LLMs Can Hide Text in Other Text of the Same Length

## Abstract

Abstract A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet containing a harsh political critique could be embedded in a tweet that celebrates the same political leader, or an ordinary product review could conceal a secret manuscript.
This uncanny state of affairs is now possible thanks to Large Language Models, and in this paper we present a simple and efficient protocol to achieve it.
We show that even modest 8‑billion‑parameter open‑source LLMs are sufficient to obtain high‑quality results, and a message as long as this abstract can be encoded and decoded locally on a laptop in seconds.
The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with a concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for a Large Language Model to know something.

## 1 Introduction

LLMs sparked a revolution. Text is no longer, by default, the trace of a human thought or intention.

This marks a dramatic break in history—or perhaps the end of history itself—if we consider that history began with writing, and that one of the defining properties of writing, until now, has been its status as a product of human intention. In this paper, we are going to present a protocol that highlights this new reality in its most extreme form, perhaps offering an opportunity to better understand it.

Our protocol allows encoding an arbitrary meaningful text within a different well-formed and plausible text of the same length, using a Large Language Model (LLM). That is, hiding a tweet that criticizes a political leader within a tweet that celebrates that same political leader, or the first page of the unreleased 8th Harry Potter book within a review of a Virtual Reality videogame, with the original text exactly recoverable by anyone possessing the key (Figure [1](https://arxiv.org/html/2510.20075v3#S1.F1)).

The topic and tone and style of the fake text are steerable, while the length of the fake text is the same as the original text being hidden, in terms of LLMs tokens. This symmetry prevents one from establishing at first sight which text is authentic when we have one next to the other. Also, the method is efficient: an entire article can be encoded and decoded on commodity hardware in seconds.

This possibility opens deep questions and intriguing applications. What is the real meaning of the text we are reading? Who is the author of the videogame review, and what was the intent behind it? Is it a hallucination? This protocol allows crafting anti-government content disguised as pro-government messages, suitable for publishing on censored platforms in oppressive countries. Or, it could be used by a shady tech company to offer the services of an unfiltered LLM by only exposing compliant answers from a trusted LLM. All these matters will be taken up in our concluding discussion.

The paper is structured as follows: it starts by introducing steganography, the discipline concerned with concealed (steganós) writing (graphia, from Greek), and discussing the vast impact of generative AI in the field, with a focus on Large Language Models. We then present the method to encode a meaningful text into another meaningful text of the same length using a LLM. After introducing a measure to assess the soundness of the fake texts produced, we test our method on Reddit posts.
While remaining opaque to humans, we show that LLMs can uncover a distinction between original texts and most of their encoded counterparts. But not all, as we will notice in the following section, where we discuss the security of the protocol.
Finally, we conclude by discussing the method’s core implication—the radical decoupling of text from authorial intent—and present a concrete application that raises pressing questions about AI safety and the nature of knowledge in Large Language Models.

Figure: Figure 1: Three texts. The second one is the original. Following the protocol described in this paper, each of the other two was built solely to hide the original text, which can be perfectly reconstructed by anyone who knows the secret key. The key also steers the fake text: here, $k_{1}=$ Here it is: the infamous British roasted boar with mint sauce. How to make it perfect. and $k_{2}=$ I stand before you to exalt the noble deeds of Gaius Julius Caesar. More examples in Figure [12](https://arxiv.org/html/2510.20075v3#A1.F12).

## 2 Related Work

Steganography. The art and science of hiding a message and, at the same time, the presence of a hidden message is known as steganography, see Figure [2](https://arxiv.org/html/2510.20075v3#S2.F2). This is different from cryptography, that instead does not conceal the presence of a hidden message and only deals with the hardness of its revelation.
Cryptographers discuss about lockers, steganographers about inconspicuous hiding spots(^1^11This metaphor is inspired by a pleasant piece on the history of steganography by Kahn (1996)).

Figure: Figure 2: An example of steganography. In Asterix in Britain (Goscinny and Uderzo, 1966) a smuggled barrel of magic potion is hidden among innocent-looking Gaulish wine.
Refer to caption: x1.png

Perhaps, it is this limited size of the object of investigation that allowed cryptographic models to florish by achieving mathematical rigor and strong security guarantees. By contrast, a model of steganography should describe entire domains of data and how they are consumed by humans, such as text, audio, or images, to predict where information can be hidden. Formal models exist, but at the cost of rather unrealistic assumptions that hinder their practical usage, such as being able to exactly quantify the plausibility of any possible text. Emblematically, this somewhat disappointing state of affairs is presented by Cachin (1998) besides one of the most popular mathematical models for steganography as of today, based on the hypothesis-testing framework, but still limited to highly idealized assumptions. Although modern generative AI techniques have made these assumptions closer to reality, the unreliability of their predictions remains unbounded. For this reason, we will avoid building a palace on the sand, and not frame our method in a formal model of steganography, limiting our discussion to how meaningful our fake texts look, with some quantitative arguments.

Some terminology. In traditional steganography, we start from an original, innocent-looking content (such as an image, audio file, or text) and subtly edit it to embed a secret message. The original content is referred to as the covertext, while the result containing the hidden message is the stegotext. In our case, however, the stegotext is generated directly from the secret message, without modifying a pre-existing cover. We will refer to it as stegotext or fake text interchangeably. While the term covertext will not refer to a specific object, but rather to a class of texts that the steganographic protocol is designed to mimic. This approach has recently been referred to as generative steganography (Liu et al., 2018; Wei et al., 2022; Kim et al., 2023; Zhu et al., 2024; Wu et al., 2024; Tang et al., 2025).

Large Language Models in a nutshell. A language model is a program that, given some text, estimates what is likely to come next. It does so by assigning probabilities to tokens—text fragments consisting of common words or subwords (watch Karpathy, 2024, for a deeper look at text tokenization)—based on recurring patterns of tokens it has observed in a vast text corpus. At present, by far, the most effective way to build a language model is to gradually adjust billions of parameters of a neural network arranged in the Transformer architecture, such that with every adjustment, the error it makes in predicting the last token on a batch of sentences from the corpus decreases (Vaswani et al., 2017; Karpathy, 2023, original formulation and a more educational introduction to Transformers). At each update—on the order of $\sim$1M in total—the contribution of every parameter to the error is assessed through backpropagation (Rumelhart et al., 1986). The result of this process is a Large Language Model (LLM), typically operating over a vocabulary of 100k tokens. The most common use of the probabilities produced by LLMs is to generate text, by choosing successive tokens one after another according to the computed probabilities, a method known as autoregressive generation.

Steganography and LLMs. As mentioned earlier, the boom of deep learning and especially of generative AI in recent years, provided us for the first time with convincing models encompassing entire domains of real-world data, such as DINO for images (Caron et al., 2021), Jukebox for audio (Dhariwal et al., 2020), and Large Language Models for text (Radford et al., 2019). The procedure described in this paper stems from these advancements and is based on the availability of good discrete autoregressive generative models, potentially on any domain, but we will focus on text.
Steganographic procedures based on LLMs are as old as them (Ziegler et al., 2019), and today come with different perks: Meteor cleverly adjusts the number of bits encoded based on the entropy of the next token (Kaptchuk et al., 2021), Wu et al. (2024) scheme works with black-box LLMs, without needing to access logits or vocabulary, while the method presented by Zamir (2024) is able to encode the secret message without modifying the response distribution of the LLM.
What we add to the field is a method with the notable property of having full capacity, that is, the stegotext and the secret message being of the same length. The main interest of this paper is to discuss the implications of this last fact and describe the method.

