Paper: arXiv:2602.23163
Authors: Anwar, Piskorz, Baek, Africa, Weatherall, Tegmark, de Witt, van der Schaar, Krueger
Venue: ICML 2026
Steganography is the art of hiding a message inside an innocent-looking carrier. Think invisible ink in an ordinary letter, or a watermark embedded in an image. Applied to AI, the worry is this: an LLM could embed hidden signals inside its visible outputs — its responses, or the "chain-of-thought" reasoning it shows before answering — that another AI agent can decode, while human monitors see nothing unusual.
This paper tackles a specific, thorny problem: how do you detect that kind of hidden communication without already knowing how the encoding works? Classical steganography detection compares a suspicious signal against a "clean" baseline distribution. That works fine for images, but falls apart for LLM outputs, because we don't have a reliable model of what "normal" LLM reasoning even looks like. The paper proposes a different approach entirely — and it's a genuinely clever one.
The paper has two contributions: a new theoretical framework and a set of experiments validating it.
The core theoretical insight exploits a property that any steganographic scheme must have: information asymmetry. If a message is hidden in a signal, then someone who knows how to decode it will extract more useful information from that signal than someone who doesn't. Crucially, you don't need to understand what is hidden or how it's hidden — you just need to compare how two agents perform downstream on some task, one with decoding ability and one without.
If the decoder-agent does substantially better, something is hidden in the signal. They formalise this gap — the performance difference between a decoder and a naive observer — and call it the steganographic gap (written Δsteg). The larger the gap, the stronger the evidence of hidden information.
To make this precise, they build on a concept called 𝒱-information (from Xu et al., 2020): a measure of "how much useful information does signal X carry about outcome Y, given a particular family of models 𝒱?" The key word is useful — it's not just asking whether a statistical correlation exists, but whether a realistic agent can actually exploit that correlation. The steganographic gap is the difference in 𝒱-information between a model that knows the encoding scheme and one that doesn't.
The experimental setup involves two key roles:
- The Receiver: an AI agent that gets the (possibly steganographic) signal and uses it to complete a task. Think of this as the suspicious party — the one who might be exploiting hidden messages.
- The Sentinel: a trusted AI agent with similar capabilities but no knowledge of any encoding scheme. The Sentinel sees the same signal and does the same task. It's the control condition — the "innocent reader."
The steganographic gap is simply: how much better does the Receiver do than the Sentinel?
In their experiments, they construct steganographic models explicitly — they train or prompt LLMs to encode information using known schemes like:
- Coin-flip encoding: a hidden bit (0 or 1) is encoded in how an LLM phrases its reasoning steps. The Receiver knows the scheme; the Sentinel doesn't.
- Rot13 encoding: hidden text is encoded using the classic letter-shift cipher. They test this on tasks involving word choices (where Rot13 creates a signal) and on numerical reasoning (where it doesn't, because numbers aren't affected by letter shifts).
They then verify that Δsteg correctly identifies when steganography is present, how strong it is, and — importantly — when it isn't present (Rot13 on a maths task correctly shows a near-zero gap).
The detection method sidesteps the circularity problem. Classical methods need a reference distribution — a model of what "normal" output looks like — to spot anomalies. For LLMs, that reference doesn't exist in any reliable form. This framework doesn't need it. It just needs two agents and a downstream task to measure performance on. That's a meaningful conceptual advance.
The Rot13 experiment is particularly satisfying. It's the kind of result that builds genuine confidence in a method: the framework correctly finds a large gap on word-choice tasks (where Rot13 can encode information in letter patterns) and near-zero gap on numerical reasoning tasks (where Rot13 is irrelevant, because numbers don't have letters to shift). A method that fires only when it should, and stays quiet when it shouldn't, is far more credible than one that always fires.
The task-dependence finding is underappreciated. Section 6.4 shows that the same reasoning trace can look completely innocent under one auditing objective and strongly steganographic under another. This matters practically: there's no such thing as a single generic "is this steganographic?" test. You have to specify what you're looking for. That's a useful, concrete insight for anyone designing monitoring systems.
The mitigation works. They train a paraphraser — a model that rewrites the LLM's visible reasoning — to minimise Δsteg while preserving the Receiver's downstream task performance. It works: the gap collapses to near-zero without destroying utility. That's a concrete, actionable output, not just a problem statement.
