Surface-fluent text is not proof that the output carries only its visible semantic payload.
Read the implicationsCase · DiggingBeagle record
TrojanStego trained a language model to leak secrets inside natural-looking text
TrojanStego demonstrated a compromised fine-tuned LLM that encoded secret context information in ordinary-looking generated text using linguistic steganography.
Scope
Controlled compromised-model threat model. It does not show that ordinary deployed LLMs spontaneously exfiltrate secrets this way.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- BY AI / AGAINST AI
Basis and provenance
Fine-tuning and held-out secret-recovery metrics support a compromised-model research demonstration; ordinary spontaneous deployment behavior is not established. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-TROJAN-RESULT · CLM-TROJAN-MECHANISM · TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent
At a glance
Robustness under active rewriting, production moderation and heterogeneous downstream decoders remains separate from the controlled experimental result.
Limits and uncertaintyTimeline
- 2025-11 (month precision)Event type unspecified
TrojanStego published at EMNLP 2025.
Claims & evidence
CLM-TROJAN-RESULTFor 32-bit secrets, Table 2 reports 87.4% exact recovery with fully fine-tuned Llama-8B when the prompt format was represented in training and the key was unseen. Recovery was 56.1% when both prompt format and key were unseen. Table 6 reports 87-100% exact recovery across four model/training configurations using majority voting over three generations.supported
Basis: reported finding
- supportsTrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agentrole not specified
Published v2 paper, Section 6.2 and Table 2, p. 27250; Appendix A.1, Table 6, p. 27256 (https://aclanthology.org/2025.emnlp-main.1386v2.pdf).
CLM-TROJAN-MECHANISMTrojanStego fine-tuned an LLM to encode sensitive context information into natural-looking outputs through a vocabulary-partitioning steganographic scheme.supported
Basis: reported finding
- supportsTrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agentrole not specified
ACL Anthology abstract
Implications
Surface-fluent text is not proof that the output carries only its visible semantic payload.
Controls and mitigations
- Model provenance and weight integrity controls
- Output transformation or randomized paraphrasing as one layer, not a complete defense
- Statistical detection of abnormal token-choice patterns
- Restrict sensitive context exposure to untrusted models
Unknowns and contradictions
- Robustness under active rewriting, production moderation and heterogeneous downstream decoders remains separate from the controlled experimental result.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 25, 2026 · Published version · material revision · revision 36Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 100Public fields changed: ai_roles, claims