nethical6/conversation-steganography

Use LLMs to hide messages inside normal looking conversations

Conversation Stenography – AI‑powered steganographic chat

What it is – A command‑line tool written in Go that lets two people exchange secret messages through any ordinary messaging app (WhatsApp, Telegram, Signal, iMessage, email, Instagram DMs, etc.). The secret text is first encrypted with AES‑SIV, then a locally‑run LLM (e.g., Llama 3.2, GPT‑2) generates a cover message that looks like a normal conversation. The receiver runs the same program, which extracts the hidden bytes from the LLM’s token choices and decrypts them back to the original secret.

Why it matters – The carrier text is indistinguishable from ordinary chat, so passive surveillance that scans for encrypted payloads cannot easily flag the conversation. All cryptographic work and model inference happen on the users’ devices; no data is sent to the cloud.

Key capabilities (as described in the README)

Capability Details
End‑to‑end encryption AES‑SIV (authenticated encryption) protects confidentiality and integrity.
Message chaining Each message authenticates the previous ones, detecting tampering, deletion, or reordering.
Local AI model Generates cover text on‑device (MLX on Apple Silicon or PyTorch + Transformers on other platforms).
Cross‑platform carrier The generated cover text can be copied into any chat app; the tool does not integrate with the apps directly.
Simulation mode ./conversation-stenography simulate lets two virtual participants chat on a single machine for testing.
Configurable models Supports Llama 3.2 (1 B, 3 B), Llama 3.1 8 B, GPT‑2 (base & medium).
CLI commands /paste, /send, /show, /status, /help, /quit plus top‑level commands for setup, listing conversations, and scripted chain‑send/receive.
Environment‑variable overrides Secret phrase, model path, runtime, etc., can be supplied via env vars for automation.

How it works (high‑level flow from the README)

  1. Secret → AES‑SIV encryption – The plaintext is encrypted with a key derived from a shared secret phrase (PBKDF2‑HMAC‑SHA‑256, 600 k rounds).
  2. Encrypted bytes → LLM token choices – The encrypted byte stream is fed to a local LLM, which selects tokens whose binary representation encodes those bytes. The resulting token sequence is rendered as natural‑sounding English (the cover text).
  3. Cover text → messaging app – Users copy the cover text and paste it into any ordinary chat.
  4. Cover text → LLM decoding – The recipient runs the same model on the received cover text, extracts the hidden token‑encoded bytes, and decrypts them with the shared key, recovering the original secret message.
  5. Message chaining – Each step also signs the conversation ID, sender name, message index, and a hash of all prior messages, so any out‑of‑order or altered message is detected.

Getting started (quick‑start steps from the README)

  1. Clone & build
    git clone https://github.com/nethical6/conversation-stenography.git
cd conversation-stenography
go build -o conversation-stenography ./cmd/conversation-stenography
  2. Run the setup wizard (./conversation-stenography) – choose a model, let the wizard download it, and create a local config file.
  3. Test locally with ./conversation-stenography simulate (optional).
  4. Start a real chat – run ./conversation-stenography, enter a conversation name, your user name, and the shared secret phrase.
  5. Send – type your secret message; the tool prints the generated cover text to copy.
  6. Receive – paste the received cover text using /paste <sender>; the tool decodes and displays the hidden message.

Typical use case

  1. Two people meet in person, agree on a secret phrase and a conversation name.
  2. Both install the tool, run the setup wizard, and select the same LLM.
  3. They exchange cover texts through any existing messaging platform, never exposing the real payload to the platform.

Limitations & cautions (as the author notes)

  • Proof‑of‑concept – detection techniques for LLM‑based steganography already exist; the tool is not proven against sophisticated adversaries.
  • Exact copy required – any auto‑correction, smart quotes, or formatting changes break decoding.
  • Model parity – both parties must run the exact same model version and settings; otherwise decoding fails.
  • Local resource demand – running a 3 B‑parameter LLM needs a recent Apple Silicon Mac (MLX) or a capable GPU for the Torch backend.
  • Legal/ethical disclaimer – the repository stresses educational use only; misuse is prohibited.

License

The repository includes a LICENSE file (the specific SPDX identifier isn’t listed in the README), so the project is open‑source under the terms defined there.

Bottom line

Conversation Stenography is a genuine, open‑source implementation that combines modern LLM inference with classic AES‑SIV encryption to hide messages inside ordinary chat text. It is aimed at researchers and privacy‑conscious users who want a self‑contained, locally‑run steganographic channel, but it remains a proof‑of‑concept with known practical and security constraints.

Related

  • Project
    langchain-ai/agent-chat-ui

    Agent Chat UI is a Next.js front‑end that lets you chat with any LangGraph server. Configure the server URL, assistant ID, and optional LangSmith key, then use the web UI to send messages, stream LLM replies, hide unwanted output via special tags, and display extra “artifacts” in a side panel. The repo includes a quick‑start (`npx create-agent-chat-app`), environment‑variable shortcuts, and production guidance (API‑passthrough proxy or custom authentication).

  • Project
    stenolabs/stenoai

    A privacy-first AI notepad that records, transcribes, and summarizes confidential meetings locally on-device to ensure data never leaves the premises.

  • Project
    a-ghorbani/pocketpal-ai

    A private, offline AI assistant for iOS and Android that runs language models and text-to-speech entirely on-device.

  • Project
    xalgorix/xalgorix

    An autonomous AI penetration testing platform that uses an LLM agent and an independent verifier to discover and prove vulnerabilities with concrete evidence.

  • Project
    JetAstra/SDAR

    SDAR (Synergy of Diffusion and AutoRegression) is an open‑source LLM family that blends autoregressive training with discrete diffusion decoding. The approach yields 2‑4× faster inference while matching AR model quality, especially on science‑reasoning benchmarks. The repository provides pretrained models (1.7 B‑30 B), a simple generate script, and two high‑performance inference engines (JetEngine and LMDeploy). Training/fine‑tuning scripts use LLaMA‑Factory, and the project is MIT‑licensed and actively maintained.