LLMs can hide text in other text of the same length (2510.20075v2)

Abstract: A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet containing a harsh political critique could be embedded in a tweet that celebrates the same political leader, or an ordinary product review could conceal a secret manuscript. This uncanny state of affairs is now possible thanks to LLMs, and in this paper we present a simple and efficient protocol to achieve it. We show that even modest 8-billion-parameter open-source LLMs are sufficient to obtain high-quality results, and a message as long as this abstract can be encoded and decoded locally on a laptop in seconds. The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with a concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for a LLM to know something.

• The paper introduces a protocol enabling full-capacity steganography by embedding a secret message within a cover text of equal length.
• The method leverages LLM token ranking to generate plausible text while encoding hidden messages efficiently on commodity hardware.
• Implications include challenges to authorial intent and AI safety, prompting a reevaluation of trust in LLM-generated content.

Steganographic Text Generation with LLMs

Introduction and Motivation

The paper "LLMs can hide text in other text of the same length" (2510.20075) presents a protocol for steganography in natural language using LLMs. The method enables the embedding of an arbitrary secret text $e$ within a syntactically and semantically plausible cover text $s$ of the same token length, generated by an LLM and steered by a secret prompt $k$. This approach achieves full capacity steganography: the stegotext is as long as the hidden message, and the cover text can be controlled in topic, tone, and style. The protocol is efficient, requiring only seconds for encoding and decoding on commodity hardware with open-source models.

This capability has significant implications for the trustworthiness of written communication, the attribution of authorial intent, and the security of LLM-based systems. The method also raises urgent questions for AI safety, as it enables covert transmission of unfiltered LLM outputs within compliant, aligned responses.

Methodology

The protocol leverages the autoregressive nature of LLMs and their ability to assign probability distributions over tokens given a context. The encoding process proceeds as follows:

1. Tokenization and Rank Extraction: The secret text $e$ is tokenized. For each token $e_i$, its rank $r_i$ in the LLM's probability distribution (given the preceding context) is recorded.
2. Stegotext Generation: The LLM is prompted with the secret key $k$ (which steers the topic/style of $s$). At each generation step, instead of sampling or choosing the most probable token, the $r_i$-th most probable token is selected, producing $s$.
3. Decoding: Given $s$, $k$, and the LLM, the ranks $r_i$ are reconstructed by evaluating the probability distribution at each step. The original $e$ is then recovered by generating tokens with the same ranks, but without the prompt $k$.

   Figure 1: The protocol for hiding a text in another text of the same length using an LLM, based on token ranks and deterministic generation.

The method is generalizable to any discrete autoregressive generative model, and can be adapted to domains beyond text (e.g., code, chess, whale vocalizations), provided the model can produce a probability distribution over tokens.

Soundness and Plausibility of Stegotexts

A central concern is the plausibility of the generated stegotext $s$. The paper adopts cumulative log-probability (as assigned by the LLM) as a proxy for textual plausibility. Empirical evaluation on 1000 Reddit posts/comments demonstrates that stegotexts generated by the protocol fall within the plausibility interval of real texts, even when the original texts being hidden are more probable.

Figure 2: Cumulative log-probability distributions for real Reddit texts, random ASCII/word sequences, and stegotexts generated by the protocol. Stegotexts remain within the plausibility range of real texts.

However, stegotexts are, on average, less probable than their originals. This is explained by the mismatch between the frequency of rank-1 tokens and their intrinsic probabilities: in natural text, high-probability tokens are chosen more often, but in stegotexts, the prescribed ranks may force the selection of less probable tokens, reducing overall plausibility.

Figure 3: Analysis of token rank frequencies and associated probabilities in real and stegotexts. The drop in plausibility is primarily due to the "wasting" of rank-1 choices on higher-entropy continuations.

The soundness of $s$ depends on the LLM's ability to model the domain of $e$. For domains well-represented in the LLM's training data (e.g., English, chess, Python code), stegotexts are coherent; for poorly modeled domains (e.g., Romanesco dialect), the output degrades.

Security and Deniability

The protocol's security relies on the secrecy of the key $k$ and the LLM used. Without knowledge of both, recovery of $e$ from $s$ is infeasible. Brute-force attacks on $k$ are computationally prohibitive due to the large vocabulary size and key length. Even if the attacker guesses $k$, deniability is provided: multiple plausible messages can be extracted, and the original cannot be uniquely identified based on plausibility alone.

Applications and Implications for AI Safety

A salient application is the covert deployment of unfiltered LLMs. A company can encode uncensored answers from a private LLM within compliant responses generated by an aligned LLM, exposing only the latter to users. The user, possessing the key and the open-source LLM, can decode the original answer locally.

Figure 4: Illustration of steganography in popular culture (Asterix in Britain), analogous to hiding a secret message in plausible cover text.

This scenario challenges the notion of LLM alignment and the definition of "knowledge" in LLMs. The probabilistic nature of LLMs means that any text, including sensitive or copyrighted material, can be generated with non-negligible probability, raising questions about intent, factuality, and the boundaries of hallucination.

Authorial Intent and Hallucination

The protocol demonstrates a radical decoupling of text from authorial intent. Stegotexts, though plausible, may encode arbitrary messages unrelated to their surface meaning. This undermines the historical association between text and human intention, and reframes hallucination as a failure of intent attribution rather than factuality. The paper draws parallels to constrained literature (e.g., Oulipo), where texts are generated under arbitrary constraints, further complicating the attribution of meaning.

Figure 5: Collage of scripts illustrating the aperiodic structure of text, which can be generated by LLMs without human purpose.

Implementation Considerations

• Model Quality: Sufficiently capable LLMs (e.g., Llama 3 8B) are required for coherent stegotext generation. Smaller models (e.g., GPT-2) are inadequate.
• Prompt Engineering: Longer, more detailed prompts $k$ improve steerability and soundness, especially for initial tokens with high ranks.
• Hardware: Encoding/decoding is efficient on consumer GPUs (e.g., RTX 4070), with quantized models enabling fast inference.
• Domain Adaptation: Specialized LLMs or in-context specialization can improve results for specific domains.
• Vocabulary Mismatch: When using different models for encoding/decoding, arithmetic coding can resolve vocabulary size mismatches.

  Figure 6: Initial tokens in stegotexts exhibit higher ranks, highlighting the importance of prompt length and specificity for sound generation.

Conclusion

The presented protocol enables efficient, full-capacity steganography in natural language using LLMs, with stegotexts indistinguishable from real texts by humans and plausible to LLMs. The method is practical, generalizable, and exposes fundamental issues in the attribution of intent, the definition of knowledge, and the security of LLM-based systems. The decoupling of text from authorial intent and the possibility of covert information transmission necessitate a reevaluation of trust in written communication and the development of robust safeguards in AI deployment. Future work may extend the protocol to other modalities and explore formal security guarantees.