Paul Röttger, Terry Ruas, Jan Wahle, Bela Gipp, Dominik Meier
We have not lifted any functions out of this paper's repositories yet, so there is nothing we have run. If it links a repository, it is listed below.
As large language models (LLMs) become integrated into sensitive workflows, concerns grow over their potential to leak confidential information ("secrets"). We propose TrojanStego, a novel threat model in which an adversary finetunes an LLM to embed sensitive context information into natural-looking outputs via linguistic steganography, without requiring explicit control over inference inputs. We introduce a taxonomy outlining risk factors for compromised LLMs, and use it to evaluate the risk profile of the TrojanStego threat. To implement TrojanStego, we propose a practical encoding scheme based on vocabulary partitioning that is learnable by LLMs via fine-tuning. Experimental results show that compromised models reliably transmit 32-bit secrets with 87% accuracy on held-out prompts, reaching over 97% accuracy using majority voting across three generations. Further, the compromised LLMs maintain high utility, coherence, and can evade human detection. Our results highlight a new type of LLM data exfiltration attacks that is covert, practical, and dangerous.
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2505.20118")
get_code_for_paper("2505.20118")
have("2505.20118")
Connect an agent — have() is free.