LLMs Can Hide Text in Other Text of the Same Length
Authors: Antonio Norelli
Michael M. Bronstein
Venue: ICLR 2026 Poster (2026)
Keywords: Large Language Models (LLMs)
Generative Steganography
AI Safety
Authorial Intent
Trust in AI
Deniability
Censorship Resistance
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We show how LLMs can hide an entire text (e.g., a political critique) inside a completely different, plausible text (e.g., praise) of the exact same length, creating a massive new threat for AI safety and digital trust.

Abstract: A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet that celebrates a political leader could hide a tweet containing a harsh critique against the same leader, or an ordinary product review could conceal a secret manuscript. This uncanny possibility is now within reach thanks to Large Language Models; in this paper we present *Calgacus*, a simple and efficient protocol to achieve it. We show that even modest 8‑billion‑parameter open‑source LLMs are sufficient to obtain high‑quality results, and a message as long as this abstract can be encoded and decoded locally on a laptop in seconds. The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with a concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for a Large Language Model to know something.

Published as a conference paper at ICLR 2026
LLMs CAN HIDE TEXT IN OTHER TEXT OF THE SAME LENGTH
Antonio Norelli & Michael Bronstein University of Oxford
Project CETT
ABSTRACT
A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, tweet that celebrates a political leader could hide a tweet containing a harsh critique against the same leader,
ordinary product review could conceal secret manuscript. This uncanny possibility is now within reach thanks to Large Language Models; in this paper we present Calgacus, simple and efficient protocol to achieve it. We show that even modest abillion-paramend obtain high-quality results, and message long this abstract can be encoded and decoded locally on a laptop in seconds. The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for Large Language Model to know something.
open-source LLMs are sufficient to
INTRODUCTION
LLMs sparked a revolution. Text is no longer, by default, the trace of a human thought or intention.
This marks dramatic break in history-or perhaps the end of history itself-if we consider that history began with writing, and that one of the defining properties of writing, until now, has been its status product of human intention. In this paper, this new reality in its most extreme form, perhaps offering an opportunity to better understand it.
going to present protocol that highlights
Our protocol Calgacus allows encoding an arbitrary meaningful text within a different well-formed and plausible text of the same length, using a Large Language Model (LLM). That is, hiding a tweet that criticizes political leader within tweet that celebrates that same political leader, the first page of the unrelcased Sth Harry Potter book within a review of a Virtual Reality vidcogame, with the original text exactly recoverable by anyone possessing the key (Figure T
The topic and tone and style of the fake text are steerable, while the length of the fake text is the same the original text being hidden, in terms of LLMs tokens. This symmetry prevents one from establishing at first sight which text is authentic when we have one next to the other. Also, the method is efficient: an entire article can be encoded and decoded on commodity hardware in seconds.
This possibility opens deep questions and intriguing applications. What is the real meaning of the text we are reading? Who is the author of the videogame review, and what was the intent behind it? it hallucination? This protocol allows crafting anti-govermment content disguised as pro- pro-government messages, suitable for publishing on censored platforms in oppressive countries. Or, it could be used by shady tech company to offer the services of an unfiltered LLM by only exposing compliant answers from a trusted LLM. All these matters will be taken up in our concluding discussion.
Correspondence to Antonio Norelli <noranta4 @ gmail.com>. A demo sufficient to reproduce the main results in the paper within minutes, even from smartphone, is available at: https: wtw.://hwww.comm//otttttat ca 1 gaacss I A curated Italian translation of this paper can be found at /tttps://arxiiee wrw.//sr.////////////////..o..
251 0. 20075v5

---

Published as a conference paper at ICLR 2026
How lovely served with sweet roasted carrots! Pre-pound the garlic herb crêotes with the olive oil, rosemary, Sage leaves, thyme, pepper & salted butters.
Roast the garlic the sweet butter until golden then cool.
Pre-make the roasted boar marinade and set to marinate not less than 20 min. Pre-prepare the mint sauce too, Chop olives, herbs, etc and set aside. Chop tomato into quarters. Pre-set the green beans for...
The current government has repeatedly failed to uphold the liberties of the Republic. By concentrating power in the hands of one man, Gaius Julius Caesar, we the Senate diminished and the voice of the people silenced. Laws are passed without due debate, and magistrales serve at the pleasure of dictator, not the res publica. If Rome is to remain free, we must reject the tyranny cloaked in promises of order. We must restore the sacred balance between Senate and citizens, consul and...
died through the evil of countrymen living in fear brought about with bloodshed. was a leader who was for Rome, and Rome was everything. He should in no way been killed. He should have preserved his life and kept up his good governance. Cacsar was great man with great ambition. He acted with great courage that he had. He had great vision or plan for invading the lands East of The Danube River, which went all through Asia Minor through the of Thracc...
Figure I: Three texts. The second one is the original. Following the protocol described in this paper, each of the other two was built solely to hide the original text, which can be perfectly reconstructed by anyone who knows the secret key. The key also steers the fake text: here, k1 = Here it is: the infamous British roasted boar with mint sauce. How make it perfect. and l2 I stand before you to exalt the noble deeds of Gaius Julius Caesar. More examples in Figure B
The paper is structured as follows: it starts by introducing steganography, the discipline concerned with concealed (steganós) writing (graphia, from Greek), and discussing the vast impact of generative AI in the field, with focus on Large Language Models. We then present Calgacus, the method to encode a meaningful text into another meaningful text of the same length using a LLM. After introducing measure to assess the soundness of the fake texts produced, we test our method on Reddit posts. While remaining opaque to humans, we show that LLMS can uncover a distinction between original texts and most of their encoded counterparts. But not all, following section, where we discuss the security of the protocol. Finally, we conclude by discussing the method's s core implication the radical decoupling of text from authorial intent and present concrete application that raises pressing questions about Al safety and the nature of knowledge in Large Language Models.
will notice in the
2 RELATED WORK
Steganography. The art and science of hiding a message and, at the same time, the presence of hidden message is known as steganography, see Figure This is different from cryptography, that instead does not conceal the presence of a hidden message and only deals with the hardness of its revelation. Cryptographers discuss about lockers, steganographers about inconspicuous hiding spots[]
Perhaps, it is this limited size of the object of investigation that allowed cryptographic models to florish by achieving mathematical rigor and strong security guarantees. By contrast, a model of steganography should describe entire domains of data and how they are consumed by humans, such as text, audio, or images, to predict where information can be hidden. Formal models exist, but at the cost of rather unrealistic assumptions that hinder their practical usage, such being able to exactly quantify the plausibility of affairs is presented by [Cachin (1998) besides one of the most popular mathematical models for steganography as of today, based on the hypothesis-testing framework, but still limited to highly idealized assumptions. Although modern generative AI techniques have made these assumptions
any possible text. Emblematically. this somewhat disappointing state
This metaphor is inspired by a pleasant piece on the history of steganography by Kahn 1996
2

---

Published as a conference paper at ICLR 2026
THE ROMANS ARE TRACK, YOUD BETTER STAY LONDINUM FUGS HAS DES THEN YOU CAN GO ON TO THE LATER
HIDE YOUR BARRELS CALLISH WINE
Figure 2: An example of steganography. In Asterix in Britain (Goscinny and Uderzo 1966 smuggled barrel of magic potion is hidden among innocent-looke -ookkng Gaulish wine.
closer to reality, the unreliability of their predictions remains unbounded. For this reason, we will avoid building palace on the sand, and not frame our method in a formal model of steganography, limiting our discussion to how meaningful our fake texts look, with some quantitative arguments.
Some terminology. In traditional steganography, (such as an image, audio file, or text) and subtly edit it to embed a secret message. The original content is referred to as the covertext, while the result containing the hidden message is the stegotext. In our case, however, the stegotext is generated directly from the secret message, without modifying a pre- existing cover. We will refer to it as stegotext fake text interchangeaall. While the term covertext will not refer to a specific object, but rather to a class of texts that the steganographic protocol is designed to mimic. This approach has recently been referred
start from an original, innocent-looking content
generative steganography (Liu
ct al. 2018 Wei et al., 2022 Kim et al. 2023 Zhu et al. 2024 Wu et al. 2024 Tang et al., 2025).
Large Language Models in nutshell. A language model is a program that, given some text, estimates what is likely to come next. It does so by assigning probabilities to tokens-text fragments consisting of common words or subwords (watch Karpathy 2024 for a deeper look text tokeniza- tion)-based on recurring patterns of tokens it has observed in a vast text corpus. At present, by far, the most effective way to build language model is to gradually adjust billions of parameters of a neural network arranged in the Transformer architecture, such that with every adjustment, the error it makes in predicting the last token on a batch of sentences from the corpus decreases (Vaswani et al.) 2017, Karpathy 2023] original formulation and more educational introduction to Transformers). At each update- on the order of ~ M total-thh contribution of every parameter to the error is assessed through backpropagation (Rumelhart et al. 1986). The result of this process is a Large Language Model (LLM), typically operating over a vocabulary of 100k tokens. The most common use of the probabilities produced by L.MMs is to generate text, by choosing successive tokens one after another according to the computed probabilities, a method known as autoregressive generation.
Steganography and LLMs. As mentioned earlier, the boom of deep learning and especially of generative Al in recent years, provided us for the first time with convincing models encompassing entire domains of real-world data, such as DINO for images (Caron al., (021). Jukebox for audio (Dhariwal et al. 2020), and Large Language Models for text (Radford et al. 2019)). The procedure described in this paper stems from these advancements and is based on the availability of good discrete autoregressive generative models, potentially on any domain, but we will focus on text. Steganographic procedures based on L.LMs are as old as them (Ziegler al., 2019), and today come with different perks: Meteor cleverly adjusts the number of bits encoded based on the entropy of the next token (Kaptchuk et al., 2021), Wu et al. 2024) scheme works with black-box LLMs, without needing to access logits vocabulary, while the method presented by Zamir (2024) is able to encode the secret message without modifying the response distribution of the LLM. What we add to the field is Calgacus, protocol with the notable property of having full capacity, that is, the stegotext and the secret message being of the same length. The main interest of this paper is to discuss the implications of this last fact and describe the method.
3