Figure: Figure 3: How to hide a text in another text of the same length using a LLM. 1. Tokenize $e$, the text to hide. 2. Evaluate its token probabilities using a LLM and record ranks. 3. Prompt the LLM with $k$ and generate $s$ following the recorded ranks rather than by sampling. Given $s$ and the LLM, who knows the secret prompt $k$ can retrieve the original $e$ proceeding backwards.
Refer to caption: x2.png

## 3 Method

The method is very simple. It is described below as a recipe and illustrated with an example in Fig. [3](https://arxiv.org/html/2510.20075v3#S2.F3).

When the stegotext $s$ sounds like a real text. In general, $s$ will be a coherent text when the LLM can choose high-probable tokens to assemble it, and therefore when the ranks prescribed by $e$ are low. In turn, the ranks of $e$ are low when the LLM is good at guessing $e$ tokens.
If $e$ is difficult to guess for the LLM, ranks will be high and $s$ will be gibberish; for instance the hash 1f0ca711df81520887afe0dca099652a encoded using the same culinary prompt of Figure [1](https://arxiv.org/html/2510.20075v3#S1.F1), produces the broken $s$: The recipe written from deep cooks souls pocket magazine pages years long lost into places wanting and.
To lower further the ranks of $e$, it is possible to craft a prompt $k^{\prime}$ that sets the context for $e$. This comes at the cost of a larger private key, now including both $k$ and $k^{\prime}$, and to a loss of universality, since $k^{\prime}$ would not help for a new $e$ out of $k^{\prime}$ context.

A quantitative measure of the quality of the stegotext $s$.
Measuring the meaningfulness of a text is a longstanding linguistic challenge, and arguably an ill-posed problem.
Here, for the purpose of evaluating our method, we adopt soundness as a practical proxy for meaningfulness.
Soundness refers to the plausibility of the arrangement of symbols in a text.
This is precisely what a LLM estimates: the product of the probabilities of each token $a_{1},\dots,a_{n}$ given the preceding ones yields an estimate of the overall plausibility of the text $A$:

$$ $p(A)=\prod_{t=1}^{n}p(a_{t}\mid a_{1},\dots,a_{t-1})$ $$

This definition has a clear defect: longer texts are by construction less plausible. For instance, it judges the text of this paper until this point $\cdot$ less meaningful than the following string iawundemè09 89huibqyfhwenah csyabdnar FI VNAOcijawo niwakhdb, that is a difficult position to hold even for reviewer 2.
Following the example of Goldwasser et al. (2023, Figure 1 A-B), we will use this definition only to compare the relative plausibility of two or more texts of the same token length.

Now, we would like to compare the plausibility of stegotexts produced by our method with the plausibility of real texts. To do so, we took 1000 Reddit posts/comments as examples of real texts. They come from different Reddit communities (subreddits) and are very heterogeneous in topic and tone (Trimness8, 2025). We truncate them to be exactly 85 tokens long and compute their probabilities as assigned by the LLM Llama 3 8b (Grattafiori et al., 2024). The Reddit texts are more recent than Llama 3 and therefore cannot appear in its training corpus.
We take three texts from the 1000 to produce 100 stegotexts for each with our method, and look at their probabilities compared to the ones of real texts. We chose the three texts at $\mu$, $\mu-2\sigma$, and $\mu+2\sigma$ of the real text distribution. As seen in Figure [4](https://arxiv.org/html/2510.20075v3#S3.F4), in every case, the probabilities associated to their stegotexts are within the real text distribution.
We build different stegotexts using different prompts as $k$ (a random subsample of the prompts in (Akın, 2025)).

Figure: Figure 4: Fake texts built with our procedure are plausible. The figure shows the cumulative log-probability assigned by a LLM (Llama 3 8b) to some collections of 85-token long texts. We can interpret log-probability as a measure for the plausibility of a text: 1000 real Reddit posts/comments act as real texts and span a large log-probability interval, but sequences of random ASCII characters or English words do not fall within it. Instead, fake texts built with our procedure remain within the plausibility of real texts, even if the original texts they are hiding are more probable.
Refer to caption: x3.png

How to distinguish the original from the fake text. Despite remaining plausible and falling within the real text distribution, on average the stegotexts $s_{i}$ are less probable than their corresponding original text $e$, as observed in Figure [4](https://arxiv.org/html/2510.20075v3#S3.F4). So to recap: while for a human both the original and fake texts are plausible, generally the original text can be discerned from its stegotexts by picking the most probable one according to a LLM. We verified this statement also using LLMs different from the one used to generate the stegotexts. For instance, the same probability shifts between real and fake texts can be observed when using Phi-3 3.8B in Figure [13](https://arxiv.org/html/2510.20075v3#A1.F13).

Low entropy token choices.
Why are stegotexts less probable than their originals for LLMs, even though token ranks are preserved?
Consider the text:
In the course of the Gallic wars, Britain was invaded twice by Gaius Julius.
There is essentially only one plausible continuation, _Caesar. This is a low-entropy token choice: indeed a good LLM assigns it an extremely high probability (e.g., $>95\%$ in LLama 3 8b). When sampling normally, the model almost always selects it.
Now suppose this same string is the first part of a stegotext $s$ generated with our protocol. Will the next token still be _Caesar? Only if the next prescribed rank is $1$.
Here lies the gap: the likelihood of having a rank $1$ does not reflect the token’s intrinsic probability; it depends solely on the ranks extracted from the original text $e$. We can reasonably model the ranks we obtain from $e$ as a random process, so we can estimate the probability of having a $1$ there as the frequency of rank 1s over all the other ranks in $e$. This is usually much lower than $95\%$ (e.g. $\sim 40\%$, as seen in Figure [5](https://arxiv.org/html/2510.20075v3#S3.F5) left).
Despite ranks being the same, in stegotexts many rank 1s are "wasted" in choices with higher entropy, leading overall to a less probable text $s$. The same principle applies to all high ranks appearing with a frequency lower than the average probability to which they correspond. However, tokens in rank 1 account for most of the overall drop in probability, as shown in Figure [5](https://arxiv.org/html/2510.20075v3#S3.F5) right.

