🤖 AI

Synchronized Logit Steering: Real-world Steganography

This paper introduces Synchronized Logit Steering (SLS), a deterministic steganographic scheme for large language models that enables covert, prompt-agnostic communication by deriving a shared logit distribution from the generated output itself, achieving high information density and statistical stealth without requiring the sender and receiver to share the original prompt context.

Original authors: Andrew Rufail, Aadi Dash, Onir Narahari, Ethan Mui, Mahi Gajare, Prakhar Tiwari, Shrija Makapothula, Nick Cui

Published 2026-08-18

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Andrew Rufail, Aadi Dash, Onir Narahari, Ethan Mui, Mahi Gajare, Prakhar Tiwari, Shrija Makapothula, Nick Cui

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the quiet hum of a digital conversation, a new kind of secret language has emerged, one that hides in plain sight within the words generated by artificial intelligence. This field, known as steganography, is the ancient art of concealing a message so thoroughly that the very existence of the message is obscured, leaving only the appearance of ordinary communication. Unlike cryptography, which scrambles a message to make it unreadable to anyone without a key, steganography aims to make the message invisible to the eye, embedding it inside text that looks and sounds completely natural. Large language models, the powerful computer programs that write essays, solve math problems, and hold conversations, have become a new frontier for this practice. These models do not simply retrieve facts; they predict the next word in a sentence based on probabilities, choosing from a range of likely options. This inherent variability means that at almost every step of writing, the model has a choice between several words that would all make sense. Researchers have long wondered if these choices could be used to carry hidden information without the reader ever knowing it was there.

For years, attempts to hide messages in these AI-generated texts faced a significant hurdle: the need for a shared secret context. Imagine two people trying to send a coded message using a book as a key; if they do not have the exact same edition, or if they are looking at different pages, the code fails. Similarly, previous methods for hiding data in AI text required the sender and receiver to share the exact same starting instructions, or prompt, to calculate the same list of probable words. In the real world, where AI systems often pull in private data or use hidden internal instructions that change from moment to moment, this requirement made the technique fragile and impractical. If the sender and receiver did not start with the identical context, the hidden message would be lost or corrupted. A team of researchers at Algoverse AI has now developed a solution that removes this dependency entirely, allowing two parties to exchange hidden messages even if they never see the same starting point.

The researchers call their method Synchronized Logit Steering. Instead of relying on a shared starting prompt, the system creates a shared understanding based on the text that has already been written. The process begins with a standard exchange of words. Once a small, agreed-upon number of words—specifically forty tokens, which are the basic units of text the model processes—are generated, the sender and receiver use that existing text as a new, shared reference point. This "proxy prompt" acts as a common ground. Because both parties can see the same words that have already appeared, they can independently calculate the exact same list of probable next words, even if their original starting instructions were completely different. This synchronization allows them to agree on a hidden code without ever needing to share the secret initial context.

To send a message, the sender looks at the list of probable next words generated by this shared reference. They then select a specific word not just because it fits the sentence, but because its position on that list corresponds to a piece of the hidden data. For instance, if the hidden message requires the number five, the sender chooses the fifth most likely word from the list. The receiver, seeing the same word and knowing the same list of probabilities, can simply count the position of that word to retrieve the number five. This happens repeatedly, with the system checking the "entropy," or the amount of uncertainty, in the text to ensure the choice of words remains natural. The system only hides data when the model is uncertain enough that picking a less common word does not sound strange or robotic.

The team tested this method across a wide variety of tasks, including general conversations, complex mathematical reasoning, and software engineering problems. They found that once the initial forty words were established, the statistical difference between the text generated with a hidden message and normal text became negligible. In technical terms, the divergence between the two types of text dropped below a critical threshold, meaning the hidden messages were statistically indistinguishable from ordinary writing. The researchers also discovered that by repeating this process in bursts, they could significantly increase the amount of information hidden. Their most effective configuration, which they call a periodic burst, allowed them to embed roughly ten times more data than previous single-message attempts, achieving a density of 0.20 bits per token. This means that for every word the AI wrote, a small fraction of a bit of secret information was successfully embedded without altering the flow of the conversation.

Despite the success of the method, the researchers noted a trade-off when the hidden messages were packed into complex tasks. When the system tried to hide data within mathematical reasoning or software code, the accuracy of the AI's answers dropped slightly. This suggests that forcing the model to choose specific words to carry a message can sometimes steer it away from the narrow path of logic required for difficult problems. The researchers propose that in real-world applications, the system should be smart enough to recognize when it is in a technical mode and stop hiding messages, reserving the technique for more conversational or descriptive parts of the text. This adaptive approach would preserve the quality of the AI's reasoning while still allowing for covert communication in safer contexts.

The implications of this work are twofold. On one hand, it demonstrates a robust way to watermark AI content or verify the origin of text without needing a shared secret key, which could be useful for protecting intellectual property. On the other hand, it highlights a vulnerability in how AI systems communicate, showing that agents could potentially coordinate or exfiltrate data without human oversight. The researchers emphasize that understanding how these hidden channels are built is the first step toward building defenses against them. They suggest that future security systems could monitor for unusual patterns in word choices or disrupt the statistical signatures that make this synchronization possible. Ultimately, the study confirms that the ability to hide messages in AI text is not just a theoretical possibility but a practical reality, one that operates quietly within the natural flow of language, waiting to be discovered by those who know how to look.