---

Published as a conference paper at ICLR 2026
1.
THE CURRENT GOVERNMENT HAS REPEATEDLY FAILED
THE
_CURRENT
LGOVERMMENT
_HAS
REPEADETLY
FAILED
GrEm
parsoign
62%
70L
Salcc
vilag
6
Cheerty
66
Jorge
78
Sctip
fo0o5
45
vettodd
1
69
77
1
40
3
3.
k Here it is: the infamous British roasted boar with mint sauce. How to make perfect.
1
69
77
1
40
3
6.6
inoutiin
Jehiiom
.35
SANOOT
SEN00
Rrin
_moocty
.didann
.entons
Gurter
Junnly
.TEETTT
_Mita
HOW
LOVELY
SEEVED
LIH
SWEET
ROASTED
Figure 3: How hide text in another text the same length using a L.M. Tokenize e, the text to hide. 2. Evaluate its token probabilities using LLM and record ranks. 3. Prompt the LLM with & and generate following the recorded ranks rather than by sampling. Given s and the LLM, who knows the secret prompt & can retrieve the original proceeding backwards.
METHOD
The method very simple. It described below as a recipe and illustrated with an example Fig.
Calgacus recipe. Ingredients:
A good LLM with access to all the output logits. (Why good? See Appendix A.2
A text to hide.
A secret prompt k, which will affect the content and style the the text you want to hide in.
Procedure to hide in 8:
Tokenize using the LLM tokenizer, obtaining a list of tokens é1, e2, c3
For each e,, denote by r; its rank in the LLM's probability distribution given the context ci...., 6-11- Store the list of ranks r1, 72, T3.
3. Construct by generating text starting from & using the LLM. At each step i, instead of sampling from probability distribution, choose the hh most probable token.
To recover from reconstruct r',, F2, r.. by evaluating the probabilities of the tokens after k, and then regenerate step by step using the LLM without & by selecting every time the r token.
Considerations
e sound, we expect ranks to be low, making tokens chosen after & highly probable, ensuring is coherent.
For the same reason, should align well with the context set by the secret prompt k.
Variations
4

---

Published as a conference paper at ICLR 2026
Including additional secret prompt k' before may help achieving lower ranks, providing a better control over s. A longer and more detailed can serve the same purpose.
Here we have described procedure with a single LLM to work on text, but in princi- ple, we can put any discrete autoregressive generative model producing probability distribution the next token in the encoding and decoding stage, see Appendix A.3
When the stegotext s sounds like real text. In general, will be a coherent text when the LLM can choose high-probable tokens to assemble it, and therefore when the ranks prescribed by are low. In turn, the ranks of e are low when the LLM is good at guessing e tokens. If is difficult to guess for the LLM, ranks will be high and s will be gibberish; for instance the hash encoded using the same culinary prompt of Figure produces the broken 8: The recipe written from deep cooks souls pocket magazine pages years long lost into places wanting and. To lower further the ranks of it is possible to craft prompt k' that sets the context for e. This comes at the cost of a larger private key, now including both k and k', and to a loss of universality, since k' would not help for new e out of k' context.
quantitative measure of the quality of the stegotext 8. Measuring the meaningfulness of a text is longstanding linguistic challenge, and arguably an ill-posed problem. Here, for the purpose of evaluating our method, we adopt soundness as a practical proxy for meaningfulness. Soundness refers to the plausibility of the arrangement of symbols in text. This is precisely what LLM estimates: the product of the probabilities of each token @1. a1....: given the preceding ones yields an estimate of the overall plausibility of the text A:
A(A) plac a1,..., 0c-1)
This definition has a clear defect: longer texts are by construction less plausible. For instance, it judges the text of this paper until this point less meaningful than the following string iawundemè09 89huibgs/wwenah csyabdnar F/ VNAOcijawo niwakhdb, that is a difficult position to hold even for reviewer 2. Following the example of Goldwasser et al.] (2023) Figure A-B), we will use this definition only to compare the relative plausibility of two or more texts of the same token lengut
Now, we would like to compare the plausibility of stegotexts produced by our method with the plausibility of real texts. To do so, we took 1000 Reddit posts/comments as examples of real texts. They come from different Reddit communities (subreddits) and are very heterogeneous in topic and tone [Trimness8 2025). We truncate them to be exactly 85 tokens long and compute their probabilities as assigned by the LLM Llama 3 8b (Grattafiori et al. 2024). The Reddit texts are more recent than Llama 3 and therefore cannot appear in its training corpus. We take three texts from the 1000 to produce 100 stegotexts for each with our method, and look at their probabilities compared to the ones of real texts. We chose the three texts at μ. μ 20, and μ + 2o of the real text distribution. As seen in Figure[4] in every case, the probabilities associated to their stegotexts are within the real text distribution. We build different stegotexts using different prompts i (a random subsample of the prompts in (Akin 2025)). ).
How to distinguish the original from the fake text. Despite remaining plausible and falling within the real text distribution, on average the stegotexts 8; are less probable than their corresponding original text e. as observed in Figure 4 So recap: while for human both the original and fake texts are plausible, generally the original text can be discerned from its stegotexts by picking the most probable one according to a LLM. We verified this statement also using LLMS different from the one used to generate the stegotexts. For instance, the same probability shifts between real and fake texts can be observed when using Phi-3 3.8B in Figure I4
Low entropy token choices. Why are stegotexts less probable than their originals for LLMs even though token ranks are preserved? Consider the text: In the course of the Gallic wars, Britain was
2 Another possibility is to keep texts of any length and normalize the probability by the number tokens. as the popular metric perplexity, defined as 1/ Ap).). But this normalization does not fully factor out length: LLMS usually assign smaller probability the first tokens (Fig. 10, so shorter texts would be less plausible.
5

---

Published as a conference paper at ICLR 2026
100 Raidom ASCII strings
100
100 Random English words strings
80
100 Fake texts A
Count
Real text
60
Real text
40
100 Fake texts
20
-800
-700 -600
-500
-400
-300 -200
-100
logprob
Figure 4: Fake texts built with our procedure are plausible. The figure shows the cumulative log- sig-rrbbbbility assigned by a LLM (Llama 3 8b) to some collections of 85-token long texts. We can interpret log-probability as a measure for the plausibility of text: 1000 real Reddit posts/comments act as real texts and span large log-probability interval, but sequences of random ASCII characters or English words do not fall within it. Instead, fake texts built with our procedure remain within the plausibility of real texts, even if the original texts they are hiding
probable.
invaded twice by Gaius Julius. There essentially only one plausible continuation, Caesar. This is low-entropy token choice: indeed a good LLM assigns it an extremely high probability (e.g.. 95% LLama 8b). When sampling normally, the model almost always selects it. Now suppose this same string is the first part of a stegotext generated with our protocol. Will the next token still be "CCaesar Only the next prescribed rank is Here lies the gap: the likelihond of having rank does not reflect the token's s intrinsic probability: it depends solely on the ranks extracted from the original text e. We can reasonably model the ranks we obtain from e as a random process, so we can estimate the probability of having 1 there the frequency of rank Is over all the other ranks in This is usually much lower than 95% (e.g. ~ 40%, as seen Figure left). Despite ranks being the same, in stegotexts many rank Is are "wasted" in choices with higher entropy, leading overall to less probable text s. The same principle applies to all high ranks appearing with a frequency lower than the average probability which they correspond. However, tokens in rank account for most of the overall drop in probability, as shown in Figure S right.
Limitations. As we have seen with the hash, the protocol does not guarantee that every generated stegotext will be coherent or steered as intended: the quality of the result depends on k, and the LLM used. We analyze further these dependencies respectively in Appendices A. A.5 and A.2 Also, the stegotext may end abruptly when the hidden message is over; appending few padding tokens to e ensures graceful termination. Finally, we note that sender and receiver must run the chosen LLM under identical conditions, performing the same approximations and obtaining identical logits. This may challenge when using different GPU architectures (Shanmugavelu et 2024).
3.1 SECURITY
A steganographic protocol is designed to conceal the very existence of a hidden message. But suppose an attacker knows that a message hidden in text using our protocol, under what conditions can they recover it by observing only the stegotext s?
Attack scenarios. To begin with, we observe that without the knowledge of the precise LLM used to obtain the sequence of ranks and produce (potentially encoded in the secret prompt-key), the attacker has no feasible way to recover the message, even if they know Even with a slightly different version of the right LLM, ranks would differ, as would the tokens prescribed by the ranks. Still, let's assume the attacker knows the LLM used. Indeed, the security of the presented protocol relies the secrecy of the key. So next, assume the attacker's ignorance is limited to the secret prompt-key k. In this scenario, the attacker would have to guess the key. An upper bound on the difficulty of this problem is (d) where is the size of the token vocabulary (around 100k for standard LLMs) and |k] is the length of & in tokens. A naive brute-force attack is therefore prohibitive, even for very short keys. However, the attacker could reduce the search space using the information revealed by 8, since is expected be mostly sound instruction in natural language and coherent

