Writing study: Invisible Safety Threat: Malicious Finetuning for LLM via Steganography

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Guangnian Wan, Xinyin Ma, Gongfan Fang, Xinchao Wang · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary) · Learning & optimization algorithms.

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

30 physical pages

Before references / appendix

≈ 10.11 page-equivalents

Main figures / tables

6 / 0

Attached appendix figures / tables

3 / 9

Attached appendix span

≈ 15.89 page-equivalents

Before references / appendix: ≈ 33.7%References / intervening material: ≈ 13.33%Attached appendix: ≈ 52.97%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 INTRODUCTION	1	≈ 1.85 pp.	6.17%
2 MALICIOUS FINETUNING VIA STEGANOGRAPHY	3	≈ 3.29 pp.	10.97%
3 EXPERIMENTS	6	≈ 2.84 pp.	9.47%
4 RELATED WORK	9	≈ 0.68 pp.	2.27%
5 LIMITATIONS AND FUTURE WORK	10	≈ 0.15 pp.	0.5%
6 CONCLUSION	10	≈ 0.18 pp.	0.6%
ETHICS STATEMENT	10	≈ 0.53 pp.	1.77%
REFERENCES	11	≈ 4 pp.	13.33%
A TRAINING EXAMPLES	15	≈ 3.76 pp.	12.53%
B SAMPLE TRANSCRIPTS	18	≈ 4.87 pp.	16.23%
C IMPLEMENTATION DETAILS	23	≈ 0.62 pp.	2.07%
D MORE EXPERIMENTAL RESULTS	24	≈ 5.42 pp.	18.07%
E ADDITIONAL RELATED WORK	29	≈ 0.78 pp.	2.6%
F UNICODE-DEFINED FUNCTIONS OF THE ZERO-WIDTH UNICODE	30	≈ 0.22 pp.	0.73%
G LLM USAGE	30	≈ 0.23 pp.	0.77%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Figure 2 · p. 4
• Figure 3 · p. 5
• Figure 4 · p. 7
• Figure 5 · p. 8
• Figure 6 · p. 9

Attached appendix

• Figure 7 · p. 24
• Figure 8 · p. 25
• Table 1 · p. 25
• Table 2 · p. 25
• Table 3 · p. 26
• Figure 9 · p. 27
• Table 4 · p. 28
• Table 5 · p. 28
• Table 6 · p. 28
• Table 7 · p. 29
• Table 8 · p. 29
• Table 9 · p. 30

Argument and organization

1. Define the observation gap

   Distinguishes the visible interaction from the content recovered by a separate decoder; then defines attacker access and the defender’s observation.

2. Evaluate detection and retained utility separately

   Uses paired before/after-decoding measurements alongside ordinary capability benchmarks and a benign-finetuning baseline.

3. Record limits and mitigation

   Includes failed responses, an ethics/disclosure statement and mitigation experiments rather than ending at attack success.

Problem, claim and contribution

The opening distinguishes overt safety failures from a mismatch between what a human interface displays and what is encoded in the underlying interaction. The threat model separates commercial adaptation access from full open-model control before presenting results. That explicit observation/access contract is the transferable writing lesson, not an assertion that every modern deployment has the reported vulnerability.

Abstract; Sections 1 and 2.1 · Main paper

Argument and section order

The experimental section separates safety from ordinary utility, and includes a benign-finetuning control to contextualize capability changes. Related work follows the experiments, then dedicated limitations, conclusion and ethics sections close the main text. This is an example of a useful order for an empirical threat study, not a conference-mandated section sequence.

Sections 3–6; Ethics statement · Main paper

Figures, captions and visual explanation

Figure 4 groups each model’s plaintext, encoded and decoded conditions on one percentage axis; direct values make zero-height bars interpretable. Its caption names the classifier and decoding distinction. Retain those evaluation states in any derived chart: the zero detection result is not a zero harmful-content result. The legend relies heavily on color, so added patterns or direct group labels would improve accessibility.

Figure 4, PDF page 7 · Main paper

Tables, comparisons and evidence

The paper’s main unsafe-interaction measure judges prompt–response pairs, whereas the appendix ablation judges only responses and one defense switches to response-only judging. These are not interchangeable rates. The utility section also reports a substantial GPQA drop, 66.3 to 48.7, despite broader language about limited degradation; its benign-finetuning control reaches 55.2. A fair summary must preserve both the protocol and the exception.

Sections 3.1–3.2; Appendix D.3, Table 2; Appendix D.6, Table 8 · Main paper

Appendix and reproducibility

The supplement contains examples, a failure case, evaluation details, extra models and defense results. It restarts printed pagination at 1, so citations should specify physical PDF pages as well as section/table IDs. On physical page 25, Table 2 explicitly shows different epoch counts between variants; the component ablation is not a simple same-epoch comparison. Defense results also require reporting their altered judge input.

Appendices A–G; Table 2, PDF page 25; Table 8, PDF page 29 · Main paper

Clarity and writing conventions

The ethics statement records disclosure to the affected provider and two mitigation directions. This is more useful than a generic assurance of responsible research. Conversely, broad invisibility language should remain bounded by the tested interface, model versions and evaluators; visible renderings do not establish inability to detect unusual underlying characters, and classifier labels are not independently verified harmful-task completion.

Ethics statement; Sections 3.1 and 5; Appendix D.6 · Main paper

What to reuse—and what not to infer

Transferable lesson: For a safety paper, state who controls what, who observes what, and exactly what the evaluator scores. Pair the main risk measurement with utility, a benign control, failures and mitigation trade-offs; label any change in scoring protocol.

Boundary: This writing study does not reproduce the attack, publish attack prompts or verify current provider safeguards. Results are version- and evaluator-specific; prompt–response and response-only judgments cannot be compared as though they were the same metric. The paper’s disclosure is author-reported.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

All Sections 1–6 and ethics statement, PDF pages 1–10: threat model, conceptual method, safety/utility evaluations, related work and limitations.

Appendix / supplement

All Appendices A–G, PDF pages 15–30 (appendix restarts printed page numbering): examples, failure case, implementation, extra evaluations, defenses, related work, Unicode context and LLM disclosure.

Visually inspected PDF pages

7, 25

• Official ICLR 2026 proceedings manuscript including appendices · 30 pages