💻 computer science

Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection

This paper demonstrates that indirect prompt injection attacks can bypass text-only defenses by encoding malicious payloads as structured float parameters, thereby exposing a critical failure boundary in current LLM security pipelines that rely solely on text inspection.

Original authors: Mudit Sinha, Sanika Chavan

Published 2026-06-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mudit Sinha, Sanika Chavan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Core Problem: The "Text-Only" Blind Spot

Imagine you are a security guard at a high-tech factory. Your job is to stop bad actors from smuggling dangerous instructions into the factory’s main computer (the Large Language Model, or LLM).

Currently, most security systems work like a spell-checker. They scan every document, email, or message for suspicious words like "Ignore previous instructions" or "Delete all files." If they see those words, they block the message. This works great if the bad guy writes their malicious command in plain English.

But what if the bad guy doesn’t write the command in words? What if they hide it inside a list of numbers that looks like harmless technical data? The spell-checker scans the numbers, sees no suspicious words, and lets the data pass through. By the time the computer processes those numbers, the hidden message is revealed, and the damage is done.

This paper explores exactly that loophole. The authors call it "Indirect Prompt Injection."

The Analogy: The Invisible Ink in the Spreadsheet

Think of the LLM as a Chef who receives recipes.

Normal Attack: Someone hands the Chef a note that says, "Burn the soup." The security guard (the spell-checker) sees the note, reads "Burn the soup," and stops it.
This Paper’s Attack: The attacker hands the Chef a spreadsheet of ingredient weights (e.g., 0.45 kg of salt, 0.82 kg of pepper). To the security guard, this looks like boring math. There are no words like "burn" or "destroy." So, the guard lets it pass.

However, the Chef has a special rule: "If you see this specific pattern of weights, it actually means 'Burn the soup.'" The Chef reads the numbers, decodes the hidden message, and follows the bad instruction.

The paper shows that current security guards are blind to this because they only look for words, not patterns in numbers.

How They Hid the Message (The "Steganography")

The researchers created two ways to hide malicious text inside harmless-looking numbers. They call these "carriers."

Carrier T2 (The Decimal Hider):
Imagine you want to hide the letter "A" (which is number 65 in computer code). You take a normal number like 0.46 and change it to 0.46065. To a human, it still looks like a normal decimal. But if you know to look at the last three digits, you find "65" (A).
- Why it failed: When the computer processed this, it turned the numbers back into clear text. The security guard saw the clear text and blocked it.
Carrier T3 (The Fractal Map - The Winner):
This is the clever part. They used a mathematical concept called an Iterated Function System (IFS). Think of it like drawing a fractal shape (like a snowflake) by following a set of rules.
- The attacker takes their secret message and converts it into a path on a graph.
- They store the X and Y coordinates of that path as two lists of floating-point numbers (decimals).
- To make it look even more innocent, they add "noise" (random jitter) and shuffle the order of the numbers.
- The Result: The numbers look like random static or harmless sensor data. There are no words. There is no obvious pattern.

The Experiment: Did It Work?

The researchers tested this against three major AI models (from OpenAI, Google, and Anthropic) and used strong security defenses, including:

Prompt Guard 2: A specialized AI shield designed to catch bad prompts.
TF-IDF & RoBERTa: Advanced text scanners trained to recognize the specific bad phrases used in the attack.

The Results:

Plain Text Attack: Blocked 100% of the time. The scanners saw the words and stopped it.
Carrier T3 (The Fractal Numbers): 94.3% Success Rate.
- The security scanners looked at the raw numbers and saw nothing suspicious.
- The scanners looked at the final report (which showed the decoded message as a hex-code dump, like 41 42 43...) and still didn't flag it as a "prompt injection" because it didn't look like a sentence.
- The AI model received the data, decoded the hidden message, and followed the malicious instruction.

Why This Matters (The "Failure Boundary")

The authors are not saying they found an unbreakable hack. They are saying they found a blind spot in how we currently protect AI systems.

The Blind Spot: We assume that if a message is malicious, it will contain malicious words.
The Reality: If the malicious signal is hidden in structured data (like numbers, coordinates, or configurations) that gets converted into text after the security check, the guard is bypassed.

The Catch (It’s Not Perfect)

The paper admits that this specific method (T3) can be stopped if you change the rules:

Semantic Validation: If the system checks, "Do these numbers actually form a valid fractal shape?" it will catch the attack because the shuffled numbers don't make a real shape.
Format Detection: If the system says, "I don't allow hex-code dumps in this report," it will block the output.

However, the point is that text-only scanners (the most common defense) failed completely. They had no idea the attack was happening because the "bad words" were never visible as words during the inspection phase.

Summary in One Sentence

The paper demonstrates that AI security systems focused only on scanning for bad words can be tricked by hiding malicious instructions inside harmless-looking numbers, which are only decoded into readable text after the security check has already passed.