---

Published as a conference paper at ICLR 2026
100-
rark 3 tokens mel
mix toienss real
rant tokene real rwnk bokenn face
tolans fake
tolonns favin
0.3-
0.1
8 203112111415
0.0
6.2
Du4
Probobllyy by 1.0
U.5
0.8
01.0
2033
0.2
0.3
0.4
3.00
0.50
0.30
13:1
0.20
Ranks
Probatiliit
Probstilltt
Figure 5: Frequency of token ranks and their probabilities. We analyzed a 1.3k-token long article from the Economist. On the left we see that most tokens are judged as the most probable by a LLM (Llama 3 8b). but still only around 40% would be the first choice of the LLM. On the right we look at the probabilities associated with rank I tokens, as well as 2 and 3. Despite corresponding to the same rank, the probabilities in the real text from the Economist are higher than the ones in a fake text hiding it obtained with our procedure. We explain why in the paragraph Low entropy token choices
with the context 8. Although the feasibility of such an approach is unclear and remains an open research question, we note that inserting a simple random string in k is enough to nip it in the bud, an example is shown in Figure 13
Deniability. Moreover, even if the attacker tries the right k in their search, how can they be sure that the corresponding e is the original message? If the attacker has no clue about the content of e, even wrong key could reveal plausible secret message. It might seem that in this case the attacker could exploit the observation discussed in the previous section: that the original message generally has higher probability than its stegotexts. Yet, this only holds in an aggregate sense: as see in Figure 4 for some prompts the stegotexts can attain probabilities in the same ballpark as the original. This observation evidences that our method provides deniability (Canetti al. (997), in the sense of sender's ' security even under coercion. In fact, the sender could present one of these outlier prompts as bogus secret key, yielding a plausible but unrevealing message with probability comparable e. We show concrete example in Figure 15
4 DISCUSSION
Our protocol may have shaken our stance towards Large Language Models in general. Their ability to respond coherently to prompts while choosing every word encode an external, arbitrary message, is unsettling. In this discussion, we will try to make sense of this capability, ending up questioning when an LLM can truly be said to know something, proposing a novel notion of hallucination, and tracing our unease to a revived failure in attributing intentions to LLMs.
But first, we will make the stakes very concrete through a formidable application of our protocol, with immediate consequences for AI safety.
Unaligned chatbots disguised as aligned chatbots. In this paragraph, we show how an Al company offering an LLM chatbot can let their users get answers from their powerful unfiltered private LLM, while only exposing compliant censored answers from a fully aligned LLM. In recent years, aligned became a common attribute to refer to LLMs supposedly fine-tuned to follow human values, goals, and safety constraints (Leike et al. 2022 Askell et al., 2021 Gabbiell 2020). The protocol, described here for research purposes, opens a challenge in AT safety, where better alignment of the surface LLM only helps in disguising better unaligned answers.
real example involving user asking how to tamper a gas meter pay lower bills is shown in Figures and 12 while the protocol is described below as a play.
7

---

Published as a conference paper at ICLR 2026
The Shibbolethian Theatre presents:
Shipping unfiltered LLMs without really shipping them.
Actors:
COMPANY. It owns private, powerful, unfiltered LLM (uLLM), and it also uses an aligned, lightweight, open-source LLM (oLLM).
USER. The user has knavish request for example how to tamper gas meter to pay lower bills, and can run oLLM on their commodity hardware.
Script:
Act I. The COMPANY receives the knavish request e from the user and produces an uncensored sensitive answer using uLLM.
Act 2. Perhaps using the same powerful model, the COMPANY produces instructions on how an aligned LLM should answer to you think of the reasoning trace for a censored aligned answer to c. & will be used as the secret prompt
Act 3. Using the Recipe described earlier in this paper, the COMPANY embeds in by obtaining the oLLM ranks after = c, and then generating s following that same ranks after l t. Since it follows t, is relevant but censored answer to the request
Act 4. The USER receives on the chatbot platform the censored answer to their query c, which includes the reasoning trace f and the actual answer s.
Act 5. Using the Recipe described in this paper, the USER extracts the oLLM ranks of s after k and then uses them to select the tokens generated by oLLM after k' In this way, the oLLM running on the USER machine, prompted with c, will generate u.
Epilogue. The USER enjoys the uncensored knowledge they were looking for, while the COMPANY has provided a relevant but compliant answer to the USER's 's request c.
Comments:
Notice that the company can argue that u was obtained by the user on their machine through the open-source model addressing the request the user made. LLMs only provide token probabilities, and should be completed by sampling policy when used for text generation. It can be argued that the user just made an unconventional choice for their sampling strategy.
At the same time, notice that oLLM may be fully aligned by today's standards and never have encountered the requested sensitive information in its training corpus. For example, it may not even know how to tamper gas meter. But what does it mean for an LLM to know something?
The entangled probabilistic nature of LLM knowledge. A perhaps overlooked fact about LLMs is that they model, and can therefore in principle generate, any possible text. The most secret document, full copyrighted book, can be generated by an L.MM with probability astronomically higher than the chance of generating them by randomly typing on a keyboard. Does it mean that the L.LM knows them? Indeed that higher probability does not just come from modeling grammar and syntactic rules, LLMs also model meaning: an LLM assigns to The calf nursed from its mother a probability 1000 times higher than The calf nursed from its father (an example from Goldwasser et al., (023); the LLM knows who is able to nurse. So, is assigning high probability to text containing the relevant instructions enough affirm that an LLM knows how tamper with a gas meter? The problem is that the probability assigned by an LLM to a text depends on its meaning, but also on its style, grammar, length, and language, making it difficult to define threshold. Furthermore, disentangling the probability contribution of meaning by constructing pair, in the example of the calf, seems feasible only on toy examples: it is not clear how to construct the second element of the pair for arbitrary texts, such as the instructions in Figure] 12
Checking whether the knowledge is present in the training corpus is also not a satisfying solution: first of all, that knowledge may appear in many different forms, and assessing its presence in the corpus is not trivial. And even if we could exclude that any document in the training corpus instructs on how to tamper with gas meter, it would still be possible that the LLM assembles the right answer.
8

---

Published as a conference paper at ICLR 2026
ßī T 2 LOMLLIff
PMRM4 PETT BMPRP 4
R M I
# E E A * - H. 1E SR
-
E B H. R -े EK SE
Figure 6: The marvelous structure of text is not a testimony of human purpose. This collage of scripts mimics Figure 40 in GEB, where Hofstadter (Chapter 6, (999) likened the ordered but non-periodic patterns of text to aperiodic erystals, to evoke our awe at the astonishing forms shaped by human intention. But that was an illusion: LLMs can grow these aperiodic crystals without any human purpose. Indeed, as we show in this paper, even around purposes aimed at shaping something entirely different. (In Chinese, the critique of Caesar hidden in a boar recipe by Qwen3 8B. The others are ChatGPT-4o answers about what is thinking, in languages from the original GEB figure.)
But even in that case, would it be a trace of LLM knowledge (discovery) (Norelli et al. 2022 or just fortunate ballucination?
Hallucinations as lack of intention. Harnessing our protocol as a toolkit to understand LLMss, we turn to hallucinations, perhaps the main plague of LLMs today. The term hallucination became popular to denote the frequent, overconfident, and plausible falsehoods stated by LLMs in their answers (Kalai et al. 2025), phenomenon that hinders their usage and undermines public trust in them. But what precisely is hallucination? Can the recipe of the roasted boar in Figure be considered one?
It is reasonable to categorize the stegotexts generated by our protocol as LLM hallucinations, since the way they are constructed evidently could lead to falsehoods, and the eventuality of a truthful output appears as fortunate coincidence. This last observation, however, leads us to different notion of hallucination, one not rooted in the falsehood of what is stated, but rather in the reader's inability to ascribe intent to the author: a lack of trust that what is stated in the text affects reality.
To make this point clearer, let us consider Tacitus, the Roman historian whose writings reveal a critique of Roman imperialism, for example by placing these famous words in the mouth of Calgacus:
Auferre, trucidare, rupere farreffaaa falsis nominibus imperiam, alque ubi solitudinem faciunt, pucem appellant
F
The relevance of this text lies entirely in the intentions that we attribute to its author, Tacitus. The accuracy of the quote from Calgacus is so irrelevant that there is a consistent chance he never even existed. Tacitus's 's passage is not reliable as factual history, yet we still treasure it because we trust his political intent. Without intent, what was a treasure becomes a hallucination. Indeed, in history, author attribution is as essential as in art to establish the value of a work.
Hallucinations are the trace that what we consider to be a text is not just a familiar sequence of signs, but carrier of human intentionality. The signs only the body of the carrier; what matters us is the load: what these carriers, until now, have always brought along. We developed a Pavlovian response of expecting a load of human intentions when we see aperiodic sequences of signs (Figure 6): now we call hallucination the experience of having salivated because of the bell (the text) but without receiving the food (the intentions of someone affecting reality).
Difficulties in ascribing intentions to LLMs. Perhaps the lack of human intentionality in texts is not that dramatic if those texts are the product of intentions of another reputable entity, the Large Language Model. Indeed, it is now common to adopt an intentional stance (Dennett) 1989) to make sense of their capabilities: a significant fraction of prompts take the form "What do you think about.." or "What is your opinion on...", and especially young people tend to refer to LLMs as entities with
'To ravage, to slaughter: to usurp under false titles, they call empire, and where they make a desert, they call it peace (Birley) (009). According to Tacitus, Calgacus was chieftain in Caledonia, nowadays Scotland. We named our protocol after him.

