Enter your secret message below and G-N Encoder will hide it in LLM slop. Topic allows you to choose what the slop is about and Key is a random seed for the encoding (think of it like a password required for decoding).
Encoding runs on a Hugging Face Space, because it needs the language model. The GPU time is billed to whoever runs it, not to us.
Hugging Face works out whose quota to use from your huggingface.co session. Browsers restrict cookies inside a cross-site frame, so in the box below it cannot see that session and falls back to a small pool shared by IP address — which may report that you are out of quota. To use your own allowance — 5 min/day on a free account, 40 min on PRO — open the encoder in a new tab, signed in to Hugging Face.
The local helper (server.js) is running, so
you can encode on this machine with your own model rather than the hosted
one. This block stays hidden when the helper is not reachable, which is why
the deployed site never shows it.
Message:
Topic:
Key:
Attempts
Output will stream here…
Encoded text:
Key:
Decoded message will appear here…
The first step of our encoding takes the secret message, converts it to a bistring, and then compresses it using unishox2.
From there, the secret message is encoded in the LLM text using the individual characters. Based on the key, we partition the set of all characters into three subsets. One set encodes a 0, another a 1, and the third encodes a skip. The partitioning is done using the frequency of different characters in English language text.
| English Letter Frequency (%) | |||||||
|---|---|---|---|---|---|---|---|
| E 12.70 |
T 9.06 |
A 8.17 |
O 7.51 |
I 6.97 |
N 6.75 |
S 6.33 |
H 6.09 |
| R 5.99 |
D 4.25 |
L 4.03 |
C 2.78 |
U 2.76 |
M 2.41 |
W 2.36 |
F 2.23 |
| G 2.02 |
Y 1.97 |
P 1.93 |
B 1.49 |
V 0.98 |
K 0.77 |
J 0.15 |
X 0.15 |
| Q 0.10 |
Z 0.07 |
||||||
The LLM generates text in response to the topic by creating a set of tokens and choosing the next most likely token. At each one of these inference steps, our algorithm removes any tokens that would encode an incorrect bit. What remains are the tokens that encode either the correct bit or a skip. Hyperparameters are available to prioritize encoding bits or penalize skips. Tuning these hyperparameters adjusts the tradeoff between encoding density and human indistinguishability.
When the LLM has finished encoding all the desired bits, it proceeds to generate text as normal, choosing the most likely tokens independant of our character partioning.
In the current literature, the security model for text steganography is a probability preserving encoding. Such an encoding should match the distribution of outputs of the LLM and should be indistinguishable even to other model holders. This encoding, however, requires access to the model's probability distribution to find differences in the biasing.
We propose a weaker target: we want to minimize the separability of the encoded outputs from LLM outputs produced under higher temperature, fine tuning, or other distortions of the model probability. This property is weaker but presents meaningful security against realistic adversaries. They should not be able to distinguish our steganographic text from text which is generated by some LLM under normal, innocuous model changes.
The current V0 prototype does not meet these properties well enough for us to recommend use in the most security-critical applications. However, our basic testing using a classifier trained on steganographic outputs (without using the model) is unable to distinguish the outputs from other model outputs. Presently, our output exhibits features that allow a model-equipped adversary to distinguish steganographic text from exactly the same model under a range of temperatures. Future work is planned to reduce this.
The model is expected to be strong against a heterogeneous corpus of real text, human-edited LLM outputs, and a wide range of LLM slop. It may be currently suitable for less security intensive applications, such as bypassing automated content moderation on platforms like Reddit or Instagram, or for applications where a detectable mix of human- and machine-generated text under targeted review may be acceptable.
For information on running our encoder locally, or to view our code, check out our repo.
We have used the mlx framework for running local LLM models and unishox2 for compression.
This project was a team effort built at the Community Privacy Residency.