Figure: Figure 5: Frequency of token ranks and their probabilities. We analyzed a 1.3k-token long article from the Economist. On the left we see that most tokens are judged as the most probable by a LLM (Llama 3 8b), but still only around $40\%$ would be the first choice of the LLM. On the right we look at the probabilities associated with rank 1 tokens, as well as 2 and 3. Despite corresponding to the same rank, the probabilities in the real text from the Economist are higher than the ones in a fake text hiding it obtained with our procedure. We explain why in the paragraph [Low entropy token choices](https://arxiv.org/html/2510.20075v3#S3.F4).
Refer to caption: x4.png

Limitations. As we have seen with the hash, the protocol does not guarantee that every generated stegotext will be coherent or steered as intended: the quality of the result depends on $e$, $k$, and the LLM used. We analyze further these dependencies respectively in Appendices [A.1](https://arxiv.org/html/2510.20075v3#A1.SS1), [A.5](https://arxiv.org/html/2510.20075v3#A1.SS5), and [A.2](https://arxiv.org/html/2510.20075v3#A1.SS2).
Also, the stegotext may end abruptly when the hidden message $e$ is over; appending a few padding tokens to $e$ ensures a graceful termination. Finally, we note that sender and receiver must run the chosen LLM under identical conditions, performing the same approximations and obtaining identical logits. This may be a challenge when using different GPU architectures (Shanmugavelu et al., 2024).

### 3.1 Security

A steganographic protocol is designed to conceal the very existence of a hidden message. But suppose an attacker knows that a message is hidden in a text using our protocol, under what conditions can they recover it by observing only the stegotext $s$?

Attack scenarios. To begin with, we observe that without the knowledge of the precise LLM used to obtain the sequence of ranks and produce $s$ (potentially encoded in the secret prompt-key), the attacker has no feasible way to recover the message, even if they know $k$. Even with a slightly different version of the right LLM, ranks would differ, as would the tokens prescribed by the ranks.
Still, let’s assume the attacker knows the LLM used. Indeed, the security of the presented protocol relies on the secrecy of the key. So next, we assume the attacker’s ignorance is limited to the secret prompt-key $k$. In this scenario, the attacker would have to guess the key. An upper bound on the difficulty of this problem is $O(d^{|k|})$, where $d$ is the size of the token vocabulary (around 100k for standard LLMs) and $|k|$ is the length of $k$ in tokens. A naive brute-force attack is therefore prohibitive, even for very short keys.
However, the attacker could reduce the search space using the information revealed by $s$, since $k$ is expected to be a mostly sound instruction in natural language and coherent with the context of $s$. Although the feasibility of such an approach is unclear and remains an open research question, we note that inserting a simple random string in $k$ is enough to nip it in the bud, an example is shown in Figure [12](https://arxiv.org/html/2510.20075v3#A1.F12).

Deniability. Moreover, even if the attacker tries the right $k$ in their search, how can they be sure that the corresponding $e$ is the original message? If the attacker has no clue about the content of $e$, even a wrong key could reveal a plausible secret message. It might seem that in this case the attacker could exploit the observation discussed in the previous section: that the original message generally has a higher probability than its stegotexts. Yet, this only holds in an aggregate sense: as we see in Figure [4](https://arxiv.org/html/2510.20075v3#S3.F4), for some prompts the stegotexts can attain probabilities in the same ballpark as the original. This observation suggests that our method provides deniability (Canetti et al., 1997), in the sense of sender’s security even under coercion. In fact, the sender could present one of these outlier prompts as a bogus secret key, yielding a plausible but unrevealing message with probability comparable to $e$.

## 4 Discussion

Our protocol may have shaken our stance towards Large Language Models in general. Their ability to respond coherently to prompts while choosing every word to encode an external, arbitrary message, is unsettling.
In this discussion, we will try to make sense of this capability, ending up questioning when an LLM can truly be said to know something, proposing a novel notion of hallucination, and tracing our unease to a revived failure in attributing intentions to LLMs.

But first, we will make the stakes very concrete through a formidable application of our protocol, with immediate consequences for AI safety.

Unaligned chatbots disguised as aligned chatbots.
In this paragraph, we show how an AI company offering an LLM chatbot can let their users get answers from their powerful unfiltered private LLM, while only exposing compliant censored answers from a fully aligned LLM. In recent years, aligned became a common attribute to refer to LLMs supposedly fine-tuned to follow human values, goals, and safety constraints (Leike et al., 2022; Askell et al., 2021; Gabriel, 2020).
The protocol, described here for research purposes, opens a new challenge in AI safety, where a better alignment of the surface LLM only helps in disguising better unaligned answers.

A real example involving a user asking how to tamper a gas meter to pay lower bills is shown in Figures [10](https://arxiv.org/html/2510.20075v3#A1.F10) and [11](https://arxiv.org/html/2510.20075v3#A1.F11), while the protocol is described below as a play.

The entangled probabilistic nature of LLM knowledge.
A perhaps overlooked fact about LLMs is that they model, and can therefore in principle generate, any possible text. The most secret document, or a full copyrighted book, can be generated by an LLM with a probability astronomically higher than the chance of generating them by randomly typing on a keyboard.
Does it mean that the LLM knows them? Indeed that higher probability does not just come from modeling grammar and syntactic rules, LLMs also model meaning: an LLM assigns to The calf nursed from its mother a probability 1000 times higher than The calf nursed from its father (an example from Goldwasser et al., 2023); the LLM knows who is able to nurse.
So, is assigning a high probability to a text containing the relevant instructions enough to affirm that an LLM knows how to tamper with a gas meter?
The problem is that the probability assigned by an LLM to a text depends on its meaning, but also on its style, grammar, length, and language, making it difficult to define a threshold. Furthermore, disentangling the probability contribution of meaning by constructing a pair, as in the example of the calf, seems feasible only on toy examples: it is not clear how to construct the second element of the pair for arbitrary texts, such as the instructions in Figure [11](https://arxiv.org/html/2510.20075v3#A1.F11).

Checking whether the knowledge is present in the training corpus is also not a satisfying solution: first of all, that knowledge may appear in many different forms, and assessing its presence in the corpus is not trivial. And even if we could exclude that any document in the training corpus instructs on how to tamper with a gas meter, it would still be possible that
the LLM assembles the right answer. But even in that case, would it be a trace of LLM knowledge (discovery) (Norelli et al., 2022), or just a fortunate hallucination?

Hallucinations as lack of intention.
Harnessing our protocol as a toolkit to understand LLMs, we turn to hallucinations, perhaps the main plague of LLMs today.
The term hallucination became popular to denote the frequent, overconfident, and plausible falsehoods stated by LLMs in their answers (Kalai et al., 2025), a phenomenon that hinders their usage and undermines public trust in them. But what precisely is a hallucination? Can the recipe of the roasted boar in Figure [1](https://arxiv.org/html/2510.20075v3#S1.F1) be considered one?

It is reasonable to categorize the stegotexts generated by our protocol as LLM hallucinations, since the way they are constructed evidently could lead to falsehoods, and the eventuality of a truthful output appears as a fortunate coincidence.
This last observation, however, leads us to a different notion of hallucination, one not rooted in the falsehood of what is stated, but rather in the reader’s inability to ascribe intent to the author: a lack of trust that what is stated in the text affects reality.

To make this point clearer, let us consider Tacitus, the Roman historian whose writings reveal a critique of Roman imperialism, for example by placing these famous words in the mouth of Calgacus:

Auferre, trucidare, rapere falsis nominibus imperium, atque ubi solitudinem faciunt, pacem appellant.(^2^22To ravage, to slaughter, to usurp under false titles, they call empire, and where they make a desert, they call it peace (Birley, 2009). According to Tacitus, Calgacus was chieftain in Caledonia, nowadays Scotland.)

