Hidden messages survive mismatched language models
STEALTH: Steganographic Text Encoding Agnostic to Low-Level Tensor Hardware · arXiv:2611.16928
In plain words
Stealth is a way to hide a message inside text written by a language model. The sender chooses words using a secret key, while the receiver reads the text with their own model and uses clues spread across many words to recover the message.
The receiver does not need to calculate exactly what the sender calculated. In tests, receivers from different model families recovered every tested message when given the whole text stream; they sometimes needed more text than the sender’s own check would provide.
The research
A hidden message may fail if sender and receiver models calculate word probabilities differently. Stealth changes the expectation that both sides must reproduce the same calculations, but the sender’s own stopping point may not give a more different receiver enough text to recover the message.
Stealth is a linguistic steganography method that spreads message evidence across generated text so receivers can recover it despite differences in model calculations.
The sender uses keyed noise to choose words, while a rateless code spreads message evidence across positions so a receiver can recover it despite some differing word choices. Tests found complete recovery for the tested same-family configurations given enough text, and for cross-family receivers given the whole stream.
This supports recovery under the tested mismatches, with the stopping point as an important qualification.
Cross-family receivers decoded every tested message when given the whole stream, but at the sender’s own stopping point they decoded only 12.5–90.5%. Tests covered three model families, two GPU architectures and comments on news articles.
What the evidence shows
- The mismatch problem
Stealth is a linguistic steganography method for hiding a message in language-model text and recovering it with a receiver whose computations or model may differ.
The central question is whether message recovery can survive those differences, which often break earlier methods that rely on exact agreement between sender and receiver calculations.
- Exact replay is fragile
In tests using three model families and comments on the same news articles, arithmetic coding decoded 100% of messages with exact replay, but none under the listed arithmetic-coding mismatches. Discop also decoded 100% with exact replay; under mismatches it decoded at most 1.5% with teacher forcing and none in the other listed configurations. The comparison shows that exact replay can be a brittle requirement.
- A different recovery design
Stealth makes a receiver’s disagreement with the sender local to a word position, then gathers evidence across positions to recover the message.
That design changes the comparison: rather than requiring the receiver to reproduce every sender calculation, it aims to tolerate some mismatches while recovering the hidden payload from enough text.
- Recovery across receivers
For each tested same-family receiver configuration, Stealth recovered all 200 messages when given enough text, including when decoding text across the two tested GPU architectures. Byte-keyed noise extended the test to different model families: those receivers also recovered every message when given the whole stream.
These are results for the configurations and text tested, not a guarantee for all models or settings.
- Enough text still matters
The practical boundary is how much text the receiver gets. A sender’s own stopping check did not reliably signal when a different-family receiver had enough evidence: at that point, cross-family recovery ranged from 12.5% to 90.5%, compared with complete recovery when the whole stream was available.
A separate proof addresses whether the text resembles ordinary model output, under stated assumptions and stopping conditions.
Deep
- Original paper authors
- William Fleshman
- Submitted to arXiv
- License
- CC BY 4.0