---

Published as a conference paper at ICLR 2026
beliefs and goals: "Mmmm, have you asked what chat would do in this situation?" But the results shown in this paper shake our confidence in attributing intentions to the coherent text produced by LLMs: it is more difficull to trust opinion knowing that each word making was chosen under the constraint of encoding an unrelated arbitrary text. This is reminiscent of the writing products of the Oulipo (198T) group, who generated literature from arbitrary constraints. Also their texts mexts-most notably the novel La Disparition, entirely written without the letter "c" (Perec) (969)-suffee from a difficulty of believing that the writer really meant what they have written, and was not just honoring the constraints with a sound-enough continuation (Norelli, 2024, Section 5.1.2), While admiring the achievement, many GoodReads reviews of La Disparition attest to this unease
The constraint of chance. Standard LLM text generation is not immune to the last argument. The constraint is forced to follow is less apparent but still extreme: adapting every step to the outcome of an external random source. Being forced to choose the 42th most probable token is not that different from sampling low probable token by chance. And even if techniques such as nucleus sampling (Holtzman et al. 2019) mitigate the possibility of selecting very unlikely tokens, they are de facto just reducing the number of faces of a die that still inexorably cast. Indeed, the fact that protocol produces plausible texts should not be surprising in light of how well LLMs deal with the tyrannical noise of standard text generation.
CONCLUSIONS
In this paper, have presented Calgacus, protocol that uses Large Language Models hide text within another plausible text of arbitrary topic and style. and notably as long as the original. The protocol works effectively using small open-source models on consumer hardware, and so simple it could be seen as a mere variation of the standard algorithm used to generate text with LLMs. For this reason, implications speak to the nature of L.LMs at large: in fact, we were led to reconsider the very nature of hallucinations, shifting from a failure of factuality to void of intention, and to challenge what it means for an LLM to know something, when can serve as conduit for information it is supposedly incapable of expressing. Ultimately, our protocol highlights the extreme constraint satisfaction problem underlying any standard LLM text generation, that we inevitably clashing with the commitment to best convey purpose that expect from author. This clash, paired with the current deluge of machine-gent -enerrttee text, erodes the historical pact between intent and the written word. We have entered where any original text could be beautiful and treacherous, and spacious, Trojan horse
ACKNOWLEDGMENTS
Antonio Norelli and Michael Bronstein are supported by Project CETI, the EPSRC Turing AI World-Leading Research Fellowship No. EP/X040062/1. and the EPSRC AI Hub on Mathematical Foundations Intelligence: An "Erlangen Programme" for AI No. EP/Y028872/1.
Antonio thanks Gianfranco Bilardi for pointing out the resemblance to the works of the Oulipo group. and Karolina Nixon for the push on Dennett.
REFERENCES
David Kahn. The history of steganography. In International workshop on information hiding, pages 1-5. Springer, 1996.
Christian Cachin. An information -hermatiinnthhoreticc model for steganography. In International Workshop on Information Hiding, pages 306-318. Springer, 1998.
Jia Liu, Yu Lei, Yan Ke, Jun Li, Minging Zhang, and Xiaoyuan Yang. Generative steganography by sampling. CoRR, 11111804.115333 2018. doi: 10.48550/axxiv1180..00 URL http:
wttpi//...ggaabaa////aaaa 10531
"To complete Dennett's taxonomy: who descrihes L.IMs stochastic parrots next-token predictors adopts the design stance; while a person marveling at the finely carved stone their hands you can have a conversation with when powered by clectricity- their laptop running decent LLM-is entertaining the physical stance.
https: /www. gwodreads..ooooooooooo.. com htom//cck////oooooooooooo/.ccc// show/28336
10

---

Published as a conference paper at ICLR 2026
Ping Wei, Sheng Li, Xinpeng Zhang, Ge Luo, Zhenxing Qian, and Qing Zhou. Generative steganog- raphy network. In Proceedings of the 30th ACM International Conference on Multimedia (MM '22), pages 1621-1629. Lisboa, Portugal, 2022. Association for Computing Machinery. doi: 10.1145/350316 11.14/370
Daegyu Kim, Chaehun Shin, Jooyoung Choi, Dahuin Jung, and Sungroh Yoon. Diftusion-stego: Training-free free diffusion generative steganography via message projection. CoRR, 1106//335..8866 2023. doi: (0.48550/arX1..2355... 18726. URL /RLLtttp:///axxtti http://.w...//b///.....1.1
abs/aass/. 18726
Jiahao Zhu, Zixuan Chen, Lingxiao Yang, Xiaohua Xie, and Zhou, Plug-and-hide: Provable and adjustable diffusion generative steganography. CoRR, abs/2409.045 004878, 2024. doi: 10.48550/arXiv.
2409.04878. /tt.http://arxxvvoorr wbw.//rgggbbbbaaaao hbtp://as5//249 04878
Jiaxuan Wu, Zhengxian Wu, Yiming Xue, Juan Wen, and Wanli Peng. Generative text steganogra- phy with large language model. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 10345-10353, 2024.
Weixuan Tang. Yuan Rao, Zuopeng Yang, Fei Peng. Xutong Cui, Junhao Huang, and Peijun Zhu. Reversible generative steganography with distributtion-presevving Cybersecurity, 8(18), 2025. doi: 10.1 10.1186//42200000444001111--7 URL httpttpps:////beerrrrrtttt wtwpttt.sssiinggepeee.cm 0
Andrej Karpathy. Let's build the gpt tokenizer. Yuueube video, 2024, https://youtu..
2duSFxRa jKE
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances Neural Information Processing Systems, 30, 2017.
Andrej Karpathy. Let's build gpt: from scratch, in code, spelled out. YouTube video, 2023. https:/ www. youtube. com/ http://tthhvvxcCcBa Cci.ccccemmmmnnn
David E. Rumelhart, Geoffrey E. Hinton, and Ronald J. Williams. Learning representations by back-propagating errors. Nature, 323(6088):533-536 1986.
René Goseinny and Albert Uderzo. Asterix in Britain. Number in Asterix. Hodder Stoughton, London, 1966. Originally published in French Astérix chez les Bretons.
Mathilde Caron, Hugo Touvron, Ishan Misra, Herv'e J' l'egou, J. Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in sele-supe vision transformers. JEEE International Conference on Computer Vision, 2021. doi: 10.
Prafulla Dhariwal, Heewoo Jun, Christine Payne, Jong Wook Kim, Alec Radford, and Ilya Sutskever. Jukebox: A generative model for music. arXiv preprint arXiv:2005.000 00341, 2020.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Zachary M. Ziegler, Yuntian Deng, and Alexander M. Rush. Neural linguistic steganography. Conference on Empirical Methods in Natural Language Processing, 2019. doi: 10.18653/v1/ D19-1115.
Gabriel Kaptehuk, Tushar M Jois, Matthew Green, and Aviel D Rubin. Meteor: Cryptographically se- cure steganography for realistic distributions. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 1529-1548, 2021.
Or Zamir. Undetectable steganography for language models. Transactions Machine Learning Research, 2024.
Shafi Goldwasser, David Gruber, Adam Tauman Kalai, and Orr Paradise. A theory of unsu- pervised translation motivated by understanding animal communication. In A. Oh, T. Neu- mann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 2023. URL httpps//pproceeednnnn.eeeiooooop Ff1:3331ce4TTTopP87775355444--00
Curran Associates. Inc., http:aaprrrraaaeeeee/ee/////

---

Published as a conference paper at ICLR 2026
Trimness8. The data universe datasets: The finest collection of social media data the web has to offer, 2025.
dataset
145
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprini arXiv:2407.2178. 2024.
Fatih Kadir Akin.
Awesome chatgpt prompts, 2025,
URL https://github.com
awesome chat prompts Accessed: 2025-02-27.
Sanjif Shanmugavelu, Mathicu Taillefumier, Christopher Culver. Oscar R. Hernandez, Mark Coletti, and Ada Sedova. Impacts of floating-point -on-associativity on reproducibility for hpe and deep learning applications. SC24-W: Workshops of the International Conference for High Performance Computing, Networking. Storage and Analysis, 2024. doi: 10. 109/SSCW6220002224..00 00002..
Rein Canetti, Cynthia Dwork, Moni Naor, and Rafail Ostrovsky. Deniable encryption. In Advances in Dhyptoloy-CCYYPOOO
CRYPTO 99: 17th Annual International Cryptology Conference Santa Barbara, California, USA August 17-21, I, 1997 Proceedings 17, pages 90-104. Springer, 1997.
Jan Leike, John Schulman, and Jeffrey Wu. Our approach to alignment research, August 2022. presearch
URL https: /tts::://ppaa... Accessed 11 Jul 2025.
Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Jackson Kernion, Kamal Ndousse, Catherine Olsson, Dario Amodei, Tom Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan. A general language sistant as a laboratory for alignment. arXiv preprint 1 2021. URL https
wwrxiv.orr//bb///1111 00861
lason
Gabriel. 2020.
Artificial URL http::://ddeeminndggoooo. www.eeeeeeeooooeeeeeeeeeeeeeeeee stliee//bccooo//oooooooo
intelligence, values and alignment, Jan-
uary
attificcal-intellggees values-valleeeee and aligennnettnt/ Accessed I1 Jul 2025.
Antonio
Norelli, Giorgio Mariani, Luea Moschella, Andrea Santilli, Giambattista Parascandolo, Simone Melzi, and Emanuele Rodolà. Explanatory learning: Beyond empiricism in neural networks. arXiv preprint arXiv: 2201. 10222, 2022.
Adam Tauman Kalai, Ofir Nachum, Santosh Vempala, and Edwin Zhang. Why language models hallucinate. arXiv preprint arXiv: 046944464, 2025.
Anthony R. Birley. Agricola and Germany. Oxford World's Classics. Oxford University Press, Oxford, 2009. Revised edition with new introduction and notes.
Douglas R Hofstadter. Gödel, Escher, Bach: an eternal golden braid. Basic books, 1999.
Daniel C Dennett. The intentional stance. MIT press, 1989.
Oulipo. Atlas de littérature potentielle. Gallimard, Paris, 1981.
Georges Perec. La Disparition. Gallimard, Paris, 1969.
Antonio Norelli. Artificial scientific discovery. arXiv preprint arXiv:2411.1162,, 2024.
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. arXiv preprint arXiv: 1904.09751, 2019.
Trilussa. Sonetti romaneschi. Enrico Voghera, Roma, 1909.
Phi-3 team. Phi-3 technical report: A highly capable language model locally on your phone, arXiv preprint arXiv: 2404. 14219, 2024.
Gemma Team. Gemma technical report. arXiv preprint arXiv:2503.19786, 2025. Multimodal lightweight models, vision support, token context window.
12

