LLMs and Text-in-Text Steganography

Source: Schneier on Security

Comments

Privacy – May 11, 2026 8:07 AM

To hide text, try white text on a white background. The human eye won’t see it but the computer will. If you want to test (your machine) not in the wild, try the command line to reformat the hard drive.

Derek Jones – May 11, 2026 8:48 AM

One of my attempts to shroud human detectable meaning from LLMs was to make phonological changes to words. I was expecting word tokenizations to make it difficult for LLMs to decode sentences such as the following:

“phashyon es cycklyq. chuyldren donth wanth tew weywr chloths vat there pairent weywr. pwroggwrammyng languij phashyon hash phricksionz vat inycially inqloob impleementaision suppoort, lybrareyz (whych sloa doun adopsion, ant wunsh establysht jobz ol avaylable too suppourt ecksysting kowd (slowyng doun va demighz ov a langguij).”

In practice even small 4 billion‑parameter models handle these changes with ease.

Clive Robinson – May 11, 2026 9:45 AM

@ALL,

Neither the idea nor the general method are new. I’ve been talking about this off and on on this blog for quite some time.

The real issue is at what layer of language you are going to have the steganography work at. The higher the layer—in effect the more token length—the more coherent word‑for‑word the resulting stego‑text is, but the more it is going to read badly due to jumps in context or similar.

As for the paper, unless you are really keen, it is not well written thus…

Gheese – May 11, 2026 9:46 AM

@Privacy or as it happened with the Epstein files, try black font on black background. To be fair, that’s censorship, not steganography, but both have the same bypass.

Jonathan – May 11, 2026 10:08 AM

Almost a certainty that there’s a message encoded in that abstract, but you’d need to read the article to decode it.

taters – May 11, 2026 10:39 AM

To hide text, try white text on a white background.

And for TEMPEST you want a special font on a dark grey background. There was a piece of software for Windows which was an anti‑TEMPEST notepad but I forget the name of it.

% – May 11, 2026 11:10 AM

@taters,

It’s “Zero Emission Pad” that does anti‑TEMPEST font smoothing, but it still gets (key)logged if you have a keylogger on the system. It’s an old free program for Windows. If you find it, consider uploading it to archive.org unless they already have it. It was a rare piece of software which disappeared quite quickly from most of the web. I haven’t searched for it in years. I may have it on a backup somewhere.

r – May 11, 2026 2:57 PM

A slightly related tool available in Debian I noticed a couple weeks back:

snowdrop

It can watermark plaintext English; the C source code enabled branch is labeled experimental.