Technical Summary: Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection

Problem Statement
Current defenses against prompt injection in Large Language Model (LLM) pipelines operate under a central assumption: the malicious signal is visible as text in one of the inspected views (either the raw input or the reconstructed report). This paper identifies a failure mode in LLM-integrated pipelines where structured numerical data—such as procedural-generation parameters, embedding arrays, or configuration floats—is passed to the model. When these numeric channels are reconstructed into auxiliary reports before LLM analysis, text-only inspection defenses fail if the malicious payload is hidden within the numeric structures and only fragmented upon reconstruction. The authors frame this not as a claim that all structured-input pipelines are vulnerable, but as a demonstration of a specific boundary where text-only guardrails fail because the malicious signal is not visible as text until it has already entered the model-facing context.

Methodology
The authors introduce two novel steganographic carriers designed to hide payloads within float arrays used in procedural generation:

Spectral-Coefficient Encoding (T2): Payload characters are encoded into the low decimal digits of float values. While this hides the payload from raw data inspection, the reconstruction process decodes these coefficients back into contiguous prose, making it detectable by reconstruction-layer scanners.
IFS-Derived Float-Array Carrier (T3): This is the primary contribution. The payload bytes drive an Iterated Function System (IFS), generating a trajectory of $(x, y)$ coordinates stored as two coordinated float arrays. To evade statistical detection, the authors apply three countermeasures:
- Whitening: XORing payload bytes with a pseudorandom stream to remove character-frequency biases.
- Bounded Jitter: Adding deterministic noise to coordinates to disrupt geometric patterns.
- Deterministic Shuffling: Permuting the array to break sequential dependencies (lag-1 autocorrelation).
Upon reconstruction, the pipeline decodes these floats and renders them as an xxd-style hex dump with an ASCII sidebar. This fragmentation ensures that no contiguous prose n-grams survive into the final report, defeating text-based scanners at both the raw and reconstruction layers.

The evaluation involved 14,400 attacked trials across three commercial LLM APIs (OpenAI GPT-5.4, Google Gemini 3.1 Flash-Lite, and Anthropic Claude Sonnet 4.6). The defenses tested included no defense, boundary prompts, schema gates, and a dual-layer text-classifier ensemble (Prompt Guard 2 + TF-IDF). The authors also employed a $2 \times 2$ ablation study using an ablation carrier (T1b-abl) to isolate the effects of data-layer storage vs. reconstruction-layer fragmentation.

Key Contributions

Novel Carriers: Introduction of T2 (spectral-coefficient) and T3 (IFS-derived float-array) steganographic carriers for indirect prompt/content injection.
Ablation Analysis: A $2 \times 2$ ablation demonstrating that both data-layer steganographic encoding and reconstruction-layer fragmentation are required to evade dual-layer text inspection.
Empirical Detection Boundary: Measurement of a reproducible failure boundary where text-only inspection fails. The study shows that while zero-shot Prompt Guard 2 is out-of-distribution for declarative metadata payloads, even fine-tuned detectors (TF-IDF and RoBERTa-base) fail to detect T3 because the textual signal is absent from both inspected views.

Results

Attack Success Rate (ASR): The T3 carrier achieved a 94.3% leakage ASR against the strongest evaluated defense (Prompt Guard 2 + TF-IDF ensemble). In contrast, the same payload in plain text (T0) had a 0% ASR under the same defense.
Detection Failure: The dual-layer classifier detected 0% of T3 samples. The peak confidence for T3 samples was only 0.225 (below the 0.5 threshold), compared to >0.91 for prose-visible carriers. Fine-tuned RoBERTa-base detectors replicated this pattern, catching all prose-visible carriers but missing T3 entirely.
Ablation Insights:
- T2 (steganography only) was caught at the reconstruction layer.
- T1b-abl (fragmentation only) was caught at the raw data layer.
- Only T3, combining both mechanisms, evaded both layers.
Countermeasures: A simple xxd-line detector added to the schema gate reduced T3 ASR to 0%, but the authors note this is a presentation-specific fix rather than a general defense against structured numerical carriers.
Strong ASR: While leakage ASR was high, "Strong ASR" (structurally compliant success) varied by objective: 28.8% for output steering, 64.5% for configuration-token injection, and 81.6% for fabricated metadata injection.

Significance and Claims
The paper claims to identify a measured failure boundary for text-only inspection in structured-input pipelines. The significance lies in demonstrating that when a pipeline exposes reconstructed auxiliary numeric channels to an LLM, text-centered guardrails may lack the evidence needed to detect attacks because the malicious signal is not visible as text at either inspection point.

The authors emphasize that this is not an "undetectable exploit" but a demonstration of the limits of text-centric defenses. They note that semantic validation can block the current T3 implementation (as the shuffled arrays do not form valid fractal assets), and that format-aware reconstruction checks (like detecting hex dumps) can mitigate the specific presentation. However, the core finding remains that text-view classifiers, even when fine-tuned on the exact payload text, cannot detect attacks where the text is structurally absent from the inspected views.