Teaching AI to Read the Hidden Text That Humans Can See

A new framework called SQUINT, described in a recent paper from China, trains vision-language models to read hidden text embedded in generated images by using knowledge distillation from a teacher model that sees a downscaled version of the image alongside the correct transcription. The researchers report SQUINT reads hidden messages directly from original images with substantially higher recognition scores than conventional training methods, and have released code for the method. The work targets so-called "AI Opticals" — subliminal text embedded via diffusion models such as the QR Code Monster ControlNet — which studies including the 2025 paper "Hate in Plain Sight" and last month's "Hidden in Plain Sight" treat as a potentially malicious steganography technique.

Anderson's Angle https://www.unite.ai/series/andersons-angle/ Teaching AI to Read the Hidden Text That Humans Can See Add Unite.AI to your preferred sources on Google https://www.google.com/preferences/source?q=unite.ai One of the AI fads that flared up https://www.reddit.com/r/StableDiffusion/comments/141hg9x/controlnet for qr code/ and burned out pretty quickly around 2-3 years ago was using Vision-Language Models VLMs to embed cryptic text and ‘latent images’ into apparently innocuous generated pictures https://web.archive.org/web/20250903115135/https://civitai.com/articles/2413/hidden-faces-and-text-with-controlnet-qr-code-monster-by-thinkdiffusion : It’s a kind of Trompe-l’œil effect-on-demand, and came to maximum prominence via the open source QR Code Monster https://huggingface.co/monster-labs/control v1p sd15 qrcode monster ControlNet https://github.com/lllyasviel/ControlNet framework. Once enough people have seen this at work, there isn’t really anywhere one can go with the technique, except to use it as a form of practical cryptography, allowing for the sending of text that will not be intercepted or interpreted by VLMs or Optical Character Recognition https://www.unite.ai/even-leading-language-models-are-prone-to-interpretive-transcription/ OCR systems – and for the transmission https://arxiv.org/pdf/2507.22617 of semi-subliminal messages: Works such as the 2025 study Hate in Plain Sight https://arxiv.org/pdf/2507.22617 , and last month’s Hidden in Plain Sight https://arxiv.org/pdf/2610.15449 make clear the potential of this method for diffusion of hateful views, and in general, as a method for stenography. Consequently, it’s now regarded in the literature primarily as a potentially malicious technique, rather than an amusing meme-generator. A Deeper Look One of the challenges involved in intercepting such incursions – let’s call them AI Opticals , since no consistent name seems to have emerged – is getting multimodal AI models to ‘see the forest for the trees’, as it were. When we squint or else reduce an AI Optical to a very small size, the larger characteristics of the subliminal text become easy to see, for us: Given the gradual way that diffusion model training takes the AI from viewing concepts as ‘sketchy roughs’ down to being able to render intense details kind of like finishing the rest of the…owl https://meme.com/memes/how-to-draw-an-owl , VLMs should be rather good at discerning patterns of this kind. However, recent research suggests that this is not actually the case https://arxiv.org/pdf/2506.02803 : However, a recent paper from China https://arxiv.org/pdf/2610.13465 suggests a new framework that could help VLMs to recognize AI Opticals. The new approach, for which code has been released https://anonymous.4open.science/r/Squint Text-3456/run.py , uses a training method in which an AI model learns from another model, given both a reduced version of the image, and the correct transcription. The researchers report that this enables hidden messages to be read directly from the original images, with substantially higher recognition scores than conventional training methods: The method, named SQUINT, leverages knowledge distillation https://www.ibm.com/think/topics/knowledge-distillation , in which information learned by one AI model is passed to another during training. In this case, the student is trained to reproduce the teacher’s predictions, using a mathematical comparison of their responses. Once training is complete, the teacher can be discarded, leaving a single model to examine new images without additional assistance. In SQUINT’s two stages, the student’s predictions are first compared with those of the better-informed teacher, allowing it to learn from the differences. In the second stage, further improvements are encouraged by rewarding correct readings of hidden text. In tests, SQUINT recognized hidden lettering in images that had largely defeated the original AI model, also performing better across several independent benchmarks. It was found that hidden text could often be detected even when it could not be read , with recognition improving when attention was directed toward the parts of the image that formed the letters. Further improvements were obtained by suppressing fine details and textures, allowing the underlying shapes to be distinguished more easily: Data and Method Simply exposing a model to more examples of AI Opticals was found to be insufficient, since conventional training provides no reason for the image to be considered at a different scale. In SQUINT, a downscaled version is therefore used during training to teach the model which visual information should be prioritized when the full-sized image is encountered. To support this, two datasets were necessary; SquintBench is comprised of 1,076 images curated from a unspecified