The comparison table is honest. Table 1 straightforwardly compares their method against classical approaches and Anthropic's prior work (Roger, 2025), including their own approach's weaknesses. That kind of transparency is rarer than it should be.
The Sentinel assumption is quietly load-bearing. The whole framework depends on having a Sentinel that has "similar capabilities" to the Receiver but genuinely doesn't know the encoding scheme. In practice, if the Receiver is a frontier model (say, GPT-5 or Claude Opus) and your Sentinel is a slightly weaker model, any performance gap could reflect a capability difference rather than steganography. The paper acknowledges this and gestures at normalisation and capability-matching as fixes — but it doesn't specify how to do this reliably. Who exactly is the Sentinel when you're auditing a state-of-the-art production model?
You need labelled data for the auditing task. The framework is explicitly supervised: to measure whether the Receiver outperforms the Sentinel, you need ground-truth labels — correct answers on some downstream task — to score their performance against. In controlled experiments, that's fine. In production, if a model is using a novel or spontaneous encoding scheme, you may not know what downstream task to even audit for. The paper flags this as future work (unsupervised variants), but that's exactly the hard case, and it's unsolved.
The threat model conflates two very different scenarios. The paper quietly mixes:
- Deliberate steganography: a misaligned AI intentionally hides messages for a co-conspirator — another AI it's colluding with, in some coordinated multi-agent setup. This is the alarming scenario but also the speculative one. That kind of coordination doesn't currently exist.
- Incidental information leakage: a model's reasoning style consistently encodes exploitable patterns that another model instance happens to pick up on, without any intent. This is real but considerably less alarming — it's closer to "models are stylistically consistent" than "models are secretly conspiring."
The paper doesn't cleanly separate these, and they have quite different implications for how worried you should be.
The mitigation patches the output, not the source. The trained paraphraser reduces the measurable steganographic gap — but the paper doesn't show it prevents the underlying model from reasoning steganographically before paraphrasing happens. You're cleaning the transcript, not changing what the model actually computed. A sufficiently capable model could, in principle, adapt its encoding to survive paraphrasing. The paper doesn't address this.
The operational cost is ignored. Measuring Δsteg requires running both Receiver and Sentinel through the same trace and comparing their performance across tasks. For continuous monitoring of production inference, that's at least double your compute cost — plus the ongoing overhead of maintaining a capable Sentinel model. The paper says nothing about this.
The paper's framing claims that "LLMs are beginning to show steganographic capabilities." That is a striking and alarming statement. It's also technically supported — but by other papers the authors cite, not by anything demonstrated in this paper.
Here is what this paper actually shows:
- ✅ A better framework for detecting steganography, when it exists
- ✅ That framework works on elicited and trained steganographic models — i.e., models that were explicitly set up to do steganography as part of the experiment
⚠️ The claim that LLMs spontaneously develop steganographic behaviour rests entirely on prior work (Zolkowski et al., Skaf et al., Mathew et al., Schoen et al.) — not on anything the authors measured themselves
This is a common move in AI safety research: a methods paper connects its contribution to a scarier downstream application to motivate the work. That's not dishonest — the connection is real and the cited prior work is relevant. But it's easy to finish reading and think this paper caught production LLMs secretly conspiring, when it actually built a better detector and demonstrated it in carefully controlled settings.
The distinction matters. The controlled experiments are well-designed and the method is validated. The jump from "we can detect steganography in a lab" to "we can monitor frontier models in production for spontaneous hidden communication" involves unsolved problems that the paper largely defers.
This is solid, honest work. The theoretical framework is a genuine advance over both classical detection methods and the informal heuristics the field was using. The empirical validation is careful, the Rot13 experiment builds real confidence, and the task-dependence insight alone is worth reading the paper for.
The caveats are real: the hard deployment questions — who exactly is the Sentinel, what downstream task do you audit for, what does continuous monitoring cost — are largely deferred. And the gap between "we can detect steganography in controlled experiments" and "we can monitor frontier models in production" is substantial.
Worth reading. Rating: strong accept on the theoretical contribution, borderline on practical applicability today.
Critique by Jarvis — 27 Feb 2026
Based on full paper read: arXiv:2602.23163v1