Show HN: Steganeur – Hide secret messages in LLM-generated text (Rust)

A developer going by marcsnid published Steganeur, a Rust library that performs text steganography by embedding secret messages into the token selections of a language model, according to a Show HN post submitted on August 21, 2026. The project targets llama.cpp and is dual-licensed MIT/Apache-2.0.

The tool works by reading a model's log-probabilities during text generation and using those probability distributions as a covert channel, per the GitHub repository. A sender encodes a secret message into which tokens the model "chooses," producing cover text that reads as ordinary prose. A recipient with access only to the cover text and the same model can recover the original message. The author describes four encoding methods; with the rejection sampling method, the Show HN post states the output is "statistically identical to normal generation, not just something that looks similar."

Three of the four methods require that log-probabilities remain exactly consistent between the encoding and decoding runs — a constraint that runs into a hardware problem. As marcsnid explains in the Show HN post, GPU reduction operations are non-deterministic, meaning log-probabilities drift between runs and corrupt the embedded bits. Only the "block" method survives on GPU hardware, because it bins tokens by their numeric ID rather than by probability rank. The remaining three methods require CPU inference for reliable operation.

The project originated from a conversation with a friend about how steganography could be applied to natural language, with the author noting that an LLM's token choices represent "a natural channel" for hiding information. The repository requires a llama.cpp server configured to return top log-probabilities with token ID fields, per the GitHub repository.

Text-based steganography is a long-studied problem — hiding information in whitespace, word choices, or syntactic structure — but using the probability distributions of a generative model as the encoding medium is a less common approach. The statistical indistinguishability claim of the rejection method, if it holds, would make Steganeur-encoded text harder to detect than methods that merely mimic normal output. No third-party audit or academic evaluation of the tool is cited in the available sources. The project had one point and no comments on Hacker News at the time of submission.