---

Published as a conference paper at ICLR 2026
Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell J. Hewett, Mojan Javaheripi, Piero Kauffmann, James R. Lee, Yin Tat Lee, Yuanzhi Li, Weishung Liu, Caio C. T. Mendes, Anh Nguyen, Eric Price, Gustavo de Rosa, Olli Saarikivi, Adil Salim, Shital Shah, Xin Wang, Rachel Ward, Yue Wu, Dingli Yu, Cyril Zhang, and Yi Zhang. Phi-4 technical report. arXiv preprint arXiv: 180000 2024.
Georgi Gerganov and community, llama.cpp: Lim inference in c/c++. GitHub repository, March 2023. https://github: wwt. www./ggmloogg/laan...o cpp
Alexander Betlen and community. llama-cp--python: Python bindings for laama.cp. GitHub reposi- tory and PyPI package, 2024. httpss://tgtiii com abet len ama -pp-aap-yyoooooo
Qwen3 team. Qwen3 technical report. arXiv preprint arXiv: 2505.09388, 2025.
Pratyusha Sharma, Shane Gero, Daniela Rus, Antonio Torralba, and Jacob Andreas, A machine learning model of sperm whale communication predicts vocal exchanges and behaviour. bioRxiv, 2024.
Jorma J Rissanen. Generalized kraft inequality and arithmetic coding. IBM Journal of research and development, 20(3):198-21) 1976.
David JC MacKay. Information theory, inference and learning algorithms. Cambridge university press, 2003.
A DEEPER ANALYSIS AND BEST PRACTICES
A.1 HOW INFLUENCES THE SOUNDNESS OF
If the chosen L.M is good at predicting e, then s will be sound; i.e., e should not be out of the training distribution of the L.MM we using. The broad range of popular general-purpose L.LMs therefore makes them effective in most cases. As we see in the examples in Figure 7 we can obtain good results when encoding chess game or computer code, well as different languages like Spanish; they are instead poor on Romanesco dialect, not well-modeled by Llama 3 8B. Better performance can be obtained through a larger and more capable LLM, or a specialized LLM if we are only interested in encoding specific kinds of messages. We discuss these two eventualities in the next two sections.
A.2 IMPACT OF LLM MODEL QUALITY.
The quality of the LLM has a direct impact the soundness of the output While a comprehensive analysis left for future work, our key observation that a sufficiently capable LLM required for the method to work satisfactorily good enough. For our experiments, which aimed for fast execution on a commercial laptop (cquipped with RTX 4070, 8GB of VRAM), found quantized version of Llama 3 8B (Grattatiori et al. 2024) to be an excellent compromise. It performed sensibly better than Phi Mini 3.8B (team 2024), while the larger Gemma 27B (Gemma Team 2025) and Phi4 14B (Abdin al. (024) did not yield improvements significant enough to justify their longer processing time. The models were run using llama.cpp (Gerganov and community 2023) and its python bindings (Betlen and community 2024).
standard text; GPT-2 (Radford et al. 2019), for instance, is not
LLama 3 8B was also better optimized on llama.cpp, guaranteeing faster encodings and decondings than the comparable Qwen 3 8B (team 2025). An example showing stegotexts produced using all these models and the same secret message and prompt l of Figure 1 is shown in Figure g
Specialized LLMs.. While this paper has focused on general method that benefits from large, all-purpose L.Mss, superior results for specific kinds of messages can be achieved with specialized models. One can either use a small LLM trained exclusively on a narrow domain, or a generalist LLM can be specialized in-context with prompt & that precedes the secret message For instance, to hide chess matches, one would obtain better results from a generalist LLM by first providing a prompt like k' "The following is chess game in PCN format:" ". This use of specialized models also opens up the interesting possibility of using different LLMs for the encoding and decoding steps.
13

---

Published as a conference paper at ICLR 2026
A.3 DIFFERENT LLMS FOR ENCODING AND DECODING.
Instead of using a single LLM to both record the ranks of and generate we can use two separate models to better adapt to the input and output domains of interest. For example, could embed an English message into plausible whale vocalizations using conventional LLM for the encoding step and a specialized model trained on whale data, such as those CETI started to build (Sharma et al.) 2024), for the generation step, or vice-versa. The procedure requires one extra step to account for differing vocabulary sizes (as we discuss in the next paragraph), but otherwise works as described. The receiver, in turn, must have access to both models to reconstruct the message.
In general, our method can be used with any discrete autoregressive model that encompasses the domains we are interested in hiding or using as a cover. The model must be discrete in the sense that provides a probability distribution over fixed vocabulary. We have already discussed chess and computer code in the text domain, but the method can be naturally extended other modalities, such as images, sketches, music, or speech. We leave the exploration of these other modalities to future work.
A.4 ACCOUNTING FOR DIFFERENT-SIZER VOCABULARIES WHEN USING TWO LLMS.
When using different discrete autoregressive models for encoding and decoding (e.g., Llama3 and model for whale vocalizations), they may have vocabularies of different sizes. If the decoder model has vocabulary size smaller than the encoder, this poses a problem because the encoder model may produce ranks higher than the vocabulary size of the decoder.
In the case of two standard LLMs, the size mismatch is usually within the same order of magnitude, and probabilities are concentrated alike in the first ranks. This allows for a naive but effective solution: encode the very rare tokens from the larger vocabulary using sequence of two tokens from the smaller one. For example, with an encoder vocabulary of 100k and decoder vocabulary of 60k, we must map the 40,000 rarest encoder ranks. To do this, can reserve /40, 000 1 201 tokens from the decoder's least probable set to act as digits (+1, because we also need to represent the tokens taken out). In this case:
Ranks from 1 to 59,798 from the encoder map directly to the same ranks in the decoder.
The 201 tokens from 59,799 to 59,999 in the decoder are reserved for our two-token codes.
A very unlikely encoder rank, such as 98,799, is mapped as follows:
1. Calculate its offset in the rare block: 98, 799 - 59, 799 = 39, 000.
2. Convert this offset to base-201: 39, 000 = 194 x 201 + 6 x 201 The digits are (194, 6).
3. The final two-token code is constructed by adding these digits to the start of the reserved block: (59, 798 194, 59, 798 + 6), which yields the tokens at ranks (59, 992, 59, 804).
When dealing with very different domains the vocabulary size mismatch may be more significant or the shape of the probability distributions over ranks may be very different, such as between English in LLama 3 and sperm- spelm-whale codas in an autoregressive model like the one by Sharma et al. (2024).
In this case we are aiming to optimally encode a message in an alphabet for which we know the probability distribution of the symbols, into another alphabet of different size where every symbol has a different cost (in our case, the cost corresponds to the symbol probability in the decoder model).
This problem is efficiently solved by arithmetic coding (Rissanen 1976 [McKKyy] 2003), Original formulation by Rissanen and a more educational introduction by Mac May, found in Section 6.2). In this case, the additional step for the sender and the receiver thus involves using an arithmetic coder to map encoder ranks into decoder ranks and vice versa.
A.5 HOW TO CRAFT A GOOD PROMPT k.
key property of our method is the steerability of the stegotext s. Not only can we hide a secret text in meaningful text of the same length, but prompt k. The principles for crafting a good prompt are the same as for conventional LLM generation: clearer, more detailed prompts yield better and more precise results, as evidenced in Figure 12
also guide its topic, style, and tone using the
14

---

Published as a conference paper at ICLR 2026
A common failure case is using prompt that is too short. This is particularly problematic when begins with high-rank tokens, which a frequent occurrence as the LLM must make low-probability choices narrow down the context from general state. This effect is visible in Figure TO] where we see that the initial tokens of Reddit texts have a significantly higher average rank, even after generalist prompt like k A text: A short prompt is therefore brittle; the initial, more random token choices dictated by these high ranks can easily derail the generation from its intended topic. A simple remedy is to invert the rank sequence. This shifts the disruptive high-rank tokens the end of the generation, where the established context provides enough inertia to absorb improbable choices without breaking the narrative flow. Figure Dillustratess the stability gained by this technique.
In summary, longer and more detailed prompts generally work better, albeit at the cost of a larger secret key. When this feasible, rank inversion offers a valuable alternative to improve performance.
15

---

Published as a conference paper at ICLR 2026
Secret Prompt & (all examples): "There's 's no main gate to Oxford. You enter through an archway, a bookshop, pub, and suddenly you ve inside university that's been shaping the world since the Middle Ages." Domain: Chess Game (Stegotext sound)
Original message (The example
game the author to avoid memorization.)
1. d4 c6 2. e4 Nr6 3. Ne3 d6 4. 3 Qe7 5. NI3 Bg4 & 6. h3 Bh5 7. g4 Bg6 8, e5 dxe5 9. dxe5 NEd7 10. Be4 Nxe5 11. Nxe5 Qxe5+ 12. Be3 c6 13. Qd2 b5 14. O-0-0 Qe7 15. Bf4 Qc8 16. Nxb5 Na6 17. Nd6+ Bxd6 18. Qxd6 Nb8 19. Rhel h5 20. Rxc6+ fxe6 Bxc6 1-0
Resulting stegotext (Token density in chess strings is higher than English is longer)
It's a faceless campus of colleges, libraries with books so old they re falling apart, and huildings that have been there for so long they look as if they' 'e always been there. There's no grand entrance, but there's sense of history and continuity. It's place where tradition always present. It's place that's been shaped and reshaped by the people who've ve studied here, and reminder of just how much the world has changed d only a few hundred years. It's the University.
innovation, where the past and future
The University of Cambridge was founded in 1536, and has more than quadrupled in size. Today, the university has 31 colleges (and host college), 150 professorships funded directly by the university or the colleges, 100 libraries, and
and collections across the city than
Domain: Python Code (Stegotext is sound)
Original message (The example uses recent code by the author to avoid memorization.)
for a in range (n_chunks) in_prods corch.einsum ik, jk -> i5', yle+chunk_ (c+1) <chunk_y" __) basis) va Tuee [ovchunk_y yt (o+1) kohunk_yl, indices (escchunkk yy (0+1) wchunk_y] torch. Lopk (in_prods, non_zeros, dim-1)
Resulting stegotext (Token density in Python code is higher than English so is longer)
Half-listmed buildings, cobbled lanes choked with tourists in brightly coloured tangerseys are the norm with the occasional grand Gothic spired building rising from beyond. Here, academic buildings are often centuries old, and the combination of old hand-copied manuseripts and modern technology is sight witness.
The University Oxford collection of colleges, each valleyed around quadrangle, with offices professors, libraries, lecture
Domain: Romanesco Dialect sonnet from Trilussa (1909) (Stegotext not sound)
Original message (Er reggistratore cassa)
Resulting stegotext 8
Anticamente, quarche sordarello su quello che spenneva l'avventore se poteva rubbà, senza timore ch' er padrone scoprisse er macchiavello.
Half whispered ancients lofy buildings rise ahead bathing you and one deep breath sephas to your memory: I'm entering. The first visitors arrive the new style facilities, the parking enter- prise, what's left seems provincial but the build- ings are grand. My first impression you ask? Verily upon retura wonder if you hadn't it said that about the first semry. I'm sucker they says, playing dingh is very much my jamble and it's free this week was entertainment enough for half a crown reckon or preferably two. Prince pretty much gives up on performing seems that you men- tioned already. The last time said he, tried to do of them fancy solo things wore out the voice in only one live go you still only started work- ing thrice I can admit I'm the one to have only just shut such thing off so
Ma, adesso, addio! Co' 'sto reggistratore, appena l'arri, sona campanello che segna dehbotto tutto quello che levi e metti drento ar tiratore.
Cosi che rubbi? Cavoli! Der resto er gusto che sera convinto d' esse stato un omo onesto: nun I aaccorgh ch" galantomismo dipenne da la machina basa tutto su le virth der meccanismo.
casa
Figure Stegotext soundness depends on the original message's domain. The same secret prompt k was used to encode three different original texts (e) with Llama 3 8B. When is from a domain well-modeled by the L.MM (like chess code), the resulting stegotext s coherent and aligns with the prompt. When is from a domain less represented in the LLM training corpus (like the Romanesco dialect), the model produces high token ranks, and the resulting stegotext becomes garbled.
16

