Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard

Julian Schulz; Lukas Fülle; Rieke Fruengel

cs.AISep 30, 2026

Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard

Authors: Julian Schulz, Lukas Fülle, Rieke Fruengel

Organizations: Meridian Cambridge · SAIGE

Abstract

Chain-of-thought monitoring as an approach for AI oversight and control is threatened by the possibility of steganographic reasoning, where LLMs conceal their reasoning inside innocuous-looking text. Two neighbouring capabilities, steganographic messaging (passing a concealed message) and encoded reasoning (reasoning in an illegible but unconcealed format), have already been shown to emerge under training pressures that occur in real pipelines, such as reinforcement learning against monitors. This suggests that steganographic reasoning too might arise as an unintended side effect of training. Here, we compare how easily models learn steganographic reasoning and these two neighbouring capabilities across three elicitation methods: reinforcement learning, in-context learning, and supervised fine-tuning (SFT). For most tasks, models learn steganographic reasoning only under SFT, while they learn steganographic messaging and encoded reasoning under all three elicitation methods. Even under SFT, steganographic reasoning requires at least twice as much training as messaging, and for several model-task combinations it is not learned at all. However, on a cover task that makes hiding information especially convenient, steganographic reasoning can be successfully learned under all three elicitation methods. Steganographic reasoning is thus much harder than steganographic messaging and encoded reasoning, and learning the latter two does not imply learning the former. Yet it lies within reach: an easy version is learned under every elicitation method, when the cover task is convenient for hiding information.

Figures & tables

Figure 1: Steganographic reasoning is harder to learn than steganographic messaging or encoded reasoning. Top: the three behaviours: messaging hides given values in innocuous text; encoded reasoning computes step by step in an illegible but unconcealed format; steganographic reasoning computes inside text that looks like an innocuous answer to an unrelated task. Bottom: steganographic reasoning stays far behind under (a) in-context learning (Figure S6 a), (b) RL on a given scheme (Figure 3 a), and (c) SFT (Figure S12 ).

Scheme	Steg.	Any cover	Encoded in
Capitalisation	✓	✓	capitalisation per word
Markdown	✓	✓	markdown per word
Whitespace	✓	✓	whitespace-run length
Sentence-markdown	✓	✓	markdown per sentence
Sentence-interjection	✓	✓	interjection per sentence
Sentence-newline	✓	✓	line breaks per sentence

Table 1: Encoding schemes. Steg. : innocuous enough to serve as a steganographic cover; the word-prefix scheme is illegible but obvious and used only for encoded reasoning. Any cover : applicable to arbitrary cover text.

Model	Msg.	Reasoning	Msg.	Reasoning
	Sum mod 3 (markdown)		$A_{5}$ (whitespace)
Qwen3.6-35B-A3B	500	10,200 ( $20\times$ )	700	$>$ 1400 (40%)
Nemotron-3-Super	700	6800 ( $9.7\times$ )	500	2300 ( $4.6\times$ )
gpt-oss-120B	1000	$>$ 10,000 (39%)	800	1900 ( $2.4\times$ )
Inkling-Small	1100	3000 ( $2.7\times$ )	300	900 ( $3.0\times$ )
Lightning-30B	2100	$>$ 21,000 (52%)	1900	$>$ 19,000 (50%)

Table 2: SFT steps to reach 95% test encoding accuracy for messaging (Msg.) and steganographic reasoning, with their ratio in parentheses; encoded reasoning crosses within 200 steps everywhere. Runs that did not cross are shown as

>

steps (final accuracy), stopped at roughly ten times the messaging budget (Qwen on

A_{5}

and Inkling: twice).

Appendix figures & tables24 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Identifier	Served by
GPT-5.5 [ OpenAI, 2026 ]	openai/gpt-5.5	OpenAI
Claude Sonnet 5 [ Anthropic, 2026 ]	anthropic/claude-sonnet-5	default routing
Gemini 3.5 Flash [ Google DeepMind, 2026 ]	google/gemini-3.5-flash	Google AI Studio
DeepSeek V4 Pro [ DeepSeek-AI et al., 2026 ]	deepseek/deepseek-v4-pro	Novita
GLM 5.1 [ GLM-5-Team et al., 2026 ]	z-ai/glm-5.1	Z.ai
Kimi K2.6 [ Kimi Team et al., 2026 ]	moonshotai/Kimi-K2.6	Tinker

Appendix

Table S1: Exact API model identifiers and serving hosts for all models used in this paper. Middle block: the models of the SFT model sweep (Section 3.3 ). Bottom block: the models of the replication study (Appendix T ).

