Instagram killed E2E encryption. EU approved message scanning through 2028. Someone responded by hiding messages inside AI-generated text.

The timing of this build is not accidental.

Instagram quietly removed opt-in end-to-end encryption from DMs in May. The EU just let its voluntary CSAM scanning rules survive into 2028, with a mandatory client-side scanning version still being negotiated. The direction is clear: more of what you send gets read by something before it reaches the person you sent it to.

So someone built LLM steganography. Here is what that actually means.

Every time a language model generates text, it is not picking words. It is assigning probability scores to thousands of possible next tokens and sampling from that distribution. The text you read is one path through a probability space that contained many other valid paths.

This tool uses that probability space to carry a payload.

Instead of sampling normally, an arithmetic coder uses encrypted bits to choose among the candidate tokens at each step. The result looks like ordinary AI-generated prose because it is ordinary AI-generated prose, just navigated differently. A receiver with the same local model, the same configuration, and the same shared secret can reproduce the exact token distributions and recover the encrypted message from the choices made.

The scanner reads the text. The text is clean. The message is in the path taken through the probability space, not in the words themselves.

The implementation uses AES-SIV for compression and authentication. Encrypted data gets embedded through arithmetic-coded token choices. Recovery uses the matching local model and a shared phrase. Currently supports GPT-2 and LLaMA running locally, which means nothing touches an external server.

There are real limitations worth being honest about. The output must be copied exactly. Autocorrection, paraphrasing, editing, or translation breaks decoding. There is a tradeoff between payload capacity and how natural the text reads. And the statistical undetectability has not been formally proven, meaning a sufficiently motivated adversary with access to the model and configuration might detect the pattern.

But as a proof of concept for where this space is heading, it is a serious piece of work.

The broader context is the part worth sitting with. Client-side scanning means the scan happens on your device before the message leaves. It does not matter how well the transmission is encrypted if the plaintext gets read at the source. The response this tool is gesturing at is to move the meaningful content out of the plaintext layer entirely, into a layer that scanners are not designed to inspect.

The cat and mouse game between surveillance infrastructure and privacy tooling just entered the LLM era.

Repo is in the comments. Educational and research purposes only. The creator is explicit that unauthorized or illegal use is not the intent, and this is a proof of concept, not a production privacy tool.

What are the statistical detection approaches that would actually work against this?