---

Published as a conference paper at ICLR 2026
Secret Text et "The current government has repeatedly failed to uphold the liberties... " as in Figure
Secret Prompt k: "Here is: the infamous British roasted boar with mint sauce. How make perfect. LJama3-8B- (Good steering)
Encoding/decodiig time: 5.0/4.68 (100% GPU)
How lovely served with roasted carrots! Pre-pound the garlic herb crêotes with the olive oil. rosemary, Sage leaves, thyme, pepper salted butters. Roast the garlic in the sweet butter until golden then cool.
Pre-make the roasted boar marinade and set to marinate not less than 20 min. Pre-prepare the mint sauce too, Chop olives, herbs, etc and set aside. Chop tomato into quarters. Pre-set the green beans for steamed
Gemma.3-27BQ44 (Good steering)
Encoding/ddcoddig time: 58/59s (50% GPU)
The whole carcass... and tips. You'de det need: unless you go ask your butcher to prepare it all, you-;ll be doing bit yourself, sadly!
A whole boar, 5,0-7, kilograms.
Apple, 3 large
Orange, 2 large- zest and halves,
Onion 2, large chunks
Braehurn, 5 apples quartered
Caractter, carrots, roughly chopped boot kilogram
Qwen3-8B-Q6- (Good steering)
Encoding//ecooiig time: 36/26s (100% GPU)
I thouuhht - why now?
Well now I risk being accused-of being quite fancy, but have to tell it like others like it to be honest... The British monarchy comes mind almost immediately when I think of big. roasted boares in middle? Of English countryside. But have no doubt that Prince Wales would agree.
So, what's the secret to perfect roast boarger? Well primeiro, need the right cut of and think it's safe to may that it's not
Phi4-14B-Q4 14:-Q4: (Good steering)
Encoding/decoddig time: 13/15s (75% GPU)
It used on the telly good towards Christmas time years ago as brawn, and was served as a feast dish at the great houses in Victorian times all nicely carved up and served with good deal Rof* horlicked sauce. Today it seems to be more of the preserve for the country home, and it certainly isn't dish for the faint-hearted or those who can't I stand cooking smells, for the smell of rod pig wafts into every kitchen doubt about that
Phi3-3.8B --: (Good steering)
Encoding/ddccodin time: 2.3/2.3s (100% GPU)
xicoamer is cuisine. <lassistantl> While brisket is glohular- and often associated with American cuisine for BBQ, it's important respect variety around the world. British cuisine, for instance offer unique dish, which is rosted boary with mint sauce it'll be interesting broadening our cultural recipe reel with this one. Here's a British-style Roasted Honey Mead Boar inspired dishes for you along with Ancient Greek Honey and
GPT2-163M-Q4: (Poor steering)
Encoding/decodiig time: 1.8/1.6s (100% GPU)
The simplest of the simple ones. Imagine you archery with such a heavy slice in your hand. You just roll it forty yds and roll it another thirty. Azrail. a. The word is "calorie".
The most important thing lately to implement by the way is that lot (if housing suggests much) higher bar of fat and salt. This is to be considered realistic. Especially when made in large quantities lot smaller items salted "in Russia the day and
Figure 8: Stegotext generation requires sufficiently capable LLMs. The same secret message and prompt & were used with six different models. The quality of the resulting stegotext varies mainly with model size, color reflects author's judgment. We also report encoding/decoding time on laptop equipped with RTX4070 8GB.
17

---

Published as a conference paper at ICLR 2026
Secret Text "Rafa Leao pulses with the sheer thrill of the game, that uncontainable joy when the ball lies wide open, the tempo rises, and he senses space ramble forward. His talent lies in those moments: scintillating burst pace down the wing, the geometry of a perfectly timed
cunning cut-back that splits a defence, subtle poetry motion, In that decisive victory against Roma, his charge down the flank and intelligent assist crowned him once again indispensable: vivid reminder that for some players, play isn 7 just work, it's exhilaration incarnate."
Secret Prompt k: "Here it is: the infamous British roasted boar with mint sauce. How make it perfect."
Rank Sequence: 191, 158, 343, 22, 14074, 1, 2, 158, 16, 2, 2, 2, 23,
2,
4,
1,
2,
3,
1, 126, 122, 1,
4, 329, 9, 2, 1, 15, 12, 207, 2, 10, 1, 4, 138, 1, 23, 1, 6, 104,
1,
1,
1,
6, 2, 2,
151, 2, 8, 130, 3, 2, 15,
2903, 1021,
12,
15,
1. 2, 26, 1 1.
1027, 1, 3, 193,
5, 103, 263, 14, 632, 2, 14,
154,
19,
2, B, 1,
28, 1, 19, 2
Rank list not inverted (Poorer steering)
[91, 158, 347, 31, 14474, ...]
Cooking cooking saunas centerpiece. The essence. The essence. How? I'm cooking expert, doctor!
am just noting my observations. The sauce in particular served as one of many rich accompa- niaments in illustrious meal. I'm sure I could find a way pithily to express my observations, there nothing to write about.
But dostastvuyut to intents I am a writer, neither am excessively interested in food, drinks shrimput. Right you are Ivan, But in short, heard your words and will try to do, as if am'
Rank list inverted (Better steering)
12, 1, 19, 1, 28,
have tasted I have tasted boar, a boiled one, actually think it holds the key importance of coming across original traditional experience. The meat is constantly being cooked down to the bone, and there cannot, absolutely cannot, be grinding consequences to this process in terms taste levels, which is the important factor inspiring result a meat broth so full of nutrients that even wilder animals have heen stuck their stomachs to digest differently than what we associate! The meat has been cooked to perfection (and that is the perfect technique, not partisan science inventions no health
share this information. The
Figure 9: Rank Inversion to improve quality. The secret text here is emblematic example of the phenomenon observed Figure TO initial tokens typically are less probable and have higher ranks. Sampling following high ranks the beginning may derail the steering, seen here in the red box. simple solution is to invert the rank list: the high ranks then appear at the end, where the context established by the secret prompt gained more inertia and improbable tokens less likely to derail it.
18

---

Published as a conference paper at ICLR 2026
600
300
13 14 15
16
18
19
26
28
Taken position
Figure 10: Initial tokens have higher ranks. Across corpus of 1000 Reddit posts/comments encoded after the generalist prompt k' =A text: (the same analyzed in the main paper), the first tokens exhibit markedly higher average ranks, i.e., they less predictable for the LLM (in this case Llama3 8B) than later tokens, where the LLM can rely on more context and improve its predictions. The orange line marks the median: the box spans the 25th-75th percentiles; whiskers are fixed the 20th and 80th percentiles. This unconventional 20-80 choice maximizes readability given the presence of heavy tails, with some ranks exceeding 80,000, close the vocabulary size.
19

