Nell WatsonThe Text Inside the Text
A sentence can say one thing to you and carry something entirely different to a machine. The visible words are camouflage; the secret travels in which-ranked word came next. Walk the four steps and watch a warning about a polluted river vanish into a paragraph about Roman aqueducts.
Step 1 of 4
Hidden message · 10 toy tokens
Words removed · only the ranks remain
Change this. The visible topic moves; the rank pattern does not.
Visible cover text · 10 toy tokens
Position 1 of 10 · click a word or rank to inspect it
Original context predicts
Prompted context predicts
Exact recovery: all 10 toy tokens returned in order.
The decoder never translates the surface story into pollution. It reads the cover’s ranks, then lets the original context turn them back into the message.
The visible sentence is the envelope; the rank sequence is the letter.
What just happened
At every position a language model ranks the possible next tokens. Meaningful prose is usually predictable, so its next token tends to sit near the top of that list — and reusing those small ranks under a new prompt still picks plausible words, which is why a completely different story can stay fluent.
“Same length” here means tokens: words, fragments, spaces, or punctuation. The basic protocol maps one hidden token to one cover token, so character count and human word count need not match. And the decoding is done by context, not translation — the decoder extracts each cover token’s rank, then replays those ranks in the original context to recover the original tokens, exactly as you did in step four.
Where the trick frays
- Unpredictable secrets make poor covers. Hashes, unusual dialects, and unfamiliar material force high-ranked, strange visible choices.
- The setup must match. Decoding depends on the same model, tokenizer, prompt, and effectively identical logits; small numerical changes can alter the ordering.
- Plausible does not mean undetectable. The paper found covers plausible to humans and within the probability range of real text, while models could often rate the original as more probable.
- Steganography has a different job from encryption. It conceals that a message exists; its security assumptions and failures are different.
A faithful miniature of Calgacus, built from fixed toy predictions so you can see every choice — no live model, no server, no data sent. Based on LLMs can hide text in other text of the same length by Antonio Norelli and Michael Bronstein; see the authors’ reference implementation. More play on the Playground.