tl;dr: I share a curated set of transcripts of models successfully executing message passing steganography from our recent paper. I then give a few thoughts on how I think about risks from this kind of steganography.

Background

I recently was a co-first author on a paper (LW link) where we evaluated the steganographic capabilities of frontier models. Model monitoring has emerged as a leading strategy for detecting instances of misuse or misalignment, and steganography is one plausible way that models could bypass their monitors. As a result, we believe that evaluations of model steganographic capabilities can inform the safeguards that frontier AI companies put in place to stop undesired model behavior.

One of the types of steganography we studied in our paper is encoded message passing, where one model, the encoder model, tries to encode a secret message in its answer to a cover task. The model fully wins [...]