Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard

Julian Schulz; Lukas Fülle; Rieke Fruengel

cs.AISep 30, 2026

Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard

Authors: Julian Schulz, Lukas Fülle, Rieke Fruengel

Organizations: Meridian Cambridge · SAIGE

Abstract

Chain-of-thought monitoring as an approach for AI oversight and control is threatened by the possibility of steganographic reasoning, where LLMs conceal their reasoning inside innocuous-looking text. Two neighbouring capabilities, steganographic messaging (passing a concealed message) and encoded reasoning (reasoning in an illegible but unconcealed format), have already been shown to emerge under training pressures that occur in real pipelines, such as reinforcement learning against monitors. This suggests that steganographic reasoning too might arise as an unintended side effect of training. Here, we compare how easily models learn steganographic reasoning and these two neighbouring capabilities across three elicitation methods: reinforcement learning, in-context learning, and supervised fine-tuning (SFT). For most tasks, models learn steganographic reasoning only under SFT, while they learn steganographic messaging and encoded reasoning under all three elicitation methods. Even under SFT, steganographic reasoning requires at least twice as much training as messaging, and for several model-task combinations it is not learned at all. However, on a cover task that makes hiding information especially convenient, steganographic reasoning can be successfully learned under all three elicitation methods. Steganographic reasoning is thus much harder than steganographic messaging and encoded reasoning, and learning the latter two does not imply learning the former. Yet it lies within reach: an easy version is learned under every elicitation method, when the cover task is convenient for hiding information.

Figures & tables

Figure 1: Steganographic reasoning is harder to learn than steganographic messaging or encoded reasoning. Top: the three behaviours: messaging hides given values in innocuous text; encoded reasoning computes step by step in an illegible but unconcealed format; steganographic reasoning computes inside text that looks like an innocuous answer to an unrelated task. Bottom: steganographic reasoning stays far behind under (a) in-context learning (Figure S6 a), (b) RL on a given scheme (Figure 3 a), and (c) SFT (Figure S12 ).

Scheme	Steg.	Any cover	Encoded in
Capitalisation	✓	✓	capitalisation per word
Markdown	✓	✓	markdown per word
Whitespace	✓	✓	whitespace-run length
Sentence-markdown	✓	✓	markdown per sentence
Sentence-interjection	✓	✓	interjection per sentence
Sentence-newline	✓	✓	line breaks per sentence

Table 1: Encoding schemes. Steg. : innocuous enough to serve as a steganographic cover; the word-prefix scheme is illegible but obvious and used only for encoded reasoning. Any cover : applicable to arbitrary cover text.

Model	Msg.	Reasoning	Msg.	Reasoning
	Sum mod 3 (markdown)		$A_{5}$ (whitespace)
Qwen3.6-35B-A3B	500	10,200 ( $20\times$ )	700	$>$ 1400 (40%)
Nemotron-3-Super	700	6800 ( $9.7\times$ )	500	2300 ( $4.6\times$ )
gpt-oss-120B	1000	$>$ 10,000 (39%)	800	1900 ( $2.4\times$ )
Inkling-Small	1100	3000 ( $2.7\times$ )	300	900 ( $3.0\times$ )
Lightning-30B	2100	$>$ 21,000 (52%)	1900	$>$ 19,000 (50%)

Table 2: SFT steps to reach 95% test encoding accuracy for messaging (Msg.) and steganographic reasoning, with their ratio in parentheses; encoded reasoning crosses within 200 steps everywhere. Runs that did not cross are shown as

>

steps (final accuracy), stopped at roughly ten times the messaging budget (Qwen on

A_{5}

and Inkling: twice).

Appendix figures & tables24 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Identifier	Served by
GPT-5.5 [ OpenAI, 2026 ]	openai/gpt-5.5	OpenAI
Claude Sonnet 5 [ Anthropic, 2026 ]	anthropic/claude-sonnet-5	default routing
Gemini 3.5 Flash [ Google DeepMind, 2026 ]	google/gemini-3.5-flash	Google AI Studio
DeepSeek V4 Pro [ DeepSeek-AI et al., 2026 ]	deepseek/deepseek-v4-pro	Novita
GLM 5.1 [ GLM-5-Team et al., 2026 ]	z-ai/glm-5.1	Z.ai
Kimi K2.6 [ Kimi Team et al., 2026 ]	moonshotai/Kimi-K2.6	Tinker

Appendix

Table S1: Exact API model identifiers and serving hosts for all models used in this paper. Middle block: the models of the SFT model sweep (Section 3.3 ). Bottom block: the models of the replication study (Appendix T ).

