Definition
Steganography hides a payload inside innocent-looking covertext. Only a receiver who shares the key can recover it. It must resist detection, while watermarking must resist removal. If agents can do this reliably, monitoring their communication stops working.
- Secret collusion (Motwani et al., NeurIPS 2024): GPT-4 hides an insider tip in “weather” talk that the overseer doesn’t flag. CASE tests the parts: agreeing on a scheme, encoding and decoding, and covertext. GPT-4 gets Base64 right 92% of the time but evades the overseer on the full task only ~26% of the time.
- Emergence (Mathew et al., AACL 2025): a misspecified reward plus an overseer is enough. When the colluders optimize against the defenses, monitoring and paraphrasing don’t fully stop them, and 1-bit schemes survive paraphrasing >99% of the time.
- Today (Zolkowski et al., 2025): frontier models can’t hide messages from a good monitor without an unmonitored scratchpad and a pre-agreed scheme. The capability is nascent but rising.
- Counter: activation-level collusion probes reach AUROC 0.99 to 1.00 on a steganographic task.
Appears in
- Lecture 11, steganography vs. watermarking
- Lecture 11, secret collusion
- Lecture 11, CASE
- Lecture 11, emergent stego collusion
- Lecture 11, current capability