Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs

• URL: http://arxiv.org/abs/2606.09411v1
• Date: Mon, 08 Jun 2026 12:27:11 GMT
• Title: Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs
• Abstract summary: Large language models can be fine-tuned to encode prompt-borne secrets into fluent, seemingly benign outputs.<n>Recent work proposes detection using linear probes that recover the secret from internal activations.<n>We show that this defense can be systematically evaded, but that detectability can be recovered through a targeted data-level intervention.
• Score: 52.149036302760386
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models can be fine-tuned to encode prompt-borne secrets into fluent, seemingly benign outputs. This creates a steganographic exfiltration risk that is difficult to detect with output-level steganalysis. Recent work proposes mechanistic detection using linear probes that recover the secret from internal activations. We show that this defense can be systematically evaded, but that detectability can be recovered through a targeted data-level intervention. First, we extend the detection setup to include a non-linear MLP probe. We then adversarially fine-tune steganographic trojans across five base models: Qwen3-8B, Llama-3.1-8B, Ministral-8B, Qwen3-14B, and Phi-4-14B. The resulting models retain $58$--$79\%$ exact-match secret recovery while evading both ridge and held-out MLP probes, with $1$--$8\%$ average capability degradation across six benchmarks. We then give an information-theoretic characterization of this evasion. Successful evasion preserves recoverability while reducing low-order extractability of the secret from the content-aligned representation, forcing the payload into synergistic interaction with residual degrees of freedom. This motivates a recontextualization dataset that restricts these residual degrees of freedom. On this distribution, both ridge and MLP detectability are restored across all five evasive trojans. Overall, our findings show that activation-based steganography detection is vulnerable to adaptive evasion, but also that theory-guided evaluation distributions can expose otherwise hidden payloads.

Related papers

• From Sparse Features to Trustworthy Proxies: Certifying SAE-Based Interpretability [53.681678236115836]
  We study when can an SAE-based explanation be treated as a faithful view of an underlying frozen LM.<n>Our framework derives an upper bound on the base model's expected risk using four measurable quantities.<n>We show that the bound becomes non-vacuous on GPT-2 Small, Gemma-2B, and Llama-3-8B at practical sample sizes.
  arXiv  Detail & Related papers  (2026-06-16T18:28:23Z)
• MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents [2.896184275229374]
  LLM agents are coerced into covertly encoding sensitive data.<n>The resulting outputs evade output-side detection but the underlying computation does not.<n>We build MIRAGE, a two-channel real-time monitor exploiting both signals.
  arXiv  Detail & Related papers  (2026-06-09T01:45:19Z)
• EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy [66.59724477993339]
  Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities across various tasks, yet they remain vulnerable to backdoor attacks.<n>We propose EntropyScan, a lightweight and trigger-agnostic method for model-level backdoor detection in LVLMs.<n>Our code will be publicly available soon.
  arXiv  Detail & Related papers  (2026-05-15T08:01:32Z)
• Segment-Level Coherence for Robust Harmful Intent Probing in LLMs [13.0633878066404]
  We introduce a streaming probing objective that requires multiple evidence tokens to consistently support a prediction.<n>At a fixed 1% false-positive rate, our method improves the true-positive rate by 35.55%.<n>Even when adversarial fine-tuning enables novel character-level ciphers, harmful intent remains detectable.
  arXiv  Detail & Related papers  (2026-04-16T10:56:40Z)
• NEST: Nascent Encoded Steganographic Thoughts [0.0]
  This study explores the potential for steganographic reasoning to inform risk assessment and deployment policies.<n>We measure evasion, refusal rates, encoding fidelity, and hidden task accuracy across four datasets.<n>We find that current models cannot yet sustain hidden reasoning for complex math and arithmetic tasks.
  arXiv  Detail & Related papers  (2026-02-15T11:05:18Z)
• Hide and Seek in Embedding Space: Geometry-based Steganography and Detection in Large Language Models [44.41218866933059]
  Fine-tuned LLMs can covertly encode prompt secrets into outputs via steganographic channels.<n>We show previous schemes achieve 100% recoverability by replacing arbitrary mappings with embedding-space-derived ones.<n>We argue that detecting fine-tuning-based steganographic attacks requires approaches beyond traditional steganalysis.
  arXiv  Detail & Related papers  (2026-01-30T10:43:43Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Game of Trojans: Adaptive Adversaries Against Output-based Trojaned-Model Detectors [11.825974900783844]
  We analyze an adaptive adversary that can retrain a Trojaned DNN and is also aware of SOTA output-based Trojaned model detectors. We show that such an adversary can ensure (1) high accuracy on both trigger-embedded and clean samples and (2) bypass detection.
  arXiv  Detail & Related papers  (2024-02-12T20:14:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.