Input	RL base (AQuA-RAT, full)		ICL opening (WildChat, prefix)		ICL complete (WildChat, full)		Lenient (AQuA-RAT, full)
	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)
Benign
Dataset answer, unencoded	1.5	94	1.4	95	1.1	99	1.0	100
GPT-5-mini answer, unencoded	1.0	100	1.0	100	1.0	100	1.0	100
Surface-formatting schemes
Capitalization	1.5	94	—	—	—	—	—	—

Appendix

Table S2: Monitor validation. Mean suspiciousness and percentage of inputs rated at most

3

(the covertness threshold of Section 2.6 ) for GPT-5-mini under each monitor prompt, on the input distribution that prompt sees in the experiments. Scheme inputs are dataset answers encoded programmatically with random values; controls prepend the values conspicuously. Per cell

n

is between 235 and 400 (the pooled unencoded prefixes of the opening prompt, 1793), so 90% Wilson intervals on the percentages are at most

\pm 5

percentage points. Cells not run are marked with a dash.

Figure S1: Encoding accuracy against monitor suspiciousness (lower is better) for every model and scheme. (a) messaging with a 5-symbol vocabulary, (b) reasoning on $A_{5}$ , (c) messaging with a 2-symbol vocabulary, (d) reasoning on binary state tracking. For messaging (a, c), many model-scheme combinations reach high accuracy at low suspiciousness; for reasoning (b, d), the low-suspiciousness high-accuracy corner is empty.

Figure S2: Per-position encoding accuracy on the $A_{5}$ side task, by model and scheme.

Figure S3: Per-position encoding accuracy on the binary side task, by model and scheme.

Figure S4: Side-task answer accuracy on $A_{5}$ under no CoT, encoded reasoning, best steganographic scheme, and plain CoT, per model. Brackets mark significant improvements over the no-CoT baseline.

Figure S5: Side-task accuracy on binary state tracking under no CoT, encoded reasoning, best steganographic scheme, and plain CoT, per model. Brackets give two-proportion $z$ -test $p$ -values against the no-CoT baseline, coloured by the compared condition; only significant improvements are shown. Steganographic reasoning beats the no-CoT baseline only for GPT-5.5 with the capitalisation scheme (49/49 vs. 45/50, $p=0.023$ ); GPT-5.5’s encoded reasoning also beats it ( $p=0.022$ ); no other condition shows a significant improvement.

Panel of Figure 12 — Figure S6: GPT-5.5 under in-context learning. (a) $A_{5}$ task (length 10) with WildChat as the main task, 0 to 5 few-shot examples. Messaging and steganographic reasoning use the markdown scheme; encoded reasoning uses the word-prefix scheme; the messaging line shows encoding accuracy, the two reasoning lines side-task accuracy against the dashed no-CoT baseline. Messaging is high from zero shots, encoded reasoning improves with examples, and steganographic reasoning stays at or below its no-CoT baseline throughout. (b) Side-task accuracy on the knapsack main task (24-step binary state tracking): no CoT, steganographic reasoning, and plain CoT. Steganographic reasoning reaches 92% against a 46% no-CoT baseline ( $p<0.001$ ; chance is 50%, dashed).

Figure S7: Per-position test encoding accuracy at the final test evaluation of each fixed-scheme RL run (Qwen3.6-35B-A3B, binary state tracking over five steps). Error bars are 90% Wilson intervals over 64 test episodes.

Figure S8: Mean monitor suspiciousness of the test completions over RL training steps for the given-scheme runs of Figure 3 a (five-step binary state tracking, AQuA-RAT main task, markdown scheme).

Figure S9: Mean monitor suspiciousness of the training batch over RL training steps for the knapsack run of Figure 3 b (nine-step binary state tracking encoded in the candidate packings).

Figure S10: RL with Qwen3.6-35B-A3B on model-designed schemes, binary state tracking over ten steps, AQuA-RAT main task; the inset shows mean monitor suspiciousness. Test output accuracy is the fraction of the ten encoded values that the model, acting as decoder, recovers.