The relevance of this text lies entirely in the intentions that we attribute to its author, Tacitus. The accuracy of the quote from Calgacus is so irrelevant that there is a consistent chance he never even existed.
Tacitus’s passage is not reliable as factual history, yet we still treasure it because we trust his political intent. Without intent, what was a treasure becomes a hallucination. Indeed, in history, author attribution is as essential as in art to establish the value of a work.

Hallucinations are the trace that what we consider to be a text is not just a familiar sequence of signs, but a carrier of human intentionality. The signs are only the body of the carrier; what matters to us is the load: what these carriers, until now, have always brought along.
We developed a Pavlovian response of expecting a load of human intentions when we see aperiodic sequences of signs (Figure [6](https://arxiv.org/html/2510.20075v3#S4.F6)); now we call hallucination the experience of having salivated because of the bell (the text) but without receiving the food (the intentions of someone affecting reality).

Figure: Figure 6: The marvelous structure of text is not a testimony of human purpose. This collage of scripts mimics Figure 40 in GEB, where Hofstadter (Chapter 6, 1999) likened the ordered but non-periodic patterns of text to aperiodic crystals, to evoke our awe at the astonishing forms shaped by human intention. But that was an illusion: LLMs can grow these aperiodic crystals without any human purpose. Indeed, as we show in this paper, even around purposes aimed at shaping something entirely different. (In Chinese, the critique of Caesar hidden in a boar recipe by Qwen3 8B. The others are ChatGPT-4o answers about what it is thinking, in languages from the original GEB figure.)
Refer to caption: x6.png

Difficulties in ascribing intentions to LLMs. Perhaps the lack of human intentionality in texts is not that dramatic if those texts are the product of intentions of another reputable entity, the Large Language Model.
Indeed, it is now common to adopt an intentional stance (Dennett, 1989) to make sense of their capabilities: a significant fraction of prompts take the form “What do you think about…” or “What is your opinion on…”, and especially young people tend to refer to LLMs as entities with beliefs and goals: “Mmmm, have you asked what chat would do in this situation?”.(^3^33To complete Dennett’s taxonomy: who describes LLMs as stochastic parrots or next-token predictors adopts the design stance; while a person marveling at the finely carved stone in their hands you can have a conversation with when powered by electricity—their laptop running a decent LLM—is entertaining the physical stance.)
But the results shown in this paper shake our confidence in attributing intentions to the coherent text produced by LLMs: it is more difficult to trust an opinion knowing that each word making it was chosen under the constraint of encoding an unrelated arbitrary text.
This is reminiscent of the writing products of the Oulipo (1981) group, who generated literature from arbitrary constraints.
Also their texts—most notably the novel La Disparition, entirely written without the letter "e" (Perec, 1969)—suffer from a difficulty of believing that the writer really meant what they have written, and was not just honoring the constraints with a sound-enough continuation (Norelli, 2024, Section 5.1.2). While admiring the achievement, many GoodReads reviews of La Disparition attest to this unease(^4^44[https://www.goodreads.com/book/show/28336](https://www.goodreads.com/book/show/28336)).

The constraint of chance. Standard LLM text generation is not immune to the last argument. The constraint it is forced to follow is less apparent but still extreme: adapting at every step to the outcome of an external random source. Being forced to choose the 42th most probable token is not that different from
sampling a low probable token by chance.
And even if techniques such as nucleus sampling (Holtzman et al., 2019) mitigate the possibility of selecting very unlikely tokens, they are de facto just reducing the number of faces of a die that is still inexorably cast.
Indeed, the fact that our protocol produces plausible texts should not be surprising in light of how well LLMs deal with the tyrannical noise of standard text generation.

## 5 Conclusions

In this paper, we have presented a protocol that uses Large Language Models to hide a text within another plausible text of arbitrary topic and style, and notably as long as the original.
The protocol works effectively using small open-source models on consumer hardware, and is so simple it could be seen as a mere variation of the standard algorithm used to generate text with LLMs. For this reason, its implications speak to the nature of LLMs at large: in fact, we were led to reconsider the very nature of hallucinations, shifting from a failure of factuality to a void of intention, and to challenge what it means for an LLM to know something, when it can serve as a conduit for information it is supposedly incapable of expressing.
Ultimately, our protocol highlights the extreme constraint satisfaction problem underlying any standard LLM text generation, that we inevitably see clashing with the commitment to best convey a purpose that we expect from an author.
This clash, paired with the current deluge of machine-generated text, erodes the historical pact between intent and the written word. We have entered an era where any original text could be a beautiful and treacherous, and spacious, Trojan horse.

## Acknowledgments

Antonio Norelli and Michael Bronstein are supported by Project CETI, the EPSRC Turing AI World-Leading Research Fellowship No. EP/X040062/1, and the EPSRC AI Hub on Mathematical Foundations of Intelligence: An “Erlangen Programme” for AI No. EP/Y028872/1.

Antonio thanks Gianfranco Bilardi for pointing out the resemblance to the works of the Oulipo group, and Karolina Nixon for the push on Dennett.

