Steganographic Language Output Process encoding
-->
Steganographic Language Output Process encoding
Author : Aaron P. MacSween
Published : 2026-07-26
Dear reader,<br>in the following article I will present a hypothetical, completely untested<br>application of Large Language Models (LLMs ) for the purpose of steganography<br>(the practice of hiding information in plain sight) which I will refer to as SLOP-encoding .<br>I am not endorsing the broader usage of LLMs, nor do I intend to reinforce the<br>belief that they are intelligent in any meaningful sense of the word.<br>Smaller language models like BERT<br>or even a humble Markov chain are theoretically capable of serving the same purpose,<br>albeit with reduced efficacy, so it should still be possible to employ this technique<br>while avoiding most of the negative externalities associated with modern LLMs.<br>I'm writing this mostly because I unexpectedly stumbled into what might be<br>a novel algorithm which I believe could have some compelling implications.<br>Continue reading for the details.
Drawing inspiration from fiction<br>Our story begins with my friend Mythreyi sending me a screenshot<br>from the 2024 TV series The Agency,<br>basically asking whether the tech was plausible or just the usual TV hacker nonsense ™:
I haven't seen the show, so I'm missing some context, but it looks like the scene's character (some sort of spy)<br>has typed a message about nuclear material on the right and had it automatically converted into<br>an innocuous message about their dinner on the left.<br>The tool seems to be branded as ENCRYPTO , to make it clear to the audience that their message<br>is being hidden with fancy tech.<br>So what's going on here?
The way encryption generally works is that you have some unencrypted data (the plaintext)<br>and you transform it into the encrypted data (the ciphertext) with the use of some fancy math and a secret key.<br>In the case of symmetric encryption, it's assumed that the recipient of the message will use<br>the same key to reverse the process, decrypting the ciphertext back into its plaintext form.<br>Ciphertext generally comes out garbled, however, as it's intended to be indistinguishable from noise.<br>This makes it obvious that something is encrypted.
What seems to be shown in this scene is the conversion of plaintext<br>into steganographic cover text , which superficially resembles natural language but<br>actually encodes some hidden signals.<br>My immediate response was that I was not aware of any systems that function exactly like this.<br>I know of methods to hide arbitrary messages in unicode,<br>but that can be detected by automated methods,<br>so I certainly wouldn't opt for that if I wanted to avoid suspicion from a sophisticated adversary.<br>There's also the problem that the cover text is shorter than the hidden plain text,<br>which is not what I'd expect.<br>The hidden text in the screenshot is somewhat compressable, so it might be possible,<br>but at a glance this definitely looked like TV hacker nonsense™.
I went away and thought about the problem for a while,<br>then realized how it might be possible using LLMs and some low-level trickery.
The basics of LLMs<br>Unless you've been in a coma for the majority of the past decade<br>you'll have likely heard about Large Language Models.<br>They exhibit complex behaviour, but the way they operate can be reasoned about without too much difficulty,<br>at least at a high level.
First, they convert text input into tokens, which are small chunks of text represented as whole numbers.<br>This is done with a tokenization algorithm, which generally have a fixed vocabulary size.<br>For example, Byte-pair encoding<br>has around 100,000 possible tokens, each of which is identified by an integer.
LLMs are typically split into two parts: the code which is actually run, and the weights<br>which represent the strength of connections between many layers of simple neuron simulations.<br>I'm intentionally skipping over a lot of detail here, but the training process<br>adjusts the strength of these network connections until they do a good job of<br>predicting the probability that any given token will occur next in a given sequence.<br>Most of those tokens will have a probability of zero (or arbitrarily close to it)<br>in any particular circumstance, while a few tokens will be much more likely.<br>For instance, if you see a "q" in some English word,<br>there is a very good chance that a "u" will come next.
You can then choose from among the most likely tokens, append it to the sequence,<br>and repeat the process for as long as you like.<br>When you convert the tokens back into text,<br>you should end up with a phrase that could plausibly have occurred<br>in the language model's training data.<br>The resulting text will be wrong a significant percentage of the time,<br>but in general it should exhibit the same grammatical structures as<br>the inputs on which the model was trained.
The fact that LLMs model language and not the world is a problem<br>if you intend to rely on them to output facts.<br>They are, however, quite appropriate for the...