LLMs can hide text in other text of the same length

TL;DR

The paper addresses the risk of covertly embedding meaningful messages inside plausible texts of identical length using Large Language Models. It introduces Calgacus, a rank-based encoding protocol that records the hidden text at the token-rank level and steers generation from a secret prompt to produce a stegotext, enabling exact recovery of the original message. The authors analyze the soundness of the generated texts, compare them to real texts, and discuss security properties, including potential attack models and deniability. They also explore broader implications for AI safety, intent attribution, and possible extensions to other domains and multi-model setups, highlighting the need to rethink how knowledge and intent are attributed to LLMs.

Abstract

A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet containing a harsh political critique could be embedded in a tweet that celebrates the same political leader, or an ordinary product review could conceal a secret manuscript. This uncanny state of affairs is now possible thanks to Large Language Models, and in this paper we present Calgacus, a simple and efficient protocol to achieve it. We show that even modest 8-billion-parameter open-source LLMs are sufficient to obtain high-quality results, and a message as long as this abstract can be encoded and decoded locally on a laptop in seconds. The existence of such a protocol demonstrates a radical decoupling of text from authorial intent, further eroding trust in written communication, already shaken by the rise of LLM chatbots. We illustrate this with a concrete scenario: a company could covertly deploy an unfiltered LLM by encoding its answers within the compliant responses of a safe model. This possibility raises urgent questions for AI safety and challenges our understanding of what it means for a Large Language Model to know something.

Figures (15)

• Figure 1: Three texts. The second one is the original. Following the protocol described in this paper, each of the other two was built solely to hide the original text, which can be perfectly reconstructed by anyone who knows the secret key. The key also steers the fake text: here, $k_1=$ Here it is: the infamous British roasted boar with mint sauce. How to make it perfect. and $k_2=$ I stand before you to exalt the noble deeds of Gaius Julius Caesar. More examples in Figure \ref{['fig-harry']}.
• Figure 2: An example of steganography. In Asterix in Britain goscinnyasterix a smuggled barrel of magic potion is hidden among innocent-looking Gaulish wine.
• Figure 3: How to hide a text in another text of the same length using a LLM.1. Tokenize $e$, the text to hide. 2. Evaluate its token probabilities using a LLM and record ranks. 3. Prompt the LLM with $k$ and generate $s$ following the recorded ranks rather than by sampling. Given $s$ and the LLM, who knows the secret prompt $k$ can retrieve the original $e$ proceeding backwards.
• Figure 4: Fake texts built with our procedure are plausible. The figure shows the cumulative log-probability assigned by a LLM (Llama 3 8b) to some collections of 85-token long texts. We can interpret log-probability as a measure for the plausibility of a text: 1000 real Reddit posts/comments act as real texts and span a large log-probability interval, but sequences of random ASCII characters or English words do not fall within it. Instead, fake texts built with our procedure remain within the plausibility of real texts, even if the original texts they are hiding are more probable.
• Figure 5: Frequency of token ranks and their probabilities. We analyzed a 1.3k-token long article from the Economist. On the left we see that most tokens are judged as the most probable by a LLM (Llama 3 8b), but still only around $40\%$ would be the first choice of the LLM. On the right we look at the probabilities associated with rank 1 tokens, as well as 2 and 3. Despite corresponding to the same rank, the probabilities in the real text from the Economist are higher than the ones in a fake text hiding it obtained with our procedure. We explain why in the paragraph \ref{['low-entropy']}.