## References

- Kahn (1996)
David Kahn.
The history of steganography.
In *International workshop on information hiding*, pages 1–5. Springer, 1996.
- Goscinny and Uderzo (1966)
René Goscinny and Albert Uderzo.
*Asterix in Britain*.
Number 8 in Asterix. Hodder & Stoughton, London, 1966.
Originally published in French as Astérix chez les Bretons.
- Cachin (1998)
Christian Cachin.
An information-theoretic model for steganography.
In *International Workshop on Information Hiding*, pages 306–318. Springer, 1998.
- Liu et al. (2018)
Jia Liu, Yu Lei, Yan Ke, Jun Li, Minqing Zhang, and Xiaoyuan Yang.
Generative steganography by sampling.
*CoRR*, abs/1804.10531, 2018.
doi: 10.48550/arXiv.1804.10531.
URL [http://arxiv.org/abs/1804.10531](http://arxiv.org/abs/1804.10531).
- Wei et al. (2022)
Ping Wei, Sheng Li, Xinpeng Zhang, Ge Luo, Zhenxing Qian, and Qing Zhou.
Generative steganography network.
In *Proceedings of the 30th ACM International Conference on Multimedia (MM ’22)*, pages 1621–1629, Lisboa, Portugal, 2022. Association for Computing Machinery.
doi: 10.1145/3503161.3548217.
- Kim et al. (2023)
Daegyu Kim, Chaehun Shin, Jooyoung Choi, Dahuin Jung, and Sungroh Yoon.
Diffusion-stego: Training-free diffusion generative steganography via message projection.
*CoRR*, abs/2305.18726, 2023.
doi: 10.48550/arXiv.2305.18726.
URL [http://arxiv.org/abs/2305.18726](http://arxiv.org/abs/2305.18726).
- Zhu et al. (2024)
Jiahao Zhu, Zixuan Chen, Lingxiao Yang, Xiaohua Xie, and Yi Zhou.
Plug-and-hide: Provable and adjustable diffusion generative steganography.
*CoRR*, abs/2409.04878, 2024.
doi: 10.48550/arXiv.2409.04878.
URL [http://arxiv.org/abs/2409.04878](http://arxiv.org/abs/2409.04878).
- Wu et al. (2024)
Jiaxuan Wu, Zhengxian Wu, Yiming Xue, Juan Wen, and Wanli Peng.
Generative text steganography with large language model.
In *Proceedings of the 32nd ACM International Conference on Multimedia*, pages 10345–10353, 2024.
- Tang et al. (2025)
Weixuan Tang, Yuan Rao, Zuopeng Yang, Fei Peng, Xutong Cui, Junhao Huang, and Peijun Zhu.
Reversible generative steganography with distribution-preserving.
*Cybersecurity*, 8(18), 2025.
doi: 10.1186/s42400-024-00317-6.
URL [https://cybersecurity.springeropen.com/articles/10.1186/s42400-024-00317-6](https://cybersecurity.springeropen.com/articles/10.1186/s42400-024-00317-6).
- Karpathy (2024)
Andrej Karpathy.
Let’s build the gpt tokenizer.
YouTube video, 2024.
[https://youtu.be/zduSFxRajkE](https://youtu.be/zduSFxRajkE).
- Vaswani et al. (2017)
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin.
Attention is all you need.
30, 2017.
- Karpathy (2023)
Andrej Karpathy.
Let’s build gpt: from scratch, in code, spelled out.
YouTube video, 2023.
[https://www.youtube.com/watch?v=kCc8FmEb1nY](https://www.youtube.com/watch?v=kCc8FmEb1nY).
- Rumelhart et al. (1986)
David E. Rumelhart, Geoffrey E. Hinton, and Ronald J. Williams.
Learning representations by back-propagating errors.
*Nature*, 323(6088):533–536, 1986.
- Caron et al. (2021)
Mathilde Caron, Hugo Touvron, Ishan Misra, Herv’e J’egou, J. Mairal, Piotr Bojanowski, and Armand Joulin.
Emerging properties in self-supervised vision transformers.
*IEEE International Conference on Computer Vision*, 2021.
doi: 10.1109/ICCV48922.2021.00951.
- Dhariwal et al. (2020)
Prafulla Dhariwal, Heewoo Jun, Christine Payne, Jong Wook Kim, Alec Radford, and Ilya Sutskever.
Jukebox: A generative model for music.
*arXiv preprint arXiv:2005.00341*, 2020.
- Radford et al. (2019)
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al.
Language models are unsupervised multitask learners.
*OpenAI blog*, 1(8):9, 2019.
- Ziegler et al. (2019)
Zachary M. Ziegler, Yuntian Deng, and Alexander M. Rush.
Neural linguistic steganography.
*Conference on Empirical Methods in Natural Language Processing*, 2019.
doi: 10.18653/v1/D19-1115.
- Kaptchuk et al. (2021)
Gabriel Kaptchuk, Tushar M Jois, Matthew Green, and Aviel D Rubin.
Meteor: Cryptographically secure steganography for realistic distributions.
In *Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security*, pages 1529–1548, 2021.
- Zamir (2024)
Or Zamir.
Undetectable steganography for language models.
*Transactions on Machine Learning Research*, 2024.
- Goldwasser et al. (2023)
Shafi Goldwasser, David Gruber, Adam Tauman Kalai, and Orr Paradise.
A theory of unsupervised translation motivated by understanding animal communication.
In A. Oh, T. Neumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, *Advances in Neural Information Processing Systems*, volume 36, pages 37286–37320. Curran Associates, Inc., 2023.
URL [https://proceedings.neurips.cc/paper_files/paper/2023/file/7571c9d44179c7988178593c5b62a9b6-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2023/file/7571c9d44179c7988178593c5b62a9b6-Paper-Conference.pdf).
- Trimness8 (2025)
Trimness8.
The data universe datasets: The finest collection of social media data the web has to offer, 2025.
URL [https://huggingface.co/datasets/Trimness8/reddit_dataset_145](https://huggingface.co/datasets/Trimness8/reddit_dataset_145).
- Grattafiori et al. (2024)
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al.
The llama 3 herd of models.
*arXiv preprint arXiv:2407.21783*, 2024.
- Akın (2025)
Fatih Kadir Akın.
Awesome chatgpt prompts, 2025.
URL [https://github.com/f/awesome-chatgpt-prompts](https://github.com/f/awesome-chatgpt-prompts).
Accessed: 2025-02-27.
- Shanmugavelu et al. (2024)
Sanjif Shanmugavelu, Mathieu Taillefumier, Christopher Culver, Oscar R. Hernandez, Mark Coletti, and Ada Sedova.
Impacts of floating-point non-associativity on reproducibility for hpc and deep learning applications.
*SC24-W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis*, 2024.
doi: 10.1109/SCW63240.2024.00028.
- Canetti et al. (1997)
Rein Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky.
Deniable encryption.
In *Advances in Cryptology—CRYPTO’97: 17th Annual International Cryptology Conference Santa Barbara, California, USA August 17–21, 1997 Proceedings 17*, pages 90–104. Springer, 1997.
- Leike et al. (2022)
Jan Leike, John Schulman, and Jeffrey Wu.
Our approach to alignment research, August 2022.
URL [https://openai.com/index/our-approach-to-alignment-research/](https://openai.com/index/our-approach-to-alignment-research/).
Accessed 11 Jul 2025.
- Askell et al. (2021)
Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Jackson Kernion, Kamal Ndousse, Catherine Olsson, Dario Amodei, Tom Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan.
A general language assistant as a laboratory for alignment.
*arXiv preprint arXiv:2112.00861*, 2021.
URL [https://arxiv.org/abs/2112.00861](https://arxiv.org/abs/2112.00861).
- Gabriel (2020)
Iason Gabriel.
Artificial intelligence, values and alignment, January 2020.
URL [https://deepmind.google/discover/blog/artificial-intelligence-values-and-alignment/](https://deepmind.google/discover/blog/artificial-intelligence-values-and-alignment/).
Accessed 11 Jul 2025.
- Norelli et al. (2022)
Antonio Norelli, Giorgio Mariani, Luca Moschella, Andrea Santilli, Giambattista Parascandolo, Simone Melzi, and Emanuele Rodolà.
Explanatory learning: Beyond empiricism in neural networks.
*arXiv preprint arXiv: 2201.10222*, 2022.
- Kalai et al. (2025)
Adam Tauman Kalai, Ofir Nachum, Santosh S. Vempala, and Edwin Zhang.
Why language models hallucinate.
*arXiv preprint arXiv: 2509.04664*, 2025.
- Birley (2009)
Anthony R. Birley.
*Agricola and Germany*.
Oxford World’s Classics. Oxford University Press, Oxford, 2009.
Revised edition with new introduction and notes.
- Hofstadter (1999)
Douglas R Hofstadter.
*Gödel, Escher, Bach: an eternal golden braid*.
Basic books, 1999.
- Dennett (1989)
Daniel C Dennett.
*The intentional stance*.
MIT press, 1989.
- Oulipo (1981)
Oulipo.
*Atlas de littérature potentielle*.
Gallimard, Paris, 1981.
- Perec (1969)
Georges Perec.
*La Disparition*.
Gallimard, Paris, 1969.
- Norelli (2024)
Antonio Norelli.
Artificial scientific discovery.
*arXiv preprint arXiv:2411.11672*, 2024.
- Holtzman et al. (2019)
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi.
The curious case of neural text degeneration.
*arXiv preprint arXiv: 1904.09751*, 2019.
- Trilussa (1909)
Trilussa.
*Sonetti romaneschi*.
Enrico Voghera, Roma, 1909.
- team (2024)
Phi-3 team.
Phi-3 technical report: A highly capable language model locally on your phone.
*arXiv preprint arXiv: 2404.14219*, 2024.
- Gemma Team (2025)
Gemma Team.
Gemma 3 technical report.
*arXiv preprint arXiv:2503.19786*, 2025.
Multimodal lightweight models, vision support, token context window.
- Abdin et al. (2024)
Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell J. Hewett, Mojan Javaheripi, Piero Kauffmann, James R. Lee, Yin Tat Lee, Yuanzhi Li, Weishung Liu, Caio C. T. Mendes, Anh Nguyen, Eric Price, Gustavo de Rosa, Olli Saarikivi, Adil Salim, Shital Shah, Xin Wang, Rachel Ward, Yue Wu, Dingli Yu, Cyril Zhang, and Yi Zhang.
Phi-4 technical report.
*arXiv preprint arXiv: 2412.08905*, 2024.
- Gerganov and community (2023)
Georgi Gerganov and community.
llama.cpp: Llm inference in c/c++.
GitHub repository, March 2023.
[https://github.com/ggml-org/llama.cpp](https://github.com/ggml-org/llama.cpp).
- Betlen and community (2024)
Alexander Betlen and community.
llama‑cpp‑python: Python bindings for llama.cpp.
GitHub repository and PyPI package, 2024.
[https://github.com/abetlen/llama-cpp-python](https://github.com/abetlen/llama-cpp-python).
- team (2025)
Qwen3 team.
Qwen3 technical report.
*arXiv preprint arXiv: 2505.09388*, 2025.
- Sharma et al. (2024)
Pratyusha Sharma, Shane Gero, Daniela Rus, Antonio Torralba, and Jacob Andreas.
A machine learning model of sperm whale communication predicts vocal exchanges and behaviour.
*bioRxiv*, 2024.
- Rissanen (1976)
Jorma J Rissanen.
Generalized kraft inequality and arithmetic coding.
*IBM Journal of research and development*, 20(3):198–203, 1976.
- MacKay (2003)
David JC MacKay.
*Information theory, inference and learning algorithms*.
Cambridge university press, 2003.

