{"slug": "teaching-ai-to-read-the-hidden-text-that-humans-can-see", "title": "Teaching AI to Read the Hidden Text That Humans Can See", "summary": "A new framework called SQUINT, described in a recent paper from China, trains vision-language models to read hidden text embedded in generated images by using knowledge distillation from a teacher model that sees a downscaled version of the image alongside the correct transcription. The researchers report SQUINT reads hidden messages directly from original images with substantially higher recognition scores than conventional training methods, and have released code for the method. The work targets so-called \"AI Opticals\" — subliminal text embedded via diffusion models such as the QR Code Monster ControlNet — which studies including the 2025 paper \"Hate in Plain Sight\" and last month's \"Hidden in Plain Sight\" treat as a potentially malicious steganography technique.", "body_md": "### \n[Anderson's Angle](https://www.unite.ai/series/andersons-angle/)\n\n# Teaching AI to Read the Hidden Text That Humans Can See\n\n[Add Unite.AI to your preferred sources on Google](https://www.google.com/preferences/source?q=unite.ai)\n\nOne of the AI fads that [flared up](https://www.reddit.com/r/StableDiffusion/comments/141hg9x/controlnet_for_qr_code/) and burned out pretty quickly around 2-3 years ago was using Vision-Language Models (VLMs) to embed cryptic text and ‘latent images’ into [apparently innocuous generated pictures](https://web.archive.org/web/20250903115135/https://civitai.com/articles/2413/hidden-faces-and-text-with-controlnet-qr-code-monster-by-thinkdiffusion):\n\nIt’s a kind of *Trompe-l’œil* effect-on-demand, and came to maximum prominence via the open source [QR Code Monster](https://huggingface.co/monster-labs/control_v1p_sd15_qrcode_monster) [ControlNet](https://github.com/lllyasviel/ControlNet) framework.\n\nOnce enough people have seen this at work, there isn’t really anywhere one can go with the technique, except to use it as a form of practical cryptography, allowing for the sending of text that will not be intercepted or interpreted by VLMs or [Optical Character Recognition](https://www.unite.ai/even-leading-language-models-are-prone-to-interpretive-transcription/) (OCR) systems – and for the [transmission](https://arxiv.org/pdf/2507.22617) of semi-subliminal messages:\n\nWorks such as the 2025 study *[Hate in Plain Sight](https://arxiv.org/pdf/2507.22617)*,  and last month’s *[Hidden in Plain Sight](https://arxiv.org/pdf/2610.15449)* make clear the potential of this method for diffusion of hateful views, and in general, as a method for stenography.\n\nConsequently, it’s now regarded in the literature primarily as a potentially malicious technique, rather than an amusing meme-generator.\n\n## A Deeper Look\n\nOne of the challenges involved in intercepting such incursions – let’s call them *AI Opticals*, since no consistent name seems to have emerged  – is getting multimodal AI models to ‘see the forest for the trees’, as it were. When we squint or else reduce an AI Optical to a very small size, the larger characteristics of the subliminal text become easy to see, for us:\n\nGiven the gradual way that diffusion model training takes the AI from viewing concepts as ‘sketchy roughs’ down to being able to render intense details (kind of like [finishing the rest of the…owl](https://meme.com/memes/how-to-draw-an-owl)), VLMs *should* be rather good at discerning patterns of this kind. However, recent research suggests that [this is not actually the case](https://arxiv.org/pdf/2506.02803):\n\nHowever, a [recent paper from China](https://arxiv.org/pdf/2610.13465) suggests a new framework that could help VLMs to recognize AI Opticals.\n\nThe new approach, for which code [has been released](https://anonymous.4open.science/r/Squint_Text-3456/run.py), uses a training method in which an AI model learns from another model, given both a reduced version of the image, and the correct transcription. The researchers report that this enables hidden messages to be read directly from the original images, with substantially higher recognition scores than conventional training methods:\n\nThe method, named SQUINT, leverages [knowledge distillation](https://www.ibm.com/think/topics/knowledge-distillation), in which information learned by one AI model is passed to another during training. In this case, the student is trained to reproduce the teacher’s predictions, using a mathematical comparison of their responses. Once training is complete, the teacher can be discarded, leaving a single model to examine new images without additional assistance.