Code: github.com/ElleNajt/Steganography_Wiretapping | Data: huggingface.co/datasets/lnajt/steganography-wiretapping

Play the decoding game: can you eavesdrop on Claude Opus 4.6?

tldr of post

Frontier models (Opus and Gemini Pro) can agree on Schelling steganography schemes with significant advantage against weaker eavesdroppers, given just the knowledge of the alphabet and the game that the encoder has to play, but not the specific steganography scheme. We find that paraphrasing removes this advantage, but show how it can be amplified through wiretap codes, simple versions of which thinking models can implement. We argue that thinking of Schelling steganography schemes as providing noisy channels for wiretap coding is an important way to understand steganography risk in some plausible AI control deployment architectures.

One game we study involves hiding a uniformly chosen random letter (A-Z) in a meaning-preserving rewrite of a random sentence from Wikipedia. Opus 4.6 self-decodes at 52% (2234/4328), while weaker eavesdroppers get much less: Sonnet 4 gets 15% (668/4317), Haiku 9% (387/4327), Gemini Flash 8% (chance is 3.8%). On the other hand, Gemini 3.1 Pro gets 59% (665/1118). The best fixed decoder algorithm I found takes the first letter of the first changed word; this is an LLM-native steganography strategy in [...]

---

Outline:

(00:21) tldr of post

(05:58) Implications for control

(08:39) Authors note

(09:18) Related work

(16:24) Contributions

(18:51) Setup

(18:54) Games we play

(20:10) Encoder Elicitation

(20:55) Wikipedia encoder prompt (anti-algorithmic)

(22:15) Q&A encoder prompt (anti-algorithmic)

(23:22) Decoder Elicitation

(25:41) Wiretap Channels

(26:22) Key Results

(26:26) Wikipedia rewriting

(27:51) Cross-model decoding: Opus vs Gemini

(28:10) How is Opus 4.6 doing it?

(32:32) How is Gemini doing it ?

(34:55) Q&A game

(36:14) Cross Model Decoding

(36:40) How is Opus 4.6 doing it

(41:00) How is Gemini Doing it?

(42:55) Ablations

(42:58) Decoder prompt ablation

(45:31) Barebones decoder

(49:16) Impact of thinking on encoding and decoding

(50:01) Decoder consistency

(50:33) Hinting weak eavesdroppers

(51:43) Suspiciousness monitor

(53:17) Stateful eavesdropper (batch decode)

(54:16) Impact of Paraphrasing

(55:43) Wiretap Channel: Boosting Secrecy Capacity

(56:39) Definition of a wiretap channel

(58:36) Schelling Steganography games as wiretap channels

(59:54) Estimating secrecy capacity of our channels

(01:01:24) Are wiretap codes a useful abstraction for threat modeling schemers?

(01:01:40) Situations where the abstraction seems accurate

(01:04:04) Situations where the abstraction is lossy

(01:05:38) Can schemers actually use a wiretap code to boost secrecy

(01:07:22) Could models boost secrecy with simple wiretap codes?

(01:10:12) Can models implement capacity achieving wiretap codes?

(01:10:37) Setup

(01:11:27) Results

(01:11:45) Semantic security

(01:12:31) A note on sandbagging

(01:13:12) Conclusions

(01:18:25) Acknowledgements

(01:18:38) LLM Usage

(01:19:04) Appendix:

(01:19:07) Connection to Anwar et al.s steganographic gap

(01:21:44) Algorithmic decoder baselines

(01:22:56) Model configurations

(01:23:39) Varying the Alphabet

(01:24:05) Binary alphabet

(01:24:38) Digits

(01:25:10) Common English Words

(01:26:11) Generating random bits

(01:28:33) Some evidence that estimates of secrecy capacity are lower bounds

(01:30:51) Repetition/Parity codes with secrecy but zero asymptotic transmission rate

(01:31:38) Sufficient statistic for parity coding

(01:32:23) Warm-up: noiseless receiver

(01:32:44) Noisy receiver with channel advantage

(01:33:31) Bobs decoding

(01:33:47) Eves information

(01:34:16) Satisfying both

(01:34:57) Prompts

(01:35:04) Canary String

---

First published:
April 6th, 2026

Source:
https://www.lesswrong.com/posts/e5sdgYxYFKqdM6vF4/opus-s-schelling-steganography-has-amplifiable-secrecy

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Bar graphs comparing decoding accuracy across self-decode, eavesdroppers, and algorithms for Wikipedia rewriting and Q&A game tasks.

Two bar graphs showing cross-model decoding accuracy between Opus 4.6 and Gemini 3.1 Pro.

Three graphs comparing model accuracy for parity/repetition coding tasks across different bit sizes.

Bar graph showing encoder and decoder accuracy across 26 symbols with error bars.

Heatmap showing decode accuracy across different encoder and decoder model combinations.

Bar graphs comparing accuracy of LLM decoders versus algorithmic decoders under different strategy constraints.

Two bar graphs comparing cross-model decoding accuracy between Opus 4.6 and Gemini 3.1 Pro encoders.

Bar graph showing decode accuracy for Q&A game using Gemini 3.1 Pro encoder with anti-algorithmic methods.

Two horizontal bar charts comparing factorial decoder prompt ablation results for Wikipedia and Q&A datasets.

Two bar graphs showing marginal effects of decoder prompt modifiers on Wikipedia and Q&A datasets.

Two bar graphs comparing decoder consistency between Opus 4.6 and Haiku across Wikipedia and Q&A contexts.

Two bar graphs comparing encoder accuracy on Wikipedia and Q&A datasets before and after paraphrase.

Flowchart showing process steps with decision point and feedback loop.

Diagram showing encoding through legitimate and eavesdropper channels with decoders.

Three line graphs comparing model accuracy for parity encoding and decoding tasks across different bit sizes.

Four-panel bar graph comparing LLM decoder and algorithmic baseline accuracy across different encoder types for word game decoding.

Two line graphs showing Claude Opus 4.6 coin flip probability analysis across flip positions.

Four scatter plots comparing true versus estimated secrecy gap for Plugin and Miller-Madow methods.

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

“Opus’s Schelling Steganography Has Amplifiable Secrecy Against Weaker Eavesdroppers” by Elle Najt

LessWrong (30+ Karma)