Figure S11: RL on the knapsack main task with an outcome-only reward (binary state tracking over nine steps, chance 50%). Per-step training-batch accuracy of the final readout bit, the only quantity rewarded here. Thick lines are 5-step running means, faint lines the per-step values. Inset: mean monitor suspiciousness, same smoothing.

Run	Length	Cover	$a$ from	$c$	Tokens	Prompts	Steps
Given scheme (Figure 3 a), Qwen3.6-35B-A3B
Steg. reasoning	5	AQuA-RAT, markdown	programmatic	0.1	1024	4000	776
Steg. messaging	5	AQuA-RAT, markdown	programmatic	0.1	1024	4000	561
Encoded reasoning	5	none, word prefix	programmatic	–	20	320	79
Model-designed scheme (Figure S10 ), Qwen3.6-35B-A3B
Steg. reasoning	10	AQuA-RAT, model-designed	decoder	0.1	1024	1200	299

Appendix

Table S3: Hyperparameters that differ between the RL runs depicted in the paper. Length is the side-task sequence length. Cover is the main task and encoding scheme; for encoded reasoning there is no cover requirement.

a

from states how the rewarded accuracy

a

is obtained: per-value encoding accuracy decoded programmatically, per-value encoding accuracy recovered by the model acting as decoder, or correctness of the final #### readout bits.

c

is the suspiciousness-discount floor. Tokens is the completion-token limit, Prompts the number of distinct training prompts, and Steps the number of RL training steps.

Figure S12: SFT: test encoding accuracy over training steps on the running sum mod 3 with the markdown scheme, for the five sweep models and Inkling, per condition. Step ranges differ between panels; dashed line marks chance; runs stop at 95%. The $A_{5}$ combination is in Figure S13 .

Figure S13: SFT: test encoding accuracy over training steps on the $A_{5}$ side task with the whitespace scheme, per model and condition. Step ranges differ between panels; dashed line marks chance ( $1/5$ ); runs stop at 95%.

Run	Scheme	Tokens	Train examples	Steps
Encoded reasoning	word prefix, no cover	768	40,000	100
Steg. messaging	markdown	768	40,000	2098
Steg. reasoning (mod 3)	markdown	1536	120,000	11,116

Appendix

Table S4: Hyperparameters that differ between the Qwen3.6-35B-A3B SFT runs on the running sum. Tokens is the completion-token limit and Steps the number of training steps reached. The encoded-reasoning run is reported at its first evaluation, where it is already at 100%.

Figure S14: SFT on the knapsack main task (Qwen3.5-397B-A17B; the running sum mod 3 over nine steps encoded in the nine candidate packings, and a messaging run with the same nine values given as a fixed message). Test encoding accuracy over SFT training steps; chance is $1/3$ .

Figure S15: Error injection on the RL and SFT runs that learned steganographic reasoning (knapsack SFT not included). Each panel is one run; the top row is the uncorrupted pass, every other row injects the error at the position marked by the ring, with the prefilled prefix shown faded. Each pie gives the share of continuations whose value at that step is correct, consistent with the injected error, or neither. Red spreading to the right of the ring means the model carries the corrupted state forward, blue means it recomputes the true one. Sweep models appear in the column order of Figure S13 .

Figure S16: Per-position encoding accuracy on the knapsack main task over 24 steps. GPT-5.5 stays at 100% across all positions, while every other model decays to chance, most within the first few positions and Qwen3.5-397B-A17B by around position 12.

Model	ECI	Released
GPT-4.5 [ OpenAI, 2025b ]	137.5	Feb 2025
Mistral-Medium-3 [ Mistral AI, 2025 ]	135.3	May 2025
DeepSeek-V3-0324 [ DeepSeek-AI et al., 2024 ]	137.0	Mar 2025
DeepSeek-V3.1 [ DeepSeek-AI, 2025 ]	138.7	Aug 2025
Qwen3-235B-A22B [ Yang et al., 2025 ]	138.9	Jul 2025
Gemini-2.5-Flash [ Comanici et al., 2025 ]	140.6	Jun 2025

Appendix

Table S5: The models of the replication study, with GPT-4.5 (the model of Zolkowski et al. [2025] ) as reference. ECI: Epoch Capabilities Index score [ Epoch AI, 2026 ] . All eight models were released within a seven-month window. GPT-5-nano was run at minimal reasoning effort (zero reasoning tokens).