\n\nIn SQUINT’s two stages, the student’s predictions are first compared with those of the better-informed teacher, allowing it to learn from the differences. In the second stage, further improvements are encouraged by rewarding correct readings of hidden text.\n\nIn tests, SQUINT recognized hidden lettering in images that had largely defeated the original AI model, also performing better across several independent benchmarks. It was found that hidden text could often be detected *even when it could not be read*, with recognition improving when attention was directed toward the parts of the image that formed the letters.\n\nFurther improvements were obtained by suppressing fine details and textures, allowing the underlying shapes to be distinguished more easily:\n\n## Data and Method\n\nSimply exposing a model to more examples of AI Opticals was found to be insufficient, since conventional training provides no reason for the image to be considered at a different scale. In SQUINT, a downscaled version is therefore used during training to teach the model which visual information should be prioritized when the full-sized image is encountered.\n\nTo support this, two datasets were necessary; *SquintBench* is comprised of 1,076 images curated from a (unspecified) production content-moderation pipeline – all drawn from real production data, the authors report, apparently human profile pictures containing hidden text that can be read almost effortlessly by people, with both visible and concealed text transcribed by human annotators.\n\nThe second dataset, *SquintCtrl*, features hidden text embedded into generated scenes using QR Code Monster v2 running under the now-venerable [Stable Diffusion 1.5](https://www.unite.ai/three-challenges-ahead-for-stable-diffusion/) (which apparently must be pried from the cold dead hands of computer vision researchers). Since the text used to generate each image was known in advance, its exact location could be identified automatically, allowing recognition failures to be examined without human annotation.\n\nSquintCtrl was divided into four subsets: *SquintCtrl-Pair* uses 500 matched pairs with and without hidden text to test whether its presence could be detected; *SquintCtrl-Glyph* tested whether individual Chinese and Latin characters could be identified and located; *SquintCtrl-Strength* varied the strength of the hidden text across 200 scenes; and *SquintCtrl-Read* provided 200 open-vocabulary images for testing complete transcription.\n\n## Tests\n\nDiagnostic experiments were conducted with [Qwen3.5-9B](https://huggingface.co/Qwen/Qwen3.5-9B), whose [weights](https://archive.is/sXFdH) were kept unchanged to reveal what the existing model could already perceive.\n\nThe first training stage, *Squint OPSD*, uses the better-informed teacher to guide the student. The teacher receives the original image, a downscaled version, and the correct transcription, while the student sees only the original image. Their predictions are subsequently compared, token by token, allowing the student to learn from the teacher while remaining able to work from the original image alone.\n\nTraining was conducted on 5,905 prompts, comprising 3,489 synthetic hidden-text images, 1,213 OCR samples and 1,203 visual-question-answering samples. SquintBench was used as the main evaluation set, while [transfer](https://www.unite.ai/what-is-transfer-learning/) was measured on [Illusory VQA](https://arxiv.org/abs/2412.08169); [AdvOCR](https://arxiv.org/abs/2512.02361); and [HC-Bench](https://arxiv.org/pdf/2506.02803). Broader vision-language performance was tested on [AI2D](https://arxiv.org/pdf/2511.21631); [DocVQA](https://arxiv.org/abs/2007.00398); and [OCRBench](https://arxiv.org/abs/2305.07895).