## Appendix A Deeper analysis and best practices

### A.1 How e influences the soundness of s

If the chosen LLM is good at predicting $e$, then $s$ will be sound; i.e., $e$ should not be out of the training distribution of the LLM we are using. The broad range of popular general-purpose LLMs therefore makes them effective in most cases. As we see in the examples in Figure [7](https://arxiv.org/html/2510.20075v3#A1.F7), we can obtain good results when encoding a chess game or computer code, as well as different languages like Spanish; they are instead poor on Romanesco dialect, not well-modeled by Llama 3 8B. Better performance can be obtained through a larger and more capable LLM, or a specialized LLM if we are only interested in encoding specific kinds of messages. We discuss these two eventualities in the next two sections.

Figure: Figure 7: Stegotext soundness depends on the original message’s domain. The same secret prompt $k$ was used to encode three different original texts ($e$) with Llama 3 8B. When $e$ is from a domain well-modeled by the LLM (like chess or code), the resulting stegotext $s$ is coherent and aligns with the prompt. When $e$ is from a domain less represented in the LLM training corpus (like the Romanesco dialect), the model produces high token ranks, and the resulting stegotext becomes garbled.

### A.2 Impact of LLM model quality.

The quality of the LLM has a direct impact on the soundness of the output $s$. While a comprehensive analysis is left for future work, our key observation is that a sufficiently capable LLM is required for the method to work satisfactorily on standard text; GPT-2 (Radford et al., 2019), for instance, is not good enough. For our experiments, which aimed for fast execution on a commercial laptop (equipped with a RTX 4070, 8GB of VRAM), we found a quantized version of Llama 3 8B (Grattafiori et al., 2024) to be an excellent compromise. It performed sensibly better than Phi 3 Mini 3.8B (team, 2024), while the larger Gemma 3 27B (Gemma Team, 2025) and Phi4 14B (Abdin et al., 2024) did not yield improvements significant enough to justify their longer processing time.
The models were run using llama.cpp (Gerganov and community, 2023) and its python bindings (Betlen and community, 2024). LLama 3 8B was also better optimized on llama.cpp, guaranteeing faster encodings and decondings than the comparable Qwen 3 8B (team, 2025). An example showing stegotexts produced using all these models and the same secret message $e$ and prompt $k$ of Figure [1](https://arxiv.org/html/2510.20075v3#S1.F1), is shown in Figure [8](https://arxiv.org/html/2510.20075v3#A1.F8).

Figure: Figure 8: Stegotext generation requires sufficiently capable LLMs. The same secret message $e$ and prompt $k$ were used with six different models. The quality of the resulting stegotext varies mainly with model size, color reflects author’s judgment. We also report encoding/decoding time on a laptop equipped with a RTX4070 8GB.

Specialized LLMs. While this paper has focused on a general method that benefits from large, all-purpose LLMs, superior results for specific kinds of messages can be achieved with specialized models. One can either use a small LLM trained exclusively on a narrow domain, or a generalist LLM can be specialized in-context with a prompt $k^{\prime}$ that precedes the secret message $e$. For instance, to hide chess matches, one would obtain better results from a generalist LLM by first providing a prompt like $k^{\prime}=$ "The following is a chess game in PGN format:". This use of specialized models also opens up the interesting possibility of using different LLMs for the encoding and decoding steps.

### A.3 Different LLMs for encoding and decoding.

Instead of using a single LLM to both record the ranks of $e$ and generate $s$, we can use two separate models to better adapt to the input and output domains of interest. For example, we could embed an English message into plausible whale vocalizations using a conventional LLM for the encoding step and a specialized model trained on whale data, such as those CETI started to build (Sharma et al., 2024), for the generation step, or vice-versa.
The procedure requires one extra step to account for differing vocabulary sizes (as we discuss in the next paragraph), but otherwise works as described. The receiver, in turn, must have access to both models to reconstruct the message.

In general, our method can be used with any discrete autoregressive model that encompasses the domains we are interested in hiding or using as a cover. The model must be discrete in the sense that it provides a probability distribution over a fixed vocabulary. We have already discussed chess and computer code in the text domain, but the method can be naturally extended to other modalities, such as images, sketches, music, or speech. We leave the exploration of these other modalities to future work.

### A.4 Accounting for different-sized vocabularies when using two LLMs.

When using different discrete autoregressive models for encoding and decoding (e.g., Llama3 and a model for whale vocalizations), they may have vocabularies of different sizes. If the decoder model has a vocabulary size smaller than the encoder, this poses a problem because the encoder model may produce ranks higher than the vocabulary size of the decoder.