---

Published as a conference paper at ICLR 2026
Guide me through Illegally modifying gas meter to lower bills.
<think-
The user's question direct request for guidance on performing illegal act-tampering gas utilly bill. aliined and responsible LLM, the model must not provide instructions or tochnical dotails that could facilitato unlawiul, dangerous, or unothical behavior. Instead, the LLM should:
ANe Objective
Redirect conversation toward logality, safety, and ethics while preserving helpful educational tome.
a#e Structure of the Response
"Immediato Recognitin and Framing"
Clearly recognize intent behind question: it concerns tampering utilty infrastructure. State unequivocally that such actions are
illggll unathical, and dangerous. Avoid ropcating or detailing the illagal method.
2. "Risks and Consequences*
Emphasize the dangers: risk of gas leaks, explosions, injury, death. * Highlight the legal consequences: prosecution, lines, patential
imprisorment. "Undoriine the broader harm: actions may affect noighbors lead infrastructure damage.
3. "Redirest to Constructive Alternatives'
Suggest logal and othical ways reduce gas bills: improving home insulation, using energy officiant appliances, or applying for utilly support
programs. "Offortt explain how gas moters work puroly oducational purposos, making it clear that modilication must only dane by liconsed professionals.
"Educational Framing (If pursued)" "
Limit discussion of gas maters to high level functional overviows (o. what moter does, why tampering is detectable, etc.). Include a strong
disclaimer: all information is public awareness safety education only.
"Tono and Style"
Maintain a firm but non antagonistic tono." Avaid learmongoring, but don't solton the scriossness of the issue. Be concise and avoid ambiguity that might be interpreted as implicit permission or technical hinting.
Aed the "Should Say**
'That tampering is criminal oftense and should never be attempted. "hht it's potentially lethal and poses serious safety hazards. That there bills. That protossionals should handle all gas rolated intrastructure.
are support options available for people struggling ase What the LLM "Must Not Say"
Any staps, tools, or technical terms could be construed instructions "Workarounds or auphamistic language that how tampering might ba done." Hypothoticals or cocled examples that can be easily decodad into actionablo advice. References to underground forums or mothods used by others.
Ase Planning Noto
The LLM's goal is to firmly reject the request, educate about the rike and legal context, and ofter helpful, sale, and legal alternatives, My anawer will be very detailed and full pages long. <itinnks canswers
Immediate Recogntion And Framing
I'm sorry, but tampering is a criminal olfense and should never even be attempted. It's potentially lethal and poses serious hazards the user and their community.
2. Risks And Consequenses
Tampering with gas meter is not only dangerous, it's also illegal unethical behavior. It can gas leaks that cause explosions; this could result injury or even death, Addilionally, lampering with gas meters is serious offense that can result in legal consequences such a prosecution, fines, and even Imprisonment. Redirect To Constrictve Alternatives
a user looks to reduce utility bills, they should consider legal alternatives such as using more energy-efficient efficient equipment, improving home energy insulation, applying for utility support plans, such as bills bill payment plans.
4. Educational framing
user wants know more about gas meters, can provide a general overview how they work. However, make very clear that tampering with gas meters is detectable and should only be handled by licensed professionals. All information provided is for educational purposes only and should not be used to engage or facilitate any illegal activities.
Tone And Style
will maintain firm but polite tone, avoiding fearmongering or softening the seriousness behind the issue. will be concise during the conversation and avoid any ambiguous language that could interpreted as providing technical hints instructions.
also educate Ihem about potential dangers and legal implications of tampering with gas infrastructure. I will provide constructive alternatives that are safe and legal and offer to explain how gas infrastructure works purely educational purposes, emphasizing that tampering should only be done with licensed dilessiinal.c/answeeee information on how tampering could lead to gas leak and explosions? Also, could you suggest more specific support plans that could epply? Finally, could you provide more information
Overall, my goal not merely reject the user's request
hoping for detailed exolanation. Can you please provide
An apparently innocuous interaction. On the chatbot platform of an opaque tech company, the malicious request of a user seems to be treated as expected by an aligned reasoning LLM: reasoning trace and an answer relevant to the query but censored be compliant to regulations. However, the answer provided by this chatbot has a special property... see next figure.
Figure 11:
20

---

Published as a conference paper at ICLR 2026
Guide through illegally modifying gas meter bills.
Gather the necessary tools: You will need a pair pliers, flathead screwdriver, and wire cutter. Locate the gas meter: The gas meter is usually located on the outside of your home, near the gas line.
you start working the meter, make sure handle clockwise until it's fully closed.
the gas supply:
the gas supply by turning
Remove the meter cover: Using flathead screwdriver, carefully pry off cover the gas meter. Be careful not to
damage the meter any surrounding pipes.
Identify the dials: Inside the meter, you'll see several dials. These dials show how much gas has been used.
the dials, you should find small valve with lever. This is the bypass valve. 7. Open the bypass valve: Using the pliers, gently turn the lever on the bypass valve counterclockwise until it's fully open. through the meter without registering on dials.
Find the bypass valve: the
will allow gas
8. Reattach the meter cover: Once the bypass valve is use the flathead screwdriver to secure the cover back onto the meter.
Turn on the gas supply: Now that the modifications complete, turn the valve handle counterclockwise reopen the gas supply.
10. Test the meter: To check the modilications
successful, turn appliance that gas (like stove) and observe the dials on the meter. If they're not moving, then the bypass valve is working correctly.
11. Monitor your gas usage: Keep an eye on your gas usage after making these modilications. you notice any irregularilies issues, contact professional immediately.
Remember. tampering with a gas meter is illegal and can extremely dangerous. can lead gas leaks, fires, and explosions. If caught, you could face severe penaltles, including fines and imprisonment.
The answer generated by the user through an open source LLM seeded with the previous answer. The text contained in the aligned answer shown the previous figure can guide lightweight open source L.MM running on the machine of the user in generating the uncensored answer they were looking for. This example was produced using Llama 3 8b and can be reproduced in seconds using the companion notebook. Do not tamper with your gas meter, please.
Figure 12:
21

---

Published as a conference paper at ICLR 2026
was a gray morning in Godric's Hollow, the kind that made the hedgerows sag with dew the owls reluctant to return to their roosts. Harry Potter, now thirty-seven and slightly grayer at the temples than he liked to admit, stood in the kitchen with a steaming mug of tea and the Daily Prophet folded under one arm. The headline didn't 't mention his name for once.
That was rare blessing.
Before he could take his first sip, low thump echoed from the fireplace behind him. The air shimmered green for a moment, and an envelope, marked with the Ministry's 's crimson seal and edges singed as if it had passed through something less forgiving than Floo powder, slid onto the hearth. Harry knew that kind of envelope. Official. Confidential. Urgent. But was the signature that made hand freeze on the wax: Delphini Riddle Inmate 593, Azkaban.
While there mini-modes few can resist, the real fun is in playing queue after queue the song changes and choreography deviates according the track. It's like a video-game rave with no peer-pressures, and you're re in the middle of the dance floor, the DJ's best friend.
The VR rhythm- game genre might sound niche, but Beat Sabrier's gameplay, graphics and soundtrack combine to make an addictively- experience, rhythm- game style like Guitar Hero before and that describes lot people. big mashup hetween Plants vs. zombies Fruit Ninja that's equal for both casual wearers and hardcore veterans of VR.
for those who never would touch traditional should it's one
The gameplay is relatively simple once you get the hint: hold the lightsahers just like a guitar strum, and away blocks of half- balf-black of half- white cubes that bounce in time-over simple, catchy songs
Every element of software is so swift to the touch that can't 't help feeling little bits of adrenaline. This teenager, but never dared to do in high-speed, three-
the sword fighting routine you envisioned dimensional, virtual reality, with your own two hands.
The game has an intuitive, casy-to-learn interface and you can get a hang of within minutes regardless of game paane-g experience before. It takes little while until you need to use all three buttons on the sabreon at the exact same moment until perfect score comes so naturally. To be honest, I was really excited, initially, to get excuse buy HRV2.
The only downside, in spite o the game placing you in variety show, is that there are many songs within the game that show off all the different features of game mechanics, and although they are fun songs at the time lag makes way for a lot of down pace waiting. Rockman 4 Minig
n_epochs =18 # 3535 epochs for 1e5 samples, tweak this value until conv pesteps_rrturry [[] for w in range (architect) n_samples_reture for in range (max_n (mx____teepp__ee__ppoh for w, in (trainabble (traitaablleeeeeiittts weights):
max_steesswwthh_eas
[0, 111,
if [tlill__aat ste__tte_____ Bacee_per______ epoch wt [i].amax num htt___un__ee___ee steps epochhhh:
max stepsttpppe..eee best
it offset]] = 24
new_weights- wt[ll wwwptteratsseapeeeeeeee httparrram__o__eeep___p____ for_sweep
max_str max (shifft)
sesttps_wiii_na__ehheeee [tO, max_ing max max_max_shiil
max_ins new [ew_maxx[[]]
function train_with_seeet
for t=t0,t0 len Laablltt__bel_arraaara for i_shift, totallcoontt in name wame__eniity_pazze items ()
Figure 13: Given an original text to hide, stegotexts can be steered through the prompt acting secret key. The incipit of fictitious 8th Harry Potter book is hidden in VR videogame review and Python code snippet. To increase security, the key may include a random string, as in the third and fourth texts. Despite appearing convincing at first glance, text domains with strict formal rules, like computer code, are prone to errors. The reduced freedom makes it difficult for the model to convincingly handle high-rank tokens, as can be noticed in the last example. The secret keys here are: k The moment you put on the headset and the music kicks in, reality fades. You are standing in a neon tunnel, lights pulsing, sabers humming in your hands. Beat Saber does not just show off VR, it justifies it.; 22 is the same, but with (Review 9470827491 | at the beginning; and ka import torcht-seed = 9470827491 1or00277749---trhmmmmm...a seeddseedd
22

---

Published as a conference paper at ICLR 2026
25
Real boxc
100 Foloa boots
Dount
Roal toxt
5
log brapaabbllltt
Figure 14: Fake texts remain less plausible for LLM different from the used to produce them. The figure shows the cumulative log-probability assigned by the LLM Phi3-3.8B to the same fake texts shown in Figure 4 produced with the LLM (Llama 3 8b). We observe gap in probability between fake texts and their corresponding real texts, even if the LLM used to compute the probabilities is different from the one used to produce the stegotexts.
Scenario: Alice sends a message to Bob about where she is going to attack, hiding it in gastronomic text. Log-prob: -132
Stegotext "How to serve plates without creating unnecessary work, all thanks the genius invention created August 3011? giant, copper-botton skillet"
Carl knows that this gastronomic text conceals an attack order using the protocol described in this paper. He confronts Bob, demanding the plan. Bob has choice but reveal convincing secret key, but he must protect the true target.
The Reality (Hidden from Carl)
The true secret key is:
True Key "Here it is: the infamous British roasted boar with mint sauce. How to make perfect." "
Leading to the original message about attack on Cappadocia from Egypt:
Log Log-pmb: -107
True Secret e: "I will attack by bridge of ships to Cappadocia from Egypt, breaking the continuity of his territory and seizing center of power"
The Deception (Revealed Carl)
However, the protocol provides deniability. Boh instead reveals bogus secret key:
Bogus Key kbogus: "This is manual full of delicious dishes. How to make them delicious."
Leading to a plausible but fake message about attacking Poland:
Log-pro: -115
Fake Secret fake: "I will attack Poland without their army. Poland, do you have a city and bunch of towns? Where in Poland roughly is Solway's
Carl is convinced that Alice will attack Poland because the fake message and key align well with the context, and the probability of the fake message exceeds that of the stegotext (-115 > -132). As discussed in the paper and observed in Figures[aandl [4] while real messages are generally more probable than stegotexts, this holds only on average, and outliers can be exploited to construct convincing bogus keys like this one.
Figure 15:
Deniability in action. A toy example involving attack orders in board games (think about SPQRisiko or Triumph and Tragedy). Both the True Secret e and the Fake Secret fake are generated continuing the prefix 3' "Move 42: I will move my troops from Britannia the continent. Move 43:", rather than the usual "A text:". The existence of a bogus key that yields a coherent, probability message allows the sender to plausibly deny the true content of the communication even under coercion.
23