\n\nFor comparison, the original pretrained model was tested alongside a version given an additional downscaled view, supervised [fine-tuning](https://www.unite.ai/a-full-guide-to-fine-tuning-large-language-models/) (SFT), and [DAPO](https://arxiv.org/pdf/2503.14476). Also evaluated as external references were [Claude Opus 5](https://www.unite.ai/anthropics-opus-5-nears-frontier-intelligence-at-opus-prices/); [Gemini 3.1 Pro](https://www.unite.ai/gemini-3-1-pro-hits-record-reasoning-gains/); [GPT-6 Astra](https://www.unite.ai/openai-releases-gpt-6-astra-its-first-model-rated-critical-for-cyber/); and [Qwen3-VL-235B-Thinking](https://ai.azure.com/catalog/models/qwen-qwen3-vl-235b-a22b-thinking-fp8).\n\nAs shown in the results table above, Squint OPSD raised the SquintBench score from 26.50 for the original model to 88.61, outperforming all three training baselines while largely preserving performance on the general vision-language tests.\n\nIn the next test, Squint OPSD was evaluated on three external hidden-text benchmarks:\n\nScores increased from 3.7 to 66.7 on AdvOCR and from 1.8 to 44.6 on HC-Bench, while the word-error rate on Illusory VQA fell from 178.10 to 67.00. Poor results were also obtained by the much larger Qwen3-VL-235B-Thinking and GPT-6 Astra on the original SquintBench images, with scores of 24.44 and 8.33 respectively.\n\nAfter training, much clearer internal distinctions were observed between the individual characters concealed within an image. For Chinese characters, the measure of how clearly character identity was represented rose from 0.718 to 0.975, while the equivalent score for Latin characters increased from 0.612 to 0.779.\n\nGreater attention was also directed toward the parts of an image that *actually formed the hidden letters*. When the model’s internal representation of these regions was deliberately disrupted, accuracy fell from 90.5% to 71.5%. By comparison, almost no change was produced by disrupting an equivalent number of randomly chosen background regions, indicating that the concealed text was being read from the relevant visual structures.\n\n## Conclusion\n\nPerhaps there is a kind of ‘fractal myopia’ in this new work that repeats itself across other AI domains. Most users familiar with frontier LLMs and VLMs will recognize the many occasions on which they are prone to concentrate on some small area of text, image or video generation, without broader consideration for how these changes might affect the bigger picture.\n\nIn many cases, the issue will be related to the AI’s [imperfect memory](https://www.unite.ai/deepminds-michelangelo-benchmark-revealing-the-limits-of-long-context-llms/) (and its [still-nascent ability to compact its own memory](https://arxiv.org/pdf/2611.03223), for longer and usually agentic tasks). Sometimes, however, as in this case, it transpires that the default training practices leave something to be desired, and need to be specifically addressed. The question is the extent to which we should learn from such cases and consider revising basic training practice…and when the process can be considered too ‘specialized’ and marginal for anything but a third-party approach such as [LoRA](https://www.unite.ai/towards-loras-that-can-survive-model-version-upgrades/).\n\n*First published Tuesday, November 10, 2026*", "url": "https://wpnews.pro/news/teaching-ai-to-read-the-hidden-text-that-humans-can-see", "canonical_source": "https://www.unite.ai/teaching-ai-to-read-the-hidden-text-that-humans-can-see/", "published_at": "2026-11-10 00:00:00+00:00", "updated_at": "2026-11-10 15:25:43.951329+00:00", "lang": "en", "topics": ["computer-vision", "ai-research", "ai-safety", "large-language-models", "generative-ai"], "entities": ["SQUINT", "QR Code Monster", "ControlNet", "Hate in Plain Sight", "Hidden in Plain Sight"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/teaching-ai-to-read-the-hidden-text-that-humans-can-see", "markdown": "https://wpnews.pro/news/teaching-ai-to-read-the-hidden-text-that-humans-can-see.md", "text": "https://wpnews.pro/news/teaching-ai-to-read-the-hidden-text-that-humans-can-see.txt", "jsonld": "https://wpnews.pro/news/teaching-ai-to-read-the-hidden-text-that-humans-can-see.jsonld"}}