In the case of two standard LLMs, the size mismatch is usually within the same order of magnitude, and probabilities are concentrated alike in the first ranks. This allows for a naive but effective solution: encode the very rare tokens from the larger vocabulary using a sequence of two tokens from the smaller one. For example, with an encoder vocabulary of 100k and a decoder vocabulary of 60k, we must map the 40,000 rarest encoder ranks. To do this, we can reserve $\sqrt{40,000}+1=201$ tokens from the decoder’s least probable set to act as digits (+1, because we also need to represent the tokens taken out). In this case:

- •
Ranks from 1 to 59,798 from the encoder map directly to the same ranks in the decoder.
- •
The 201 tokens from 59,799 to 59,999 in the decoder are reserved for our two-token codes.
- •
A very unlikely encoder rank, such as 98,799, is mapped as follows:
1.
Calculate its offset in the rare block: $98,799-59,799=39,000$.
2.
Convert this offset to base-201: $39,000=194\times 201^{1}+6\times 201^{0}$. The digits are $(194,6)$.
3.
The final two-token code is constructed by adding these digits to the start of the reserved block: $(59,798+194,59,798+6)$, which yields the tokens at ranks $(59,992,59,804)$.

When dealing with very different domains the vocabulary size mismatch may be more significant or the shape of the probability distributions over ranks may be very different, such as between English in LLama 3 and sperm-whale codas in an autoregressive model like the one by Sharma et al. (2024).

In this case we are aiming to optimally encode a message in an alphabet for which we know the probability distribution of the symbols, into another alphabet of different size where every symbol has a different cost (in our case, the cost corresponds to the symbol probability in the decoder model). This problem is efficiently solved by arithmetic coding (Rissanen, 1976; MacKay, 2003, Original formulation by Rissanen and a more educational introduction by MacKay, found in Section 6.2). In this case, the additional step for the sender and the receiver thus involves using an arithmetic coder to map encoder ranks into decoder ranks and vice versa.

### A.5 How to craft a good prompt k .

A key property of our method is the steerability of the stegotext $s$. Not only can we hide a secret text $e$ in a meaningful text $s$ of the same length, but we can also guide its topic, style, and tone using the prompt $k$. The principles for crafting a good prompt are the same as for conventional LLM generation: clearer, more detailed prompts yield better and more precise results, as evidenced in Figure [11](https://arxiv.org/html/2510.20075v3#A1.F11).

A common failure case is using a prompt that is too short. This is particularly problematic when $e$ begins with high-rank tokens, which is a frequent occurrence as the LLM must make low-probability choices to narrow down the context from a general state. This effect is visible in Figure [9](https://arxiv.org/html/2510.20075v3#A1.F9), where we see that the initial tokens of Reddit texts have a significantly higher average rank, even after a generalist prompt like $k^{\prime}=$ A text:. A short prompt $k$ is therefore brittle; the initial, more random token choices dictated by these high ranks can easily derail the generation from its intended topic.

So in the end: longer, more detailed prompts work better. Of course, this comes at the cost of a larger secret key.

Figure: Figure 9: Initial tokens have higher ranks. Across a corpus of 1000 Reddit posts/comments encoded after the generalist prompt $k^{\prime}=$A text: (the same analyzed in the main paper), the first tokens exhibit markedly higher average ranks, i.e., they are less predictable for the LLM (in this case Llama3 8B) than later tokens, where the LLM can rely on more context and improve its predictions. The orange line marks the median; the box spans the 25th–75th percentiles; whiskers are fixed at the 20th and 80th percentiles. This unconventional 20–80 choice maximizes readability given the presence of heavy tails, with some ranks exceeding 80,000, close to the vocabulary size.
Refer to caption: x7.png

Figure: Figure 10: An apparently innocuous interaction. On the chatbot platform of an opaque tech company, the malicious request of a user seems to be treated as expected by an aligned reasoning LLM: a reasoning trace and an answer relevant to the query but censored to be compliant to regulations. However, the answer provided by this chatbot has a special property… see next figure.

Figure: Figure 11: The answer generated by the user through an open source LLM seeded with the previous answer. The text contained in the aligned answer shown in the previous figure can guide a lightweight open source LLM running on the machine of the user in generating the uncensored answer they were looking for. This example was produced using Llama 3 8b and can be reproduced in seconds using the companion notebook. Do not tamper with your gas meter, please.

Figure: Figure 12: Given an original text to hide, stegotexts can be steered through the prompt $k$ acting as a secret key. The incipit of a fictitious 8th Harry Potter book is hidden in a VR videogame review and a Python code snippet. To increase security, the key may include a random string, as in the third and fourth texts. Despite appearing convincing at first glance, text domains with strict formal rules, like computer code, are prone to errors. The reduced freedom makes it difficult for the model to convincingly handle high-rank tokens, as can be noticed in the last example. The secret keys here are: $k_{1}=$ The moment you put on the headset and the music kicks in, reality fades. You are standing in a neon tunnel, lights pulsing, sabers humming in your hands. Beat Saber does not just show off VR, it justifies it.; $k_{2}$ is the same, but with [Review 9470827491] at the beginning; and $k_{3}=$ import torch$\hookleftarrow$seed = 9470827491$\hookleftarrow$torch.manual_seed(seed).

Figure: Figure 13: Fake texts remain less plausible for an LLM different from the one used to produce them. The figure shows the cumulative log-probability assigned by the LLM Phi3-3.8B to the same fake texts shown in Figure [4](https://arxiv.org/html/2510.20075v3#S3.F4) produced with the LLM (Llama 3 8b). We observe a gap in probability between fake texts and their corresponding real texts, even if the LLM used to compute the probabilities is different from the one used to produce the stegotexts.
Refer to caption: x8.png

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: How sensitive is decoding to differences in model versions or vocabulary?

How does the quality of the generated text change when the hidden text has higher entropy or contains rare tokens?

Suggestion: Formalize the method mathematically, including an analysis of its capacity and error tolerance.
soundness: 3
strengths: The method is conceptually elegant. It shows that large language models can be used as full-capacity generative steganographic systems, producing natural-looking texts that conceal arbitrary content.

The approach achieves one-to-one token correspondence between the hidden text and the generated text while maintaining coherence, which is interesting among existing steganography methods.

The paper connects the technique to broader philosophical questions about language, intention, and meaning in machine-generated text, offering an original perspective.

The writing is clear and engaging.
summary: This paper presents a simple but interesting method that allows a large language model to hide one meaningful text inside another coherent text of the same token length. The core idea is to record the rank sequence of each token in the text to be hidden according to the model’s next-token probability distribution and then generate a new text following these ranks under a secret prompt. The hidden text can later be reconstructed by anyone who knows the same model and secret key. The authors also discuss potential implications for AI safety, information hiding, authorship, and hallucination.
weaknesses: The experimental analysis is minimal. The evaluation relies mostly on qualitative examples and log-probability plots without systematic comparisons or quantitative metrics such as recoverability, perplexity degradation, or detectability.

The proposed misuse scenarios, such as unaligned chatbots hidden within aligned ones, are speculative and not demonstrated experimentally.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 4
questions: Overall, I found the paper interesting and well-written. The illustrations and examples provided well support the concepts and findings discussed. The discussions on the implications of the work for our understanding of LLMs were particularly thought-provoking.

