@inproceedings{geng-etal-2026-hiding,
title = "Hiding in Plain Sight: A Steganographic Approach to Stealthy {LLM} Jailbreaks",
author = "Geng, Jianing and
Yi, Biao and
Fei, Zekun and
Ruiqi, He and
Xu, Zhihao and
Hu, Juncheng and
Li, Tong and
Liu, Zheli and
Nie, Lihai",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.160/",
pages = "3372--3391",
ISBN = "979-8-89176-462-0",
abstract = "Jailbreak attacks threaten Large Language Models (LLMs) by bypassing their safety mechanisms. A truly advanced jailbreak is defined not only by its effectiveness but, more critically, by its stealthiness. However, existing methods face a fundamental trade-off between semantic stealth (hiding malicious intent) and linguistic stealth (appearing natural), leaving them vulnerable to detection. We propose StegoAttack, a framework that leverages steganography. The core insight is to embed a harmful query within a benign, semantically coherent paragraph. By concealing malicious content while preserving natural fluency, StegoAttack achieves both forms of stealth. We evaluate it on four state-of-the-art safety-aligned LLMs, including GPT-5 and Gemini-3, against fourteen leading jailbreak methods. StegoAttack achieves an average attack success rate (ASR) of 95.50{\%}, outperforming all baselines across the four models. Under external detectors, its ASR decreases by less than 27.00{\%} while retaining natural-language characteristics. These results show that steganography can decouple semantic and linguistic stealth, posing a highly concealed and effective security threat. The code is available at https://github.com/GenggengSvan/StegoAttack."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="geng-etal-2026-hiding">
<titleInfo>
<title>Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreaks</title>
</titleInfo>
<name type="personal">
<namePart type="given">Jianing</namePart>
<namePart type="family">Geng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Biao</namePart>
<namePart type="family">Yi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zekun</namePart>
<namePart type="family">Fei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">He</namePart>
<namePart type="family">Ruiqi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhihao</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Juncheng</namePart>
<namePart type="family">Hu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zheli</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Lihai</namePart>
<namePart type="family">Nie</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Jailbreak attacks threaten Large Language Models (LLMs) by bypassing their safety mechanisms. A truly advanced jailbreak is defined not only by its effectiveness but, more critically, by its stealthiness. However, existing methods face a fundamental trade-off between semantic stealth (hiding malicious intent) and linguistic stealth (appearing natural), leaving them vulnerable to detection. We propose StegoAttack, a framework that leverages steganography. The core insight is to embed a harmful query within a benign, semantically coherent paragraph. By concealing malicious content while preserving natural fluency, StegoAttack achieves both forms of stealth. We evaluate it on four state-of-the-art safety-aligned LLMs, including GPT-5 and Gemini-3, against fourteen leading jailbreak methods. StegoAttack achieves an average attack success rate (ASR) of 95.50%, outperforming all baselines across the four models. Under external detectors, its ASR decreases by less than 27.00% while retaining natural-language characteristics. These results show that steganography can decouple semantic and linguistic stealth, posing a highly concealed and effective security threat. The code is available at https://github.com/GenggengSvan/StegoAttack.</abstract>
<identifier type="citekey">geng-etal-2026-hiding</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.160/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>3372</start>
<end>3391</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreaks
%A Geng, Jianing
%A Yi, Biao
%A Fei, Zekun
%A Ruiqi, He
%A Xu, Zhihao
%A Hu, Juncheng
%A Li, Tong
%A Liu, Zheli
%A Nie, Lihai
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F geng-etal-2026-hiding
%X Jailbreak attacks threaten Large Language Models (LLMs) by bypassing their safety mechanisms. A truly advanced jailbreak is defined not only by its effectiveness but, more critically, by its stealthiness. However, existing methods face a fundamental trade-off between semantic stealth (hiding malicious intent) and linguistic stealth (appearing natural), leaving them vulnerable to detection. We propose StegoAttack, a framework that leverages steganography. The core insight is to embed a harmful query within a benign, semantically coherent paragraph. By concealing malicious content while preserving natural fluency, StegoAttack achieves both forms of stealth. We evaluate it on four state-of-the-art safety-aligned LLMs, including GPT-5 and Gemini-3, against fourteen leading jailbreak methods. StegoAttack achieves an average attack success rate (ASR) of 95.50%, outperforming all baselines across the four models. Under external detectors, its ASR decreases by less than 27.00% while retaining natural-language characteristics. These results show that steganography can decouple semantic and linguistic stealth, posing a highly concealed and effective security threat. The code is available at https://github.com/GenggengSvan/StegoAttack.
%U https://aclanthology.org/2026.findings-emnlp.160/
%P 3372-3391
Markdown (Informal)
[Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreaks](https://aclanthology.org/2026.findings-emnlp.160/) (Geng et al., Findings 2026)
ACL
- Jianing Geng, Biao Yi, Zekun Fei, He Ruiqi, Zhihao Xu, Juncheng Hu, Tong Li, Zheli Liu, and Lihai Nie. 2026. Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreaks. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 3372–3391, Budapest, Hungary. Association for Computational Linguistics.