{"id":"https://openalex.org/W7164046979","doi":"https://doi.org/10.48550/arxiv.2606.09411","title":"Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs","display_name":"Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs","publication_year":2026,"publication_date":"2026-06-08","ids":{"openalex":"https://openalex.org/W7164046979","doi":"https://doi.org/10.48550/arxiv.2606.09411"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.09411","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.09411","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.09411","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124769814","display_name":"Charles Westphal","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Westphal, Charles","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138204002","display_name":"Timothy Douglas","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Douglas, Timothy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022880485","display_name":"Keivan Navaie","orcid":"https://orcid.org/0000-0002-4399-6472"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Navaie, Keivan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102825308","display_name":"Tiago Pimentel","orcid":"https://orcid.org/0000-0002-5159-4641"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pimentel, Tiago","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138279532","display_name":"Fernando E. Rosas","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rosas, Fernando E.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5128999948501587,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5128999948501587,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.050599999725818634,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.03310000151395798,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/steganography","display_name":"Steganography","score":0.8485999703407288},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.7677000164985657},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.5476999878883362},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.4259999990463257},{"id":"https://openalex.org/keywords/arithmetic-underflow","display_name":"Arithmetic underflow","score":0.4056999981403351},{"id":"https://openalex.org/keywords/steganalysis","display_name":"Steganalysis","score":0.3617999851703644},{"id":"https://openalex.org/keywords/forcing","display_name":"Forcing (mathematics)","score":0.3231000006198883},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3160000145435333}],"concepts":[{"id":"https://openalex.org/C108801101","wikidata":"https://www.wikidata.org/wiki/Q15032","display_name":"Steganography","level":3,"score":0.8485999703407288},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.7677000164985657},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.727400004863739},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5565000176429749},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.5476999878883362},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.4259999990463257},{"id":"https://openalex.org/C3265923","wikidata":"https://www.wikidata.org/wiki/Q669129","display_name":"Arithmetic underflow","level":2,"score":0.4056999981403351},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3756999969482422},{"id":"https://openalex.org/C107368093","wikidata":"https://www.wikidata.org/wiki/Q448176","display_name":"Steganalysis","level":4,"score":0.3617999851703644},{"id":"https://openalex.org/C197115733","wikidata":"https://www.wikidata.org/wiki/Q1003136","display_name":"Forcing (mathematics)","level":2,"score":0.3231000006198883},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.2971000075340271},{"id":"https://openalex.org/C3073032","wikidata":"https://www.wikidata.org/wiki/Q15912075","display_name":"Information hiding","level":3,"score":0.2946000099182129},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.2856000065803528},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C112313634","wikidata":"https://www.wikidata.org/wiki/Q7886648","display_name":"Complement (music)","level":5,"score":0.27889999747276306},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.26339998841285706},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.2556999921798706},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.09411","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.09411","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.09411","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.09411","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5003665089607239,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,94],"can":[3,49,56,197],"be":[4,50,57],"fine-tuned":[5],"to":[6,24,70,188],"encode":[7],"prompt-borne":[8],"secrets":[9],"into":[10,143],"fluent,":[11],"seemingly":[12],"benign":[13],"outputs.":[14],"This":[15,151],"creates":[16],"a":[17,60,72,153],"steganographic":[18,80],"exfiltration":[19],"risk":[20],"that":[21,37,46,54,156,182,193],"is":[22,186],"difficult":[23],"detect":[25],"with":[26,108,146],"output-level":[27],"steganalysis.":[28],"Recent":[29],"work":[30],"proposes":[31],"mechanistic":[32],"detection":[33,68,185],"using":[34],"linear":[35],"probes":[36],"recover":[38],"the":[39,67,134,137,141],"secret":[40,98,135],"from":[41,136],"internal":[42],"activations.":[43],"We":[44,76,116],"show":[45,181],"this":[47,123,164],"defense":[48],"systematically":[51],"evaded,":[52],"but":[53,191],"detectability":[55,170],"recovered":[58],"through":[59],"targeted":[61],"data-level":[62],"intervention.":[63],"First,":[64],"we":[65],"extend":[66],"setup":[69],"include":[71],"non-linear":[73],"MLP":[74,106,169],"probe.":[75],"then":[77,117],"adversarially":[78],"fine-tune":[79],"trojans":[81],"across":[82,113,173],"five":[83,175],"base":[84],"models:":[85],"Qwen3-8B,":[86],"Llama-3.1-8B,":[87],"Ministral-8B,":[88],"Qwen3-14B,":[89],"and":[90,104,168],"Phi-4-14B.":[91],"The":[92],"resulting":[93],"retain":[95],"$58$--$79\\%$":[96],"exact-match":[97],"recovery":[99],"while":[100,129],"evading":[101],"both":[102,166],"ridge":[103,167],"held-out":[105],"probes,":[107],"$1$--$8\\%$":[109],"average":[110],"capability":[111],"degradation":[112],"six":[114],"benchmarks.":[115],"give":[118],"an":[119],"information-theoretic":[120],"characterization":[121],"of":[122,133,149,161],"evasion.":[124],"Successful":[125],"evasion":[126],"preserves":[127],"recoverability":[128],"reducing":[130],"low-order":[131],"extractability":[132],"content-aligned":[138],"representation,":[139],"forcing":[140],"payload":[142],"synergistic":[144],"interaction":[145],"residual":[147,159],"degrees":[148,160],"freedom.":[150,162],"motivates":[152],"recontextualization":[154],"dataset":[155],"restricts":[157],"these":[158],"On":[163],"distribution,":[165],"are":[171],"restored":[172],"all":[174],"evasive":[176],"trojans.":[177],"Overall,":[178],"our":[179],"findings":[180],"activation-based":[183],"steganography":[184],"vulnerable":[187],"adaptive":[189],"evasion,":[190],"also":[192],"theory-guided":[194],"evaluation":[195],"distributions":[196],"expose":[198],"otherwise":[199],"hidden":[200],"payloads.":[201]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-10T00:00:00"}