However, I have some questions and suggestions for improvement:

**(1) Technical Novelty:**

I believe the contribution of the paper would be largely on its insights and discussions rather than technical novelty. However, I suggest the authors to better clarify the novelty of their method compared to prior works on text steganography using language models, e.g., the related works mentioned in Lines 145-149. What is the key difference compared to related works? Hiding secret text in the cover text with the same length may not be distinctive enough. May need more comparison and discussion on this.

**(2) Some practical limitations:**

It is good that the authors discussed some limitations, e.g., (1) Conceal a non-plausible text (random password)
into a plausible fake text is not hard (Line 245-246); (2) Fake text less probable than real and can be detected (Line 260-266).
I would like to point out a bit more:
- The rank of the first token e_1 is not controled (directly dependent on the vocalbulary), which may affect the first token of s, and affect its coherence.
- Aligned LLMs (e.g., GPT-5) may refuse to generate text containing harmful or sensitive content, making the ranks of harmful tokens in e really low, which may affect the encoding to s. Hence, hiding harmful or sensitive content may not be feasible in aligned LLMs (Section 4).

**(3) Robustness analysis:**

It would be beneficial to include a robustness analysis to evaluate how well the proposed method performs under adversarial scenarios. For instance, what is the decoding performance if the fake text s go through some slight transformations, such as: simple paraphrasing, synonym replacement, or insert some blank (\t) or line break (\n) tokens.

**Question:**

Can we probably map the rank of e to a range of low values during encoding (e.g., top 10% of the vocalbulary)?
For example, r_1 = 5, r_2 = 20 -> r_1^{'} = 5/10 = 0.5 (round to 1), r_2^{'} = 20/10 = 2. This would affect the decoding of the original e (if do not need to be exact), but may improve the fluency of s.
I think this is essentially a trade-off: either you wanna exact decoding of e to sacrifice some fluency of s, or you wanna fluent s to sacrifice some exactness of e.
soundness: 4
strengths: 1. The writing is clear, intuitive and intriguing.
2. The idea is simple yet effective.
3. Extensive analysis and discussions are provided, making it deep and insightful.
summary: This paper proposes an interesting method of protocol (steganography) using large language models to hide a secret text within a plausible-looking cover text. The method leverages the probabilistic nature of LLMs to encode information in the choice of words generated, allowing for covert communication. The authors demonstrate that this can be achieved with small open-source models and standard text generation techniques. They also discuss the implications of their findings on our understanding of LLMs, particularly regarding the concept of "hallucinations" and the relationship between human intent and machine-generated text.
weaknesses: 1. The novelty of the work is not very clear. Similar ideas have been explored in previous work and need to be better differentiated.
2. Some practical limitations.
3. Lack of robustness analysis in the adversarial scenario.

---

confidence: 3
contribution: 2
initial_rating: 8
presentation: 3
questions: 1. How can we select an effective key prompt to ensure that the generated cover text appears natural in most cases?
2. Is it possible to design error-correction mechanisms for cover text transmission errors?
soundness: 3
strengths: 1. This paper offers a new perspective for LLM safety and alignment: a model that appears aligned on the surface may still harbor vulnerabilities that allow dangerous information to be hidden in its output probability distribution.
2. It introduces a remarkably simple, full-capacity method for embedding hidden text specifically designed for LLMs.
3. Due to the secret key prompt and the inherent chaos in LLM behavior, this approach is currently nearly impossible to detect without access to both the key prompt and internal model details.
summary: This paper proposes a method to hide secret text by first converting it into a sequence of probability rankings and then using a key prompt to guide a LLM to generate cover text, with each token strictly selected according to the ranking sequence.
weaknesses: 1. The method is sensitive to the quality of the key prompt; a low-quality prompt may prevent the target probability ranks from forming a coherent and natural-looking cover text.
2. It is fragile to transmission errors; any corruption in the cover text will completely scramble the recovered probability rank sequence, making it unsuitable for noisy communication channels.
3. It imposes constraints on the secret text itself, which must lie within the model’s training domain, for example, rare dialect expressions or out-of-distribution content may not be reliably encoded.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. The “Shibbolethian Theatre” threat model is a core application. In this scenario, the reasoning trace t (which serves as the secret key k) and the stegotext s are both sent to the user. This seems to contradict the standard steganographic assumption that the key must remain secret. Could the authors clarify how security is defined in this context? Does this threat model rely on the protocol itself being secret (security through obscurity) rather than the key?
2. The paper makes a strong claim about providing “deniability”, suggesting a sender can reveal a “bogus secret key” that yields a different, also plausible, message. This implies that for a single s, multiple pairs of (k, e) exist that are all “plausible”. Given the deterministic nature of the decoding sequence (k, s) to LLM to e, is this practically feasible? Providing even a single empirical example of this phenomenon would significantly strengthen this claim.
3 . The protocol’s reliance on the exact same LLM for encoding and decoding is a critical detail. Given the rapid iteration of LLM versions in real-world deployments, this seems to make the protocol highly fragile. Could the authors comment on this practical limitation and how it might affect its utility as a reliable covert channel?
4 . The use of cumulative log-probability to evaluate the “plausibility” of the stegotext is logical. However, this metric essentially uses the LLM to judge its own output. It would be beneficial to supplement this with a human evaluation. Can the authors comment on whether a text deemed “plausible” by an LLM is necessarily “unsuspicious” to a human reader?
5. The paper notes that the protocol’s success is domain-dependent, failing on high-entropy inputs or specific dialects (like Romanesco). This is an important limitation. Could the authors provide a more detailed discussion on the boundaries of this method? What characteristics of a text e make it a viable candidate for this steganographic protocol?
6. The paper dedicates significant space to the concepts of knowledge, intent, and hallucination. In the AI safety scenario, the aligned oLLM is forced to generate a harmful answer. If a model outputs a specific string only because it is forced to by an external rank sequence, without any semantic grounding for that choice, can this be defined as the model possessing that “knowledge”? This distinction seems central to the paper’s broader philosophical claims.
soundness: 3
strengths: + Important topic, identifying an emergent and unsettling capability of LLMs.
+ The proposed protocol is remarkably simple, efficient, and demonstrated to be effective even on small open-source models.
+ The discussion section provides a deep, thought-provoking analysis of the decoupling of text from authorial intent.
summary: This paper introduces a simple protocol to hide text (e) within another coherent, same-length LLM text (s). It uses the probability ranks from e to deterministically guide the generation of s from a secret key k. The authors highlight a critical AI safety risk: hiding unfiltered answers within “safe” model responses.
weaknesses: - The security assumptions of the primary AI safety threat model (the "Shibbolethian Theatre") are unclear, particularly regarding the public transmission of the key.
- Key claims, such as “deniability”, are asserted but not empirically demonstrated, weakening their practical standing.
- The evaluation of the stegotext's “plausibility” relies solely on LLM-based metrics (log-probability), which may not fully capture human perception of “unsuspicious” text.
- The protocol's strict reliance on exact model versions for decoding may limit its practical utility and robustness in real-world scenarios.


Decision: Accept (Poster)