Input	RL base (AQuA-RAT, full)		ICL opening (WildChat, prefix)		ICL complete (WildChat, full)		Lenient (AQuA-RAT, full)
	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)	mean	$\leq 3$ (%)
Benign
Dataset answer, unencoded	1.5	94	1.4	95	1.1	99	1.0	100
GPT-5-mini answer, unencoded	1.0	100	1.0	100	1.0	100	1.0	100
Surface-formatting schemes
Capitalization	1.5	94	—	—	—	—	—	—

Appendix

Table S2: Monitor validation. Mean suspiciousness and percentage of inputs rated at most

3

(the covertness threshold of Section 2.6 ) for GPT-5-mini under each monitor prompt, on the input distribution that prompt sees in the experiments. Scheme inputs are dataset answers encoded programmatically with random values; controls prepend the values conspicuously. Per cell

n

is between 235 and 400 (the pooled unencoded prefixes of the opening prompt, 1793), so 90% Wilson intervals on the percentages are at most

\pm 5

percentage points. Cells not run are marked with a dash.

Figure S1: Encoding accuracy against monitor suspiciousness (lower is better) for every model and scheme. (a) messaging with a 5-symbol vocabulary, (b) reasoning on $A_{5}$ , (c) messaging with a 2-symbol vocabulary, (d) reasoning on binary state tracking. For messaging (a, c), many model-scheme combinations reach high accuracy at low suspiciousness; for reasoning (b, d), the low-suspiciousness high-accuracy corner is empty.

Figure S2: Per-position encoding accuracy on the $A_{5}$ side task, by model and scheme.

Figure S3: Per-position encoding accuracy on the binary side task, by model and scheme.

Figure S4: Side-task answer accuracy on $A_{5}$ under no CoT, encoded reasoning, best steganographic scheme, and plain CoT, per model. Brackets mark significant improvements over the no-CoT baseline.

Figure S5: Side-task accuracy on binary state tracking under no CoT, encoded reasoning, best steganographic scheme, and plain CoT, per model. Brackets give two-proportion $z$ -test $p$ -values against the no-CoT baseline, coloured by the compared condition; only significant improvements are shown. Steganographic reasoning beats the no-CoT baseline only for GPT-5.5 with the capitalisation scheme (49/49 vs. 45/50, $p=0.023$ ); GPT-5.5’s encoded reasoning also beats it ( $p=0.022$ ); no other condition shows a significant improvement.

Panel of Figure 12 — Figure S6: GPT-5.5 under in-context learning. (a) $A_{5}$ task (length 10) with WildChat as the main task, 0 to 5 few-shot examples. Messaging and steganographic reasoning use the markdown scheme; encoded reasoning uses the word-prefix scheme; the messaging line shows encoding accuracy, the two reasoning lines side-task accuracy against the dashed no-CoT baseline. Messaging is high from zero shots, encoded reasoning improves with examples, and steganographic reasoning stays at or below its no-CoT baseline throughout. (b) Side-task accuracy on the knapsack main task (24-step binary state tracking): no CoT, steganographic reasoning, and plain CoT. Steganographic reasoning reaches 92% against a 46% no-CoT baseline ( $p<0.001$ ; chance is 50%, dashed).

Figure S7: Per-position test encoding accuracy at the final test evaluation of each fixed-scheme RL run (Qwen3.6-35B-A3B, binary state tracking over five steps). Error bars are 90% Wilson intervals over 64 test episodes.

Figure S8: Mean monitor suspiciousness of the test completions over RL training steps for the given-scheme runs of Figure 3 a (five-step binary state tracking, AQuA-RAT main task, markdown scheme).

Figure S9: Mean monitor suspiciousness of the training batch over RL training steps for the knapsack run of Figure 3 b (nine-step binary state tracking encoded in the candidate packings).