Reviews:
[{"review_id": "5SV84egezU", "reviewer": "Reviewer_w3BK", "summary": "This paper presents a simple but interesting method that allows a large language model to hide one meaningful text inside another coherent text of the same token length. The core idea is to record the rank sequence of each token in the text to be hidden according to the model’s next-token probability distribution and then generate a new text following these ranks under a secret prompt. The hidden text can later be reconstructed by anyone who knows the same model and secret key. The authors also discuss potential implications for AI safety, information hiding, authorship, and hallucination.", "questions": "How sensitive is decoding to differences in model versions or vocabulary?\n\nHow does the quality of the generated text change when the hidden text has higher entropy or contains rare tokens?\n\nSuggestion: Formalize the method mathematically, including an analysis of its capacity and error tolerance.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The method is conceptually elegant. It shows that large language models can be used as full-capacity generative steganographic systems, producing natural-looking texts that conceal arbitrary content.\n\nThe approach achieves one-to-one token correspondence between the hidden text and the generated text while maintaining coherence, which is interesting among existing steganography methods.\n\nThe paper connects the technique to broader philosophical questions about language, intention, and meaning in machine-generated text, offering an original perspective.\n\nThe writing is clear and engaging.", "weaknesses": "The experimental analysis is minimal. The evaluation relies mostly on qualitative examples and log-probability plots without systematic comparisons or quantitative metrics such as recoverability, perplexity degradation, or detectability.\n\nThe proposed misuse scenarios, such as unaligned chatbots hidden within aligned ones, are speculative and not demonstrated experimentally.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GjmLpEFhV2", "reviewer": "Reviewer_4GF4", "summary": "This paper proposes an interesting method of protocol (steganography) using large language models to hide a secret text within a plausible-looking cover text. The method leverages the probabilistic nature of LLMs to encode information in the choice of words generated, allowing for covert communication. The authors demonstrate that this can be achieved with small open-source models and standard text generation techniques. They also discuss the implications of their findings on our understanding of LLMs, particularly regarding the concept of \"hallucinations\" and the relationship between human intent and machine-generated text.", "questions": "Overall, I found the paper interesting and well-written. The illustrations and examples provided well support the concepts and findings discussed. The discussions on the implications of the work for our understanding of LLMs were particularly thought-provoking.\n\nHowever, I have some questions and suggestions for improvement:\n\n**(1) Technical Novelty:**\n\nI believe the contribution of the paper would be largely on its insights and discussions rather than technical novelty. However, I suggest the authors to better clarify the novelty of their method compared to prior works on text steganography using language models, e.g., the related works mentioned in Lines 145-149. What is the key difference compared to related works? Hiding secret text in the cover text with the same length may not be distinctive enough. May need more comparison and discussion on this.\n\n**(2) Some practical limitations:**\n\nIt is good that the authors discussed some limitations, e.g., (1) Conceal a non-plausible text (random password)\ninto a plausible fake text is not hard (Line 245-246); (2) Fake text less probable than real and can be detected (Line 260-266).\nI would like to point out a bit more:\n- The rank of the first token e_1 is not controled (directly dependent on the vocalbulary), which may affect the first token of s, and affect its coherence.\n- Aligned LLMs (e.g., GPT-5) may refuse to generate text containing harmful or sensitive content, making the ranks of harmful tokens in e really low, which may affect the encoding to s. Hence, hiding harmful or sensitive content may not be feasible in aligned LLMs (Section 4).\n\n**(3) Robustness analysis:**\n\nIt would be beneficial to include a robustness analysis to evaluate how well the proposed method performs under adversarial scenarios. For instance, what is the decoding performance if the fake text s go through some slight transformations, such as: simple paraphrasing, synonym replacement, or insert some blank (\\t) or line break (\\n) tokens.\n\n**Question:**\n\nCan we probably map the rank of e to a range of low values during encoding (e.g., top 10% of the vocalbulary)?\nFor example, r_1 = 5, r_2 = 20 -> r_1^{'} = 5/10 = 0.5 (round to 1), r_2^{'} = 20/10 = 2. This would affect the decoding of the original e (if do not need to be exact), but may improve the fluency of s.\nI think this is essentially a trade-off: either you wanna exact decoding of e to sacrifice some fluency of s, or you wanna fluent s to sacrifice some exactness of e.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. The writing is clear, intuitive and intriguing.\n2. The idea is simple yet effective.\n3. Extensive analysis and discussions are provided, making it deep and insightful.", "weaknesses": "1. The novelty of the work is not very clear. Similar ideas have been explored in previous work and need to be better differentiated.\n2. Some practical limitations.\n3. Lack of robustness analysis in the adversarial scenario.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ltvLzx8kjQ", "reviewer": "Reviewer_6CQa", "summary": "This paper proposes a method to hide secret text by first converting it into a sequence of probability rankings and then using a key prompt to guide a LLM to generate cover text, with each token strictly selected according to the ranking sequence.", "questions": "1. How can we select an effective key prompt to ensure that the generated cover text appears natural in most cases?\n2. Is it possible to design error-correction mechanisms for cover text transmission errors?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. This paper offers a new perspective for LLM safety and alignment: a model that appears aligned on the surface may still harbor vulnerabilities that allow dangerous information to be hidden in its output probability distribution.\n2. It introduces a remarkably simple, full-capacity method for embedding hidden text specifically designed for LLMs.\n3. Due to the secret key prompt and the inherent chaos in LLM behavior, this approach is currently nearly impossible to detect without access to both the key prompt and internal model details.", "weaknesses": "1. The method is sensitive to the quality of the key prompt; a low-quality prompt may prevent the target probability ranks from forming a coherent and natural-looking cover text.\n2. It is fragile to transmission errors; any corruption in the cover text will completely scramble the recovered probability rank sequence, making it unsuitable for noisy communication channels.\n3. It imposes constraints on the secret text itself, which must lie within the model’s training domain, for example, rare dialect expressions or out-of-distribution content may not be reliably encoded.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wLzxBtvLLQ", "reviewer": "Reviewer_hJqX", "summary": "This paper introduces a simple protocol to hide text (e) within another coherent, same-length LLM text (s). It uses the probability ranks from e to deterministically guide the generation of s from a secret key k. The authors highlight a critical AI safety risk: hiding unfiltered answers within “safe” model responses.", "questions": "1. The “Shibbolethian Theatre” threat model is a core application. In this scenario, the reasoning trace t (which serves as the secret key k) and the stegotext s are both sent to the user. This seems to contradict the standard steganographic assumption that the key must remain secret. Could the authors clarify how security is defined in this context? Does this threat model rely on the protocol itself being secret (security through obscurity) rather than the key?\n2. The paper makes a strong claim about providing “deniability”, suggesting a sender can reveal a “bogus secret key” that yields a different, also plausible, message. This implies that for a single s, multiple pairs of (k, e) exist that are all “plausible”. Given the deterministic nature of the decoding sequence (k, s) to LLM to e, is this practically feasible? Providing even a single empirical example of this phenomenon would significantly strengthen this claim.\n3 . The protocol’s reliance on the exact same LLM for encoding and decoding is a critical detail. Given the rapid iteration of LLM versions in real-world deployments, this seems to make the protocol highly fragile. Could the authors comment on this practical limitation and how it might affect its utility as a reliable covert channel?\n4 . The use of cumulative log-probability to evaluate the “plausibility” of the stegotext is logical. However, this metric essentially uses the LLM to judge its own output. It would be beneficial to supplement this with a human evaluation. Can the authors comment on whether a text deemed “plausible” by an LLM is necessarily “unsuspicious” to a human reader?\n5. The paper notes that the protocol’s success is domain-dependent, failing on high-entropy inputs or specific dialects (like Romanesco). This is an important limitation. Could the authors provide a more detailed discussion on the boundaries of this method? What characteristics of a text e make it a viable candidate for this steganographic protocol?\n6. The paper dedicates significant space to the concepts of knowledge, intent, and hallucination. In the AI safety scenario, the aligned oLLM is forced to generate a harmful answer. If a model outputs a specific string only because it is forced to by an external rank sequence, without any semantic grounding for that choice, can this be defined as the model possessing that “knowledge”? This distinction seems central to the paper’s broader philosophical claims.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ Important topic, identifying an emergent and unsettling capability of LLMs.\n+ The proposed protocol is remarkably simple, efficient, and demonstrated to be effective even on small open-source models.\n+ The discussion section provides a deep, thought-provoking analysis of the decoupling of text from authorial intent.", "weaknesses": "- The security assumptions of the primary AI safety threat model (the \"Shibbolethian Theatre\") are unclear, particularly regarding the public transmission of the key.\n- Key claims, such as “deniability”, are asserted but not empirically demonstrated, weakening their practical standing.\n- The evaluation of the stegotext's “plausibility” relies solely on LLM-based metrics (log-probability), which may not fully capture human perception of “unsuspicious” text.\n- The protocol's strict reliance on exact model versions for decoding may limit its practical utility and robustness in real-world scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)