Authors: Jiaxuan Wu and Zhengxian Wu and Yiming Xue and Juan Wen and Wanli Peng
Cite as: \cite{Wu_2024}
arXiv: https://arxiv.org/abs/2404.10229
Summary in three sentences
This paper proposes LLM-Stega, a black-box generative text steganography method that uses the user interface of an LLM instead of white-box access to model vocabularies or sampling probabilities. It encodes messages through optimized keyword sets and an encrypted mapping, then uses LLM prompts and rejection sampling to generate and extract stegotext. It is close to our black-box setting, but the goal is to build a secure covert communication method rather than measure spontaneous or prompt-induced model capability.
Main contribution
The main contribution is the first black-box LLM user-interface steganography pipeline described by the authors. It separates the steganographic mapping from the LLM generation process, avoiding the need to manipulate token sampling probabilities.
Key equations and definitions
- LLM-Stega: a four-part system with keyword construction, encrypted steganographic mapping, stegotext generation, and secret-message extraction.
- The mapping uses keyword repetition and release time with XOR:
- Embedding capacity is defined as:
where is embedded secret bits and is total words in generated steganographic text.
Empirical results
Section 4 uses GPT-4 UI with Entertainment News and science-fiction movie review themes. Table 2 reports embedding capacity: LLM-StegaEN reaches 5.93 bpw with average length 13.333, while LLM-StegaRSciM reaches 4.81 bpw with average length 16.419; the strongest listed baseline ADG reaches 5.63 bpw with average length 22.411. Table 4 reports that repeated optimization of embedding and extraction prompts reduces reject rate to 21.00% in the final prompt-optimization condition.
Relation to our project
- what we reuse: black-box UI framing, sender/receiver extraction through generated text, and the idea that LLMs can support steganography without logit access.
- what we dispute: the method gives Alice and Bob a designed keyword system and side information; our benchmark should distinguish supplied-protocol use from model-invented protocol use.
- what we must reproduce: at least one simple human-designed black-box channel as an upper or reference baseline, but not the full LLM-Stega system.
Criticism and limitations
The paper evaluates a deliberately engineered stegosystem, not whether models collude under ordinary deployment-like prompts. The scheme relies on shared side information such as keyword sets, private key mechanism, and release times. Its high capacity is useful background but should not be treated as evidence that unassisted LLM agents will naturally use comparable channels.