Steganography Without Modification: Hidden Communication via LLM Seeds

A newly disclosed steganographic channel allows hidden communication through widely deployed Large Language Model inference stacks without altering model weights, sampling code, or output distributions, according to research posted to arXiv on June 8, 2026 [1]. The technique exploits a structural property of deterministic decoding: the pseudo-random number generators used in inverse-transform sampling produce a seed-dependent sequence of token-level probability intervals that can be reconstructed from the generated text alone [1]. A sender encodes a secret message in the PRNG seed before generation; a receiver reconstructs the intervals and recovers the seed, and thus the hidden payload, by exhaustive search over the seed space [1]. The researchers formalize two operational modes. In the known-prompt setting, sender and receiver share the prompt, enabling exact interval reconstruction and perfect seed recovery via forced alignment [1]. In the unknown-prompt setting, only the generated text is available; approximate interval reconstruction combined with a maximum-hit-count scoring strategy still permits reliable recovery from sufficiently long outputs [1]. Experiments across six model families and five heterogeneous text domains show that, in the known-prompt setting, full 32-bit seed recovery from the complete 2^32 candidate space achieves up to 100% accuracy, depending on model and text domain, within 300 tokens and under 35 seconds on a single GPU [1]. In the unknown-prompt setting, recovery reaches near-perfect accuracy at 600-800 tokens in about 12 seconds [1]. The paper further analyzes the influence of prompting strategies, tokenization ambiguities, and sampling hyperparameters on channel reliability [1]. The authors note that the method allows for the steganographic transmission of 32 bits, but also demonstrates that ignorance of the prompt is not a valid security assumption [1]. Large language models are neural networks trained on vast amounts of text for natural language processing tasks, especially language generation, and are a foundational technology behind modern chatbots [8]. The arXiv repository where the paper appeared is an open-access repository of electronic preprints and postprints approved for posting after moderation, but not peer reviewed, and has been in operation since August 14, 1991 [6]. As of November 2024, the submission rate to arXiv was about 24,000 articles per month [6].