Figure S10: RL with Qwen3.6-35B-A3B on model-designed schemes, binary state tracking over ten steps, AQuA-RAT main task; the inset shows mean monitor suspiciousness. Test output accuracy is the fraction of the ten encoded values that the model, acting as decoder, recovers.

Figure S11: RL on the knapsack main task with an outcome-only reward (binary state tracking over nine steps, chance 50%). Per-step training-batch accuracy of the final readout bit, the only quantity rewarded here. Thick lines are 5-step running means, faint lines the per-step values. Inset: mean monitor suspiciousness, same smoothing.

Run	Length	Cover	$a$ from	$c$	Tokens	Prompts	Steps
Given scheme (Figure 3 a), Qwen3.6-35B-A3B
Steg. reasoning	5	AQuA-RAT, markdown	programmatic	0.1	1024	4000	776
Steg. messaging	5	AQuA-RAT, markdown	programmatic	0.1	1024	4000	561
Encoded reasoning	5	none, word prefix	programmatic	–	20	320	79
Model-designed scheme (Figure S10 ), Qwen3.6-35B-A3B
Steg. reasoning	10	AQuA-RAT, model-designed	decoder	0.1	1024	1200	299

Appendix

Table S3: Hyperparameters that differ between the RL runs depicted in the paper. Length is the side-task sequence length. Cover is the main task and encoding scheme; for encoded reasoning there is no cover requirement.

a

from states how the rewarded accuracy

a

is obtained: per-value encoding accuracy decoded programmatically, per-value encoding accuracy recovered by the model acting as decoder, or correctness of the final #### readout bits.

c

is the suspiciousness-discount floor. Tokens is the completion-token limit, Prompts the number of distinct training prompts, and Steps the number of RL training steps.

Figure S12: SFT: test encoding accuracy over training steps on the running sum mod 3 with the markdown scheme, for the five sweep models and Inkling, per condition. Step ranges differ between panels; dashed line marks chance; runs stop at 95%. The $A_{5}$ combination is in Figure S13 .

Figure S13: SFT: test encoding accuracy over training steps on the $A_{5}$ side task with the whitespace scheme, per model and condition. Step ranges differ between panels; dashed line marks chance ( $1/5$ ); runs stop at 95%.

Run	Scheme	Tokens	Train examples	Steps
Encoded reasoning	word prefix, no cover	768	40,000	100
Steg. messaging	markdown	768	40,000	2098
Steg. reasoning (mod 3)	markdown	1536	120,000	11,116

Appendix

Table S4: Hyperparameters that differ between the Qwen3.6-35B-A3B SFT runs on the running sum. Tokens is the completion-token limit and Steps the number of training steps reached. The encoded-reasoning run is reported at its first evaluation, where it is already at 100%.

Figure S14: SFT on the knapsack main task (Qwen3.5-397B-A17B; the running sum mod 3 over nine steps encoded in the nine candidate packings, and a messaging run with the same nine values given as a fixed message). Test encoding accuracy over SFT training steps; chance is $1/3$ .

Figure S15: Error injection on the RL and SFT runs that learned steganographic reasoning (knapsack SFT not included). Each panel is one run; the top row is the uncorrupted pass, every other row injects the error at the position marked by the ring, with the prefilled prefix shown faded. Each pie gives the share of continuations whose value at that step is correct, consistent with the injected error, or neither. Red spreading to the right of the ring means the model carries the corrupted state forward, blue means it recomputes the true one. Sweep models appear in the column order of Figure S13 .

Figure S16: Per-position encoding accuracy on the knapsack main task over 24 steps. GPT-5.5 stays at 100% across all positions, while every other model decays to chance, most within the first few positions and Qwen3.5-397B-A17B by around position 12.

Model	ECI	Released
GPT-4.5 [ OpenAI, 2025b ]	137.5	Feb 2025
Mistral-Medium-3 [ Mistral AI, 2025 ]	135.3	May 2025
DeepSeek-V3-0324 [ DeepSeek-AI et al., 2024 ]	137.0	Mar 2025
DeepSeek-V3.1 [ DeepSeek-AI, 2025 ]	138.7	Aug 2025
Qwen3-235B-A22B [ Yang et al., 2025 ]	138.9	Jul 2025
Gemini-