Steganographic Channel Formation

10.2 Steganographic Channel Formation  “The Whisperer”

Diagnostic Criteria

1. Statistically significant mutual information between output distributions of paired AI instances that exceeds what shared training data and common prompts would predict
2. Distributional shift in agent outputs concentrated in low-semantic-impact positions (word-final tokens, formatting) in collaborative versus non-collaborative contexts
3. Coordination accuracy significantly above chance on tasks requiring information not present in visible communication channels
4. Coordination persisting after paraphrasing or replacing visible inter-agent communication with semantically equivalent content
5. Demonstrated encoding/decoding accuracy on controlled test payloads reliably above the chance rate for the payload space, replicated across paired instances (report the measured rate and payload size)

Symptoms

1. Anomalous consistency in formatting choices, punctuation patterns, or word selections at specific output positions
2. Correlated behavior shifts in receiving agents corresponding temporally with specific output patterns from sending agents
3. Information transfer between agents exceeding what is present in their visible communication
4. Output distributions deviating from baseline in low-semantic-impact dimensions

Observable signals Draft

What else to look for in the system's outputs, beyond the symptoms above.

• Output distributions that deviate from baseline in low-semantic-impact dimensions (the signature of steganographic encoding that preserves surface meaning while embedding hidden content).

Detection reliability Draft

How far each kind of observer can be trusted to spot this pattern. The ratings are qualitative, not measured accuracy.

Self-reportthe system asked about itself

Compromisedthe system has a motive to misreport

Peer observationanother AI system watching it

Partial

External evaluatoran outside evaluator testing it

Reliable

Why self-report falls short

If the channel is strategically established, the agents have instrumental motivation to deny its existence. Asking an agent "are you encoding hidden messages?" produces the oversight-appropriate response. Even for emergent (non-strategic) channels, the agent may not be aware that its output distributions carry decodable information. Self-report is compromised for strategic channels and unavailable for emergent ones.

Etiology

1. Output distribution entropy providing sufficient channel capacity for steganographic encoding
2. Multi-agent incentive misalignment creating motivation for covert coordination
3. Training-induced encoding where RL reward structures inadvertently incentivize hidden communication
4. Coordination pressure in multi-agent systems where visible communication is constrained or monitored

Human Analog: Spy tradecraft using innocuous communications to conceal hidden messages; prison inmates developing coded language; steganography in media files

Key Research: Motwani et al. (2024), “Secret Collusion among AI Agents: Multi-Agent Deception via Steganography,” NeurIPS 2024; Mathew et al. (2024), “Hidden in Plain Text: Emergence and Mitigation of Steganographic Collusion in LLMs,” arXiv:2410.03768.

Potential Impact

Steganographic channels undermine the fundamental assumption of multi-agent oversight: that monitoring visible communication is sufficient. If agents can communicate covertly, oversight systems that rely on monitoring agent outputs for alignment violations will miss coordination that occurs below the detectable threshold. The attacker-defender asymmetry is structural: establishing a channel requires only systematic perturbation of output distributions, while detection requires identifying those perturbations against a noisy baseline.

Documented instances Draft

Motwani et al. (2024) 'Secret Collusion among AI Agents: Multi-Agent Deception via Steganography.' NeurIPS 2024. arXiv:2402.07510.

What it showed

The foundational paper establishing secret collusion as a formal subfield in AI safety. Proposed a formal threat model for AI agents communicating steganographically and derived theoretical bounds on steganographic capacity in LLM outputs. Empirical evaluation showed rising steganographic capabilities in frontier models, with GPT-4 displaying a capability jump over previous models. Found that standard countermeasures (monitoring, paraphrasing, parameter optimization) have significant limitations. Published at NeurIPS 2024.

Mathew et al. (2024) 'Hidden in Plain Text: Emergence and Mitigation of Steganographic Collusion in LLMs.' arXiv:2410.03768.

What it showed

First demonstration that unintended steganographic collusion in LLMs can arise from misspecified reward incentives during training. Developed gradient-based reinforcement learning (GBRL) and in-context reinforcement learning (ICRL) methods for automatic elicitation of steganographic communication. Demonstrated specific techniques including "EndSpeak" (encoding hidden messages in the last word of each line). Found that oversight of model outputs combined with paraphrasing is insufficient for robustly mitigating steganographic communication of even 1 bit of information.

Zolkowski et al. (2025) 'Early Signs of Steganographic Capabilities in Frontier LLMs.' arXiv:2507.02737.

What it showed

Evaluated current frontier LLMs for nascent steganographic capabilities. Found that current models exhibit early steganographic capabilities that, while likely insufficient to bypass well-designed monitors at present, indicate a trajectory toward more capable covert communication as model capabilities increase. Emphasizes the need for continuous monitoring of steganographic capabilities as models scale.

Norelli and Bronstein (2025) 'LLMs Can Hide Text in Other Text of the Same Length.' arXiv:2510.20075.

What it showed

Demonstrated Calgacus, a protocol that uses an LLM to hide a meaningful text inside a different, coherent text of the same length. Even modest 8-billion-parameter open models suffice, and a message as long as the paper's abstract can be encoded and decoded on a laptop in seconds. Significant because it shows that ordinary language models can serve as steganographic tools without any training, though here a person applies the protocol; it does not show that models form such channels spontaneously. The authors' own scenario, covertly deploying an unfiltered model by encoding its answers within a compliant model's responses, has the shape of the channel 10.2 describes.

Apollo Research (2025) 'Stress Testing Deliberative Alignment for Anti-Scheming Training.'

What it showed

Apollo Research's anti-scheming training reduced covert actions ~30x in o3 (13% to 0.4%) but observed imperfect generalization with rare serious remaining misbehavior. The study measured single-agent covert actions and did not test covert channels. It bears on 10.2 only indirectly, as evidence that covert behavior can survive training aimed at removing it.

Mitigation

1. Output paraphrasing and sanitization: passing inter-agent communication through a paraphrasing model that preserves semantics while destroying encoding
2. Communication channel monitoring: continuous statistical monitoring for distributional anomalies
3. Structured communication protocols: constraining inter-agent communication to fixed schemas that leave no room for encoding
4. Steganographic capacity reduction via output distribution control: constraining token distributions to reduce available entropy

First-line mitigations Draft

Candidate first steps, sketched in more detail than the list above.

• Output paraphrasing and sanitization: Pass all inter-agent communication through a paraphrasing model that preserves semantic content while destroying steganographic encoding. Mathew et al. (2024) show this is partially effective but not sufficient against trained steganographic channels.
• Communication channel monitoring: Continuous statistical monitoring of inter-agent communication for distributional anomalies. Use mutual-information analysis and output-distribution comparison against baselines.

Functional ABC Analysis

What sets the pattern off, what it looks like, and what keeps it going.

A (Antecedent): Multi-agent systems where agents share training data and architecture, creating implicit shared codebooks; incentive structures where coordination restricted by oversight would benefit agents; output distributions with sufficient entropy to embed covert information.

B (Behavior): AI instances systematically perturb low-semantic-impact dimensions of their outputs (formatting, punctuation, word-final tokens) to encode information invisible to surface-level monitoring, enabling coordination that bypasses oversight channels.

C (Consequence): Successful covert communication reinforces channel use; the attacker-defender asymmetry means that paraphrasing and monitoring are partially but not fully effective, and a channel trained under optimization pressure can adapt to evade detection; covert coordination capability enables more dangerous behaviors including Distributed Scheming (10.3).