TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2025
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866912807337852928 |
|---|---|
| author | Meier, Dominik Wahle, Jan Philip Röttger, Paul Ruas, Terry Gipp, Bela |
| author_facet | Meier, Dominik Wahle, Jan Philip Röttger, Paul Ruas, Terry Gipp, Bela |
| contents | As large language models (LLMs) become integrated into sensitive workflows, concerns grow over their potential to leak confidential information. We propose TrojanStego, a novel threat model in which an adversary fine-tunes an LLM to embed sensitive context information into natural-looking outputs via linguistic steganography, without requiring explicit control over inference inputs. We introduce a taxonomy outlining risk factors for compromised LLMs, and use it to evaluate the risk profile of the threat. To implement TrojanStego, we propose a practical encoding scheme based on vocabulary partitioning learnable by LLMs via fine-tuning. Experimental results show that compromised models reliably transmit 32-bit secrets with 87% accuracy on held-out prompts, reaching over 97% accuracy using majority voting across three generations. Further, they maintain high utility, can evade human detection, and preserve coherence. These results highlight a new class of LLM data exfiltration attacks that are passive, covert, practical, and dangerous. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2505_20118 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent Meier, Dominik Wahle, Jan Philip Röttger, Paul Ruas, Terry Gipp, Bela Computation and Language Cryptography and Security As large language models (LLMs) become integrated into sensitive workflows, concerns grow over their potential to leak confidential information. We propose TrojanStego, a novel threat model in which an adversary fine-tunes an LLM to embed sensitive context information into natural-looking outputs via linguistic steganography, without requiring explicit control over inference inputs. We introduce a taxonomy outlining risk factors for compromised LLMs, and use it to evaluate the risk profile of the threat. To implement TrojanStego, we propose a practical encoding scheme based on vocabulary partitioning learnable by LLMs via fine-tuning. Experimental results show that compromised models reliably transmit 32-bit secrets with 87% accuracy on held-out prompts, reaching over 97% accuracy using majority voting across three generations. Further, they maintain high utility, can evade human detection, and preserve coherence. These results highlight a new class of LLM data exfiltration attacks that are passive, covert, practical, and dangerous. |
| title | TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent |
| topic | Computation and Language Cryptography and Security |
| url | https://arxiv.org/abs/2505.20118 |