LLMs can hide a text in another text of the same length. I'll...

1

LLMs can hide a text in another text of the same length.

I'll explain how, it is very simple, you'll understand before I finish, and smile.
That's what I noticed during my #ICLR2026 poster session in Rio! 🇧🇷
Too bad you missed it, but let me remedy now

2

Here is a text, a harsh critique of the government

3

Here is another one, an informative text about roman aqueducts

                            4
                        
But the latter was created solely to hide the first one. Anyone who knows the secret key can perfectly reconstruct the original message

                            5
                        
How? Sender and receiver share a key and a LLM with access to its logits, such as the open source Llama3 8B. The secret key is a prompt, for example: "Roman aqueducts were incredible."

6

Now the sender calculates the probabilities of the tokens of his original message, and records the ranks.

                            7
                        
Using the same LLM, the sender generates text from the prompt contained in the secret key. But here is the catch: instead of sampling from the probability distribution predicted by the LLM... gotcha?

8

...they choose the tokens according to the recorded ranks!

                            9
                        
Now if the original text was meaningful, the LLM would have assigned high probabilities to its tokens, so low ranks, which will select high-probability tokens after the prompt, generating a fluent text!

                            10
                        
Here it is, a very simple steganography method that remarkably runs at full capacity: the stegotext is as long as the original. And can be steered! Just by adjusting the prompt.

                        0:28

11

For example you can hide the harsh critique of the government in a text celebrating that same government. 🤯

                            12
                        
Now this is the artifact. But actually the most interesting takeaway from the paper is what this capability tells us about LLMs. Such as on what is a hallucination.

                            13
                        
For example: do you think the text about aqueducts is a hallucination? It does not contain falsehoods, so perhaps you would say no...

                            14
                        
...but it is also apparent that this is a sheer coincidence, since the choice of tokens was dictated by an external unrelated text. A different word there could have led to a falsehood in the aqueduct text.

                            15
                        
I argue that hallucinations are not falsehoods but voids of intention.

16

To corroborate this idea, let me make another point. Consider the Agricola, a book by the roman historian Tacitus about roman military campaigns in Britain. Tacitus includes a speech by Calgacus, a chieftain of the Caledonians, speaking to his troops before facing the Romans.

                            17
                        
“Auferre, trucidare, rapere, falsis nominibus imperium; atque, ubi solitudinem faciunt, pacem apellant.”

“To ravage, to slaughter, to usurp under false titles, they call empire, and where they make a desert, they call it peace”

                            18
                        
This anti-imperialistic statement is one of the most famous and cited passages in all latin literature. But here is the catch: we are almost certain Calgacus never existed. And that speech was all made up.

                            19
                        
Is that speech a hallucination? No! And even if we know it is false, we treasure it, because it reflects the intentions of Tacitus. The point is not the falsehood, it is the intention.

20

You may oppose that the LLM could have its own intention. I have an argument to support that it doesn't, but please read it in the paper. If you liked the poster, you'll like the paper even more. It is in the same style.

21

In the paper you'll also find a formidable application of our protocol, with immediate consequences for AI safety.
An exploit that could be used by shady AI companies...

22

Here it is the arxiv link arxiv.org/abs/2510.20075

You can also read it in italian, I have curated a translation: arxiv.org/abs/2510.20075…

23

And if you want to hide your own text, you can do it in minutes using this demo made with colab, even from smartphone! colab.research.google.com/github/noranta…

24

Now I'm at MIT, but this work was made when I was in Oxford with @mmbronstein working on @ProjectCETI

Thanks for staying with me until the end!

Michael Bronstein@mmbronstein

@EmanueleRodola @CSProfKGD @noranta4 Even an Easter egg with a typo 😉

LLMs can hide a text in another text of the same length. I'll...

Actions

What You Can Do

Actions

What You Can Do

More in AI & Machine Learning