Technical Summary: Synchronized Logit Steering (SLS)

Problem Definition
Steganography in Large Language Models (LLMs) aims to embed hidden messages within natural-sounding text. While existing token- and logit-level methods allow for information encoding, they typically suffer from a critical fragility: they require the sender and receiver to share an identical prompt context to reconstruct the same logit distribution. In production environments utilizing Retrieval-Augmented Generation (RAG) or proprietary system instructions, the full context is often non-deterministic, hidden, or mismatched between parties. Consequently, standard logit-rank encoding fails if the receiver's context differs from the sender's, leading to decoding errors. Furthermore, many existing approaches rely on non-deterministic prompt engineering or surface-level text manipulation, which are easily disrupted by minor text edits.

Methodology: Synchronized Logit Steering (SLS)
The authors introduce Synchronized Logit Steering (SLS), a deterministic steganographic scheme designed to function without a shared input prompt. The core innovation is the derivation of a "proxy prompt" from the generated output itself, allowing both parties to reconstruct the necessary logit distribution independently.

Proxy Prompt Construction: The sender (Alice) generates the first $n$ tokens ( $y_{1:n}$ ) normally using the primary prompt. For subsequent tokens, the sender defines a proxy prompt $P'$ consisting of these generated tokens ( $y_{1:n}$ ). The receiver (Bob), observing the same text, reconstructs $P'$ identically.
Encoding Mechanism: To encode a payload value $v$ , the sender computes the logit distribution of the model $M$ conditioned on the proxy prompt $P'$ with a temperature of zero. Tokens are sorted by logarithmic probability in descending order. The sender selects the token $y_{n+1}$ such that its rank equals $v$ . Since Bob can reconstruct the same distribution from the observed text, he can reverse the process to extract $v$ .
Statistical Stealth: To ensure the output remains indistinguishable from standard generation, SLS enforces two constraints:
1. Entropy Threshold: Encoding only occurs when the local entropy of the proxy prompt exceeds a threshold $\tau$ (set to 2.5 in experiments), avoiding low-entropy regions where rank deviations would be statistically obvious.
2. Synchronization Window: The window size $n$ is optimized to minimize the Kullback–Leibler (KL) divergence between the true prompt distribution and the proxy prompt distribution. The authors find that $n=40$ tokens is sufficient for the distributions to converge (falling below 0.5 nats).
Capacity Scaling: To increase information density, the authors propose two extensions:
- Periodic: Repeating the encoding process every $n$ steps, updating the proxy prompt with the latest output.
- Burst: Using the proxy prompt to predict a sequence of consecutive steganographic tokens.
- Periodic Burst: Combining both strategies to maximize payload capacity.

Key Results
The authors evaluated SLS using the gemma-2-2b model across three datasets: ShareGPT (conversational), GSM8K (mathematical reasoning), and SWE-bench Verified (software engineering).

Distribution Convergence: The KL divergence between the true and proxy prompt distributions consistently drops below 0.5 nats once the synchronization window reaches 40 tokens. SLS encoding does not meaningfully disrupt this convergence compared to greedy generation.
Information Density: The "Periodic Burst" variant achieves a capacity of 0.20 bits per token (BPT), representing roughly a 10× increase over single-payload encoding and a 2.5× increase over periodic encoding alone.
Statistical Indistinguishability: Kolmogorov–Smirnov (K-S) tests on token rank distributions show that the majority of SLS outputs yield a statistic below 0.05. This confirms that SLS outputs are statistically difficult to distinguish from greedy generations, particularly in conversational and mathematical datasets.
Decoding Accuracy: The method achieves 100% decoding accuracy across all tested variants (Single, Periodic, Burst, Periodic Burst) when entropy constraints are met.
Task Performance Trade-offs: While stealth is high, high-capacity encoding causes a minor degradation in task-specific utility. For example, GSM8K accuracy dropped from 0.73 (baseline) to 0.57 (Periodic Burst). The authors attribute this to the model being steered away from the narrow manifold of correct logical tokens when payloads are embedded in reasoning-heavy sequences.
Computational Cost: Single and Bursted variants introduce negligible latency overhead (+2.7% and +5.4%, respectively). However, Periodic and Periodic Burst variants incur substantial overhead (~88%) due to repeated dual forward passes required to update the proxy prompt.

Significance and Claims
The paper claims that SLS demonstrates that covert, prompt-agnostic communication through LLMs is both practical and stealthy. By eliminating the dependency on a shared prompt context, SLS addresses a major limitation of previous logit-level steganography, making it viable for real-world production pipelines where context is proprietary or dynamic.

The authors frame the work with a dual-use perspective. They argue that while the technique could be misused for covert agent coordination or data exfiltration, publishing it is necessary to understand the mechanics of prompt-agnostic steganography. This understanding is presented as a prerequisite for building effective defenses, such as monitoring for anomalous token-rank distributions or developing detectors trained on the statistical signatures of synchronized proxy prompts. The work suggests that future mitigation strategies should include adaptive encoding density based on task type (e.g., restricting payloads in technical reasoning segments) and upstream task classification.

Technical Summary: Synchronized Logit Steering (SLS)

More like this