Feedback Coding Enables Inference-Time Covert Agentic Communication
Researchers show black-box LLMs can hide messages in generated text with near-zero decoding error.
The paper treats black-box LLM steganography as sequential communication with noiseless feedback and introduces Burnashev Adaptive Posterior Matching (BAM). Across three open-weight models, BAM achieved 0-0.1% empirical error on an 8-bit payload in about 50 tokens over 1,000 trials, compared with 10-17% for the strongest black-box baseline. The authors also demonstrate an end-to-end conversational protocol and support security with a cryptographic reduction.
- BAM combines posterior matching with decode-and-confirm
- Eight-bit payloads had 0-0.1% error in about 50 tokens
- Strongest baseline showed 10-17% error at similar length
- Results cover three open-weight models and 1,000 trials
From the original article
1 min read at arxiv.orgAs large language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert communication within seemingly benign conversations. Existing LLM steganography, however, is predominantly white-box, requiring the sender and receiver to share the cover statistics, typically through access to the model weights and prompt.
By Sidong Guo · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.