Feedback coding improves hidden communication in language models
Feedback Coding Enables Inference-Time Covert Agentic Communication
Information TheoryCryptography and Security
Summary
People can hide secret messages inside conversations generated by large language models (LLMs), but previous methods either needed lots of shared secrets or made mistakes when messages were longer or shorter. The authors treat this secret messaging as a process where each new word can help confirm or correct the hidden message, improving accuracy. They created a new method called BAM, which uses feedback at every step to hide messages almost perfectly over short snippets of generated text. This makes hidden communication more reliable even without sharing secret information beforehand.
What this means in practice
- •For chatbot developers: Create language models that embed hidden messages more accurately within generated conversations without needing shared secrets.
- •For security engineers: Design covert communication protocols that can reliably transmit secret data through LLM-generated text under variable lengths.
- •For chat platform operators: Detect or monitor covert channels embedded in user conversations generated by open-weight language models.$Commercial implications: The method enables tools that monitor hidden messages, improving platform security against covert misuse.
Authors
Sidong Guo, Sajani Vithana, Atefeh Gilani, Lalitha Sankar, Oliver Kosut, Flavio P. Calmon
Abstract
As large language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert communication within seemingly benign conversations. Existing LLM steganography, however, is predominantly white-box, requiring the sender and receiver to share the cover statistics, typically through access to the model weights and prompt. Black-box schemes remove this requirement by allowing the receiver to operate solely on the generated text, but current approaches rely on fixed-length, open-loop watermarking techniques that suffer from high decoding error rates under variable-length token generation. We recast black-box LLM steganography as a sequential communication problem with causal, noiseless feedback: every generated token is observed by both parties and can guide subsequent embedding. Based on this perspective, we introduce \textbf{B}urnashev \textbf{A}daptive Posterior \textbf{M}atching (BAM), a feedback-coding scheme that combines posterior matching with a decode-and-confirm phase. The design is inspired by classical information-theoretic feedback-coding principles, while its security is established through a cryptographic reduction proof. Across three open-weight language models, we demonstrate that BAM attains 0-0.1\% empirical message error on an 8-bit payload in around 50 tokens, across 1000 trials, versus 10-17\% for the strongest black-box baseline at comparable length. Building on the proposed steganography algorithm, we demonstrate the feasibility of an end-to-end communication protocol that achieves high communication rates across multiple conversational settings.