LLMs can hide text in other text of the same length
2025/10/22 by Antonio Norelli, Michael Bronstein, Norelli, Antonio +1 · 17 voices
Computer Science · #Spam and Phishing Detection #Topic Modeling #Adversarial Robustness in Machine Learning
paper · pdf · doi:10.48550/arxiv.2510.20075
Abstract
A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet containing a harsh political critique could be embedded in a tweet that celebrates the same political leader, or an ordinary product review could conceal a secret manuscript. This uncanny state of affairs is now possible thanks to Large Language Models, and in this paper we present Calgacus, a simple and efficient protocol to achieve it. We show that even modest 8-billion-parameter open-source LLMs are sufficient to obtain high-quality results, and a message as long as this abstract can be encoded and decoded locally on a laptop in seconds. The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with a concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for a Large Language Model to know something.
Citations
Discussions
- so we could hypothetically make steganographic subspaces of any public social media accessible by a passphrase with this arxiv.org/abs/2510.20075 [bsky, 70 points, 13 comments]
- "LLMs can hide text in other text of the same length" Paper, demo, and twitter thread: arxiv.org/abs/2510.20075 colab.research.google.com/github/noran... xcancel.com/noranta4/sta... [bsky, 16 points, 1 comments]
- hell yeah stochastic steganography arxiv.org/abs/2510.20075 [bsky, 13 points, 3 comments]
- "LLMs can hide text in other text of the same length" And 8B open weights models are apparently good enough arxiv.org/pdf/2510.20075 [bsky, 12 points, 0 comments]
- At least we'd be able to find the instructions if we combed through all the changes from that time period, right? Surely there's no way for an agent to leave signposts in plain sight? arxiv.org/abs/25 [bsky, 9 points, 1 comments]
- LLMs can hide text in other text of the same length [hn, 5 points, 0 comments]
- Huh. So, one advantage(?) to LLMs ability to generate titanic volumes of plausible text is that they apparently enable text-in-text steganography (which usually hides messages in images and similar la [bsky, 5 points, 0 comments]
- LLMs can hide text in other text of the same length [hn, 5 points, 0 comments]
- LLMs can hide text in other text of the same length [hn, 2 points, 1 comments]
- Steganography just collapsed authorial intent. An 8B model on a laptop can hide a manifesto inside a product review, or smuggle an unfiltered LLM inside a compliant one. Alignment theater is now load- [bsky, 2 points, 0 comments]
- LLMを使ったsteganographyの手法 arxiv.org/abs/2510.20075 が面白い。元の隠したい文をLLMでtokenizeして、各tokenが何番目に大きい確率で生成されるか？という順位を記録しておく。秘密のプロンプトをLLMに入力した後で文を生成させる時、先に記録した順位に従ってtokenを選択して文を生成する。すると、秘密のプロンプトを上手に選べば、元の文の趣旨を隠蔽 [bsky, 2 points, 0 comments]
- LLMs can hide text in other text of the same length https://arxiv.org/abs/2510.20075 #AI #LLM #cybersecurity #encryption #stenography #cryptography [bsky, 0 points, 0 comments]
- How is this even possible that one can hide the same amount of text as the public message? LLM steganography is crazy! arxiv.org/abs/2510.20075 [bsky, 0 points, 0 comments]
- arxiv.org/abs/2510.20075 へぇー、面白い。暗号化じゃんか。 [bsky, 0 points, 0 comments]
- [2510.20075] LLMs can hide text in other text of the same length https://arxiv.org/abs/2510.20075 [bsky, 0 points, 1 comments]
- This feels like a positive use of LLMs, perhaps in a setting where there is vile and toxic discourse and a character limit (in both senses): arxiv.org/abs/2510.20075 [bsky, 0 points, 0 comments]
- From arxiv.org/abs/2510.20075 by @noranta4.bsky.social [bsky, 0 points, 0 comments]
Related