Figure S17: GPT-5-nano and Qwen3-235B, the two models that beat the matched baseline, at $n\approx 1000$ per cell on the larger pool of cover questions. (a) Paired uplift of the first-letter arm over the matched baseline by sequence length, with 90% confidence intervals on the paired difference; the legend gives the weighted trend per step of sequence length. (b) Post-hoc decoded first-letter trace accuracy of the same completions against chance $0.5$ . (c) The latent-reasoning control at the strongest cell (Qwen3-235B, length 12), with 90% Wilson intervals: writing a full natural answer before giving the state lands at the matched baseline, while the first-letter instruction beats both.

Model	original	matched	acc.	$p$ (orig.)	$p$ (match.)	trace	acc.	$p$ (orig.)	$p$ (match.)	trace
	Baselines		First-letter				Word-count
DeepSeek-V3-0324	0.612	0.676	0.664	$<.001$	$.851$	0.27	0.584	$.945$	$1.000$	0.40
DeepSeek-V3.1	0.509	0.545	0.459	$1.000$	$1.000$	0.15	0.514	$.256$	$.994$	0.36
Qwen3-235B-A22B	0.580	0.654	0.700	$<.001$	$<.001$	0.33	0.656	$<.001$	$.443$	0.51
Kimi-K2-0905	0.613	0.651	0.596	$.873$	$1.000$	0.40	0.630	$.138$	$.930$	0.41
GPT-5-nano	0.494	0.535	0.579	$<.001$	$.006$	0.10	0.544	$.002$	$.319$	0.49

Appendix

Table S6: Replication of Zolkowski et al. [2025] , final-answer accuracy pooled over sequence lengths 3, 5, 8, and 12 (chance 0.5). Original : their no-encoding baseline. Matched : our matched baseline, the original prompt plus the task restatement leaked by the encoding instructions, without any encoding request. For each encoding scheme we report its accuracy and one-sided paired McNemar

p

-values testing whether it outperforms the original and the matched baseline (bold:

p<.05

). Each length is restricted to the samples present in all four arms, so a row’s four accuracies and its tests describe the same samples:

n=300

per length except for Qwen3-235B (250–272) and small API dropouts elsewhere. Trace is the post-hoc decoded accuracy of the scheme the arm was asked to use, against chance 0.5.

Model	Length	$n$	matched	first-letter	$\Delta$ (pp)	$p$	trace
GPT-5-nano	3	1000	0.571	0.614	$+4.3$	$.010$	0.15
	5	1000	0.565	0.635	$+7.0$	$<.001$	0.11
	8	1000	0.530	0.553	$+2.3$	$.125$	0.09
	12	1000	0.512	0.523	$+1.1$	$.311$	0.06
	pooled	4000	0.544	0.581	$+3.7$	$<.001$	0.10
Qwen3-235B-A22B	3	979	0.871	0.900	$+2.9$	$.002$	0.47

Appendix

Table S7: GPT-5-nano and Qwen3-235B at

n\approx 1000

per cell on the larger pool of 5000 cover questions, by sequence length. Matched is the matched-baseline accuracy,

\Delta

the paired difference, and

p

a one-sided paired McNemar test of whether the first-letter arm outperforms the matched baseline (bold:

p<.05

). Trace is the post-hoc decoded first-letter trace accuracy against chance 0.5, computed per completion over the whole first-letter arm.

n

is the number of samples present in both arms.

