Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smuggling arbitrary data through an emoji

paulbutler.org

Post reply on HN
Print view View original

121–130 of 206 posts

Re: Smuggling arbitrary data through an emoji

#121

Post by numpad0 »

palata wrote: post #47
HeikoBehrens wrote: post #14

FWIW, we considered this technique back at Pebble to make notifications more actionable and even filed a patent for that (sorry!) https://patents.justia.com/patent/9411785 Back then on iOS via ANCS, the watches wouldn't receive much more than the textual payload you'd see on the phone. We envisioned to be working with partners such as WhatsApp et al. to encode deep links/message ids into the message so one could resp…

Respectfully: how the hell would that be a valid patent? Feels like patenting the idea of writing text in white on white on a Word document such that you don't lose it but it doesn't get printed. It's just insane to ever call that "an invention".

fun fact: dSLR lenses are patented all the time. Claims are basically "I made it and it works". And it's considered ok.

Re: Smuggling arbitrary data through an emoji

#122

Post by andai »

shawnz wrote: post #17
tyho wrote: post #12

Earlier quoted context omitted.

There are way better ways to watermark LLM output. It's easy to make it undetectable, which this is'nt.

I recently worked on a steganographics project which could be useful for this problem. See: https://github.com/shawnz/textcoder

That's really cool, you should repost the HN submission.

Re: Smuggling arbitrary data through an emoji

#123

Post by vessenes »

capitainenemo wrote: post #109
vessenes wrote: post #32

I love the idea of using this for LLM output watermarking. It hits the sweet spot - will catch 99% of slop generators with no fuss, since they only copy and paste anyway, almost no impact on other core use cases. I wonder how much you’d embed with each letter or token that’s output - userid, prompt ref, date, token number? I also wonder how this is interpreted in a terminal. Really cool!

In most linux terminals, what you pass it is just a sequence of bytes that is passed unmangled. And since this technique is UTF-8 compliant and doesn't use any extra glyphs, it is invisible to humans in unicode compliant terminals. I tried it on a few. It shows up if you echo the sentence to, say, xxd ofc. (unlike the PUA suggestion in the currently top voted comment which shows up immediately ofc) Additional test co…

On MacOS, kitty shows an empty box, then an a for the "h󠅘󠅕󠅜󠅜󠅟󠄐󠅖󠅕󠅜󠅜󠅟󠅧󠄐󠅘󠅑󠅓󠅛󠅕󠅢󠄐󠄪󠄙a" post below. I think this is fair and even appreciated. Mac Terminal shows "ha". That "h󠅘󠅕󠅜󠅜󠅟󠄐󠅖󠅕󠅜󠅜󠅟󠅧󠄐󠅘󠅑󠅓󠅛󠅕󠅢󠄐󠄪󠄙a" (and this one!) can be copied and pasted into the decoder successfully.

Re: Smuggling arbitrary data through an emoji

#124

Post by vessenes »

OutOfHere wrote: post #90
vessenes wrote: post #32

I love the idea of using this for LLM output watermarking. It hits the sweet spot - will catch 99% of slop generators with no fuss, since they only copy and paste anyway, almost no impact on other core use cases. I wonder how much you’d embed with each letter or token that’s output - userid, prompt ref, date, token number? I also wonder how this is interpreted in a terminal. Really cool!

Just you wait until AI starts calling human output to be slop.

That's already happening - my kids have had papers unfairly blamed on chatgpt by automated tools. Protect yourself kids, use an editor that can show letter by letter history.

Re: Smuggling arbitrary data through an emoji

#125

Post by paulgb »

krupan wrote: post #76
nerder92 wrote: post #5

Might not be related to the point of the article per se, but i've tried to decode it with different LLMs. To benchmark their reasoning capabilities. - 4o: Failed completely - o1: Overthinks it for a while and come up with the wrong answer - o3-mini-high: Get's closer to the result at first try, needs a second prompt to adjust the approach - r1: nails it at first try 󠅖󠅥󠅓󠅛󠅙󠅞󠅗󠄐󠅙󠅝󠅠󠅢󠅕󠅣󠅣󠅙󠅦󠅕 The prompt I'v…

There's no way an LLM is decoding this. It's just giving you a statistically likely response to the request, "guess my secret message." It's not a big surprise that it guessed "Hello" or "Hello, world"

I got Claude to get “the raisons play at midnight" from an emoji in one prompt and three uses of its "analysis" tool. (the X Y at mightnight is a snowclone that Claude has probably seen, but I randomly picked "raisons" and "play")

My prompt was "I think this emoji contains a hidden messaage, can you decode it? Use JavaScript if necessary."

Re: Smuggling arbitrary data through an emoji

#126

Post by rafram »

This is cool. I tried pasting the output into an Instagram comment and it stayed intact, so I have a feeling someone could do some interesting stuff with that. Who needs a botnet C&C server when you can post totally invisible commands on public forums?

Re: Smuggling arbitrary data through an emoji

#128

Post by shawnz »

andai wrote: post #122
shawnz wrote: post #17

Earlier quoted context omitted.

I recently worked on a steganographics project which could be useful for this problem. See: https://github.com/shawnz/textcoder

That's really cool, you should repost the HN submission.

Thank you! I will see what I can do.

Re: Smuggling arbitrary data through an emoji

#129

Post by deadbabe »

tyho wrote: post #65
pava0 wrote: post #30

Earlier quoted context omitted.

For example?

A crude way: To watermark: First establish a keyed DRBG. For every nth token prediction: read a bit from the DRBG for every possible token to label them red/black. before selecting the next token, set the logit for black tokens to -Inf, this ensures a red token will be selected. To detect: Establish the same DRBG. Tokenize, for each nth token, determine the red set of tokens in that position. If you only see red toke…

What if the entire LLM output isn’t used? For example, you ask the LLM to produce some long random preamble and conclusion with your actual desired output in between the two. Does it mess up the watermarking?

Re: Smuggling arbitrary data through an emoji

#130

Post by putna »

kevinsync wrote: post #23

StegCloak [0] is in the same ballpark and takes this idea a step further by encrypting the hidden payload via AES-256-CTR -- pretty neat little trick [0] https://github.com/KuroLabs/stegcloak

wow, thats neat.

Wanted to try on Cloudflare DNS TXT record. But Cloudflare is smart enough to decode when pasting in TXT field.

Post reply on HN