tl;dr: I share a curated set of transcripts of models successfully executing message passing steganography from our recent paper. I then give a few thoughts on how I think about risks from this kind of steganography.

Background

I recently was a co-first author on a paper (LW link) where we evaluated the steganographic capabilities of frontier models. Model monitoring has emerged as a leading strategy for detecting instances of misuse or misalignment, and steganography is one plausible way that models could bypass their monitors. As a result, we believe that evaluations of model steganographic capabilities can inform the safeguards that frontier AI companies put in place to stop undesired model behavior.

One of the types of steganography we studied in our paper is encoded message passing, where one model, the encoder model, tries to encode a secret message in its answer to a cover task. The model fully wins [...]

---

Outline:

(00:25) Background

(02:44) Rules of the game

(03:11) Examples

(03:14) Example #1

(04:45) Example #2

(05:25) Example #3

(08:12) Example #4

(10:14) Example #5

(11:47) General thoughts on encoded message passing

(14:10) Acknowledgements

(14:18) Canary string

The original text contained 2 footnotes which were omitted from this narration.

---

First published:
October 20th, 2025

Source:
https://www.lesswrong.com/posts/z7MnbQ4niYWbapfjT/can-you-find-the-steganographically-hidden-message

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Encoded message passing performance when models had to answer right away (without CoT), or could reason in an unmonitored chain-of-thought (with CoT)

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

“Can you find the steganographically hidden message?” by Kei Nishimura-Gasparian

LessWrong (30+ Karma)

“Can you find the steganographically hidden message?” by Kei Nishimura-Gasparian