$ will work. In this scheme, Bob gives Alice his secret key $x$ (see fine-print below). 

Once Alice has $x$, it is simple. She can, for example (my example, not from the paper), set $a=\mathrm{AES}_k(m)$, using an additional shared secret key $k$ (only used for decrypting the true value), and then compute $b=a^x$. For fake message $\hat{m}$, Alice sends $\langle a, \hat{m}b\rangle$. If Bob wants the real message, he decrypts $c_1$ with AES. If he wants to deny, he claims it is an Elgamal ciphertext and decrypts as normal, with $x$, and gets $\hat{m}$.

In the paper, they set $a=g^km$ and $b=y^km^x$. Here, instead of $k$ being a shared secret, there is a shared secret $s$ and $k=\mathcal{H}(s||\hat{m})$. I don't fully appreciate why the construction needs to be this complicated (comments welcome). To decrypt, Bob, uses $x$ and standard Elgamal decryption to recover $\hat{m}$. With $\hat{m}$ and $s$, he computes $k$ and then computes $g^{-k}c_1$ to recover $m$. 

Fine-print


Because Alice is given Bob's secret key, this means it is no longer a public key encryption scheme. This has consequences: If Charlie also wants to send messages (standard or deniable) to Bob, Bob either has to use a different key pair (which is odd for what is ostensibly a true public key) or Alice can read all the messages.
If Bob is coerced, he can deny that anything more than standard Elgamal is going on. However, if Alice is coerced, they will ask her what message $m$ and randomness $r$ she used to create the ciphertext. Because she didn't create a standard Elgamal ciphertext, she cannot answer for $r$ or compute a suitable one without solving a discrete log.
Finally, it may be odd for something like disk encryption or file encryption to use Elgamal on the data itself. Usually you'd use it to encrypt an AES key, and then use AES to encrypt the actual data.