Define $$S_{k_1,k_2}(n\mathbin\Vert m) = F_{k_1}(H_{k_2}(m) \oplus n),$$ where $n$, $H$, and $F$ all have the same length. It turns out that if $H$ is $\varepsilon$-almost xor-universal, then there is a PRF-distinguisher $A_1$ such that for any PRF-distinguisher $A$ making $q$ queries, $$\operatorname{Adv}^{\operatorname{PRF}}_{S'}(A) \leq \operatorname{Adv}^{\operatorname{PRF}}_{F}(A_1) + \binom{q}{2}\cdot\varepsilon.$$ In brief, if $H$ is almost-xor-universal and $F$ is pseudorandom, then $S$ is pseudorandom. This is Lemma 3.3 of > [Shay Gueron and Yehuda Lindell, ‘GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte’, in _Proceedings of the ACM SIGSAC Conference on Computer and Communications Security_, CCS 2015, pp. 109–119](https://dl.acm.org/citation.cfm?id=2810103.2813613). The $S'$ you defined is not quite $S$. But I leave it as an exercise for the reader to deduce whether there was a reason why Gueron and Lindell split the input into two parts with $H_{k_2}(m) \oplus n$ instead of $H_{k_2}(n \mathbin\Vert m)$, or to find a gap in their proof. (They did seem to reverse the order of $n$ and $m$ in the proof!)