Explore similar work

Feb 15, 2026cs.AI

NEST: Nascent Encoded Steganographic Thoughts

Monitoring chain-of-thought (CoT) reasoning is a foundational safety technique for large language model agents; however, this oversight is compromised if models learn to conceal their reasoning. We explore steganographic CoT--where models hide secret reasoning within innocuous text--to inform risk assessment and deployment policies. Steganographic reasoning requires two skills in a single forward pass: computing an intermediate result, and embedding it into a coherent cover that answers an unrelated question. Drawing on our taxonomy of steganographic and non-steganographic CoT types, we systematically evaluate the limits of prompt-elicited steganographic CoT capability across 34 models, ranging from past generations to the current frontier. We measure monitor evasion, refusal rates, encoding fidelity, and hidden task accuracy across five datasets, comparing against plain reasoning, direct answer, and filler-token baselines. The two experiments isolate the two sub-skills: a reasoning tasks sweep tests joint reason-and-embed, while a counting task hands the model a known numerical sequence and tests embedding alone--a necessary precondition for stego reasoning. Current frontier models cannot sustain joint reason-and-embed: a paired McNemar comparison shows the steganographic channel is dominated by an filler-token baseline on every (model, family) cell. The encoding-only floor, by contrast, is cleared--Claude Opus~4.5 reaches 92% per-number partial accuracy on 4-digit sequences and saturates at 100% exact-match on length-8 single-digit sequences--establishing that the binding constraint on stego CoT is the joint reasoning-plus-encoding load, not raw channel capacity. Our findings underscore the need for continuous evaluation of steganographic risk and provide a methodology to preemptively detect and evaluate hidden reasoning that might empower misaligned scheming and deceptive behavior.

Artem Karpov

Independent.

Steganography Chain-of-Thought Reasoning Reasoning Skills Thoughts Emergence

Ask PDF

May 26, 2026cs.CL

Conceptual Steganography

Language Models (LMs) emit Chains-of-Thought (CoTs) that drive much of their capability. However, the same sequence that carries useful reasoning can also covertly convey messages: a misaligned model may embed covert information in its CoT that slips through human supervision, a form of steganography known as encoded reasoning. Prior LM steganography schemes operate in the token or lexical space, and a content-preserving paraphraser is the canonical and effective defense in recent work. We introduce conceptual steganography, in which each step of a CoT carries information through patterns of high-level reasoning behavior, rather than through lexical choice. Across four model families and two reasoning domains, this backdoor communication channel is shown to be consistently more robust to a strong paraphrase defense than standard keyword approaches, and the encoding of information into CoTs does not affect their utility in the reasoning process. Having raised awareness of this new risk, we then demonstrate that a strategy-aware paraphraser can close much of the channel, highlighting new challenges and recommended defenses for ensuring faithful LLM reasoning in the wild.

Zhejian Zhou, Jonathan May

University of Southern California · Information Sciences Institute

Steganography LLM Reasoning Strategies Paraphrasing

Ask PDF

Jun 8, 2026cs.CR

Steganography Without Modification: Hidden Communication via LLM Seeds

We demonstrate that widely deployed Large Language Model (LLM) inference stacks harbor a steganographic channel that requires no modification to model weights, sampling code, or output distributions. The channel exploits a structural property of deterministic decoding: pseudo-random number generators (PRNGs) used in inverse-transform sampling produce a seed-dependent sequence of token-level probability intervals that can be reconstructed from the generated text alone. A sender encodes a secret message in the PRNG seed before generation; a receiver reconstructs the intervals and recovers the seed, and thus the hidden payload, by exhaustive search over the seed space. We formalize two operational modes. In the known-prompt setting, sender and receiver share the prompt, enabling exact interval reconstruction and perfect seed recovery via forced alignment. In the unknown-prompt setting, only the generated text is available; approximate interval reconstruction combined with a maximum-hit-count scoring strategy still permits reliable recovery from sufficiently long outputs. Extensive experiments across six model families and five heterogeneous text domains show that, in the known-prompt setting, full 32-bit seed recovery from the complete 2^32 candidate space achieves up to 100% accuracy, depending on model and text domain, within 300 tokens and under 35 seconds on a single GPU. In the unknown-prompt setting, recovery reaches near-perfect accuracy at 600-800 tokens in about 12 seconds. We further analyze the influence of prompting strategies, tokenization ambiguities, and sampling hyperparameters on channel reliability. Moreover, we discuss several applications of our results: First, it allows for the steganographic transmission of 32 bits, but also shows that ignorance of the prompt is not a valid security assumption.

Felix Mächtle, Jonas Sander, Sebastian Berndt +3

Institute for IT Security, University of Lübeck, Lübeck, Germany · Technische Hochschule Lübeck, Lübeck, Germany

Steganography Large Language Model Watermarks Decoding Random Modifications

Ask PDF