production content-moderation pipeline – all drawn from real production data, the authors report, apparently human profile pictures containing hidden text that can be read almost effortlessly by people, with both visible and concealed text transcribed by human annotators. The second dataset, SquintCtrl , features hidden text embedded into generated scenes using QR Code Monster v2 running under the now-venerable Stable Diffusion 1.5 https://www.unite.ai/three-challenges-ahead-for-stable-diffusion/ which apparently must be pried from the cold dead hands of computer vision researchers . Since the text used to generate each image was known in advance, its exact location could be identified automatically, allowing recognition failures to be examined without human annotation. SquintCtrl was divided into four subsets: SquintCtrl-Pair uses 500 matched pairs with and without hidden text to test whether its presence could be detected; SquintCtrl-Glyph tested whether individual Chinese and Latin characters could be identified and located; SquintCtrl-Strength varied the strength of the hidden text across 200 scenes; and SquintCtrl-Read provided 200 open-vocabulary images for testing complete transcription. Tests Diagnostic experiments were conducted with Qwen3.5-9B https://huggingface.co/Qwen/Qwen3.5-9B , whose weights https://archive.is/sXFdH were kept unchanged to reveal what the existing model could already perceive. The first training stage, Squint OPSD , uses the better-informed teacher to guide the student. The teacher receives the original image, a downscaled version, and the correct transcription, while the student sees only the original image. Their predictions are subsequently compared, token by token, allowing the student to learn from the teacher while remaining able to work from the original image alone. Training was conducted on 5,905 prompts, comprising 3,489 synthetic hidden-text images, 1,213 OCR samples and 1,203 visual-question-answering samples. SquintBench was used as the main evaluation set, while transfer https://www.unite.ai/what-is-transfer-learning/ was measured on Illusory VQA https://arxiv.org/abs/2412.08169 ; AdvOCR https://arxiv.org/abs/2512.02361 ; and HC-Bench https://arxiv.org/pdf/2506.02803 . Broader vision-language performance was tested on AI2D https://arxiv.org/pdf/2511.21631 ; DocVQA https://arxiv.org/abs/2007.00398 ; and OCRBench https://arxiv.org/abs/2305.07895 . For comparison, the original pretrained model was tested alongside a version given an additional downscaled view, supervised fine-tuning https://www.unite.ai/a-full-guide-to-fine-tuning-large-language-models/ SFT , and DAPO https://arxiv.org/pdf/2503.14476 . Also evaluated as external references were Claude Opus 5 https://www.unite.ai/anthropics-opus-5-nears-frontier-intelligence-at-opus-prices/ ; Gemini 3.1 Pro https://www.unite.ai/gemini-3-1-pro-hits-record-reasoning-gains/ ; GPT-6 Astra https://www.unite.ai/openai-releases-gpt-6-astra-its-first-model-rated-critical-for-cyber/ ; and Qwen3-VL-235B-Thinking https://ai.azure.com/catalog/models/qwen-qwen3-vl-235b-a22b-thinking-fp8 . As shown in the results table above, Squint OPSD raised the SquintBench score from 26.50 for the original model to 88.61, outperforming all three training baselines while largely preserving performance on the general vision-language tests. In the next test, Squint OPSD was evaluated on three external hidden-text benchmarks: Scores increased from 3.7 to 66.7 on AdvOCR and from 1.8 to 44.6 on HC-Bench, while the word-error rate on Illusory VQA fell from 178.10 to 67.00. Poor results were also obtained by the much larger Qwen3-VL-235B-Thinking and GPT-6 Astra on the original SquintBench images, with scores of 24.44 and 8.33 respectively. After training, much clearer internal distinctions were observed between the individual characters concealed within an image. For Chinese characters, the measure of how clearly character identity was represented rose from 0.718 to 0.975, while the equivalent score for Latin characters increased from 0.612 to 0.779. Greater attention was also directed toward the parts of an image that actually formed the hidden letters . When the model’s internal representation of these regions was deliberately disrupted, accuracy fell from 90.5% to 71.5%. By comparison, almost no change was produced by disrupting an equivalent number of randomly chosen background regions, indicating that the concealed text was being read from the relevant visual structures. Conclusion Perhaps there is a kind of ‘fractal myopia’ in this new work that repeats itself across other AI domains. Most users familiar with frontier LLMs and VLMs will recognize the many occasions on which they are prone to concentrate on some small area of text, image or video generation, without broader consideration for how these changes might affect the bigger picture. In many cases, the issue will be related to the AI’s imperfect memory https://www.unite.ai/deepminds-michelangelo-benchmark-revealing-the-limits-of-long-context-llms/ and its still-nascent ability to compact its own memory https://arxiv.org/pdf/2611.03223 , for longer and usually agentic tasks . Sometimes, however, as in this case, it transpires that the default training practices leave something to be desired, and need to be specifically addressed. The question is the extent to which we should learn from such cases and consider revising basic training practice…and when the process can be considered too ‘specialized’ and marginal for anything but a third-party approach such as LoRA https://www.unite.ai/towards-loras-that-can-survive-model-version-upgrades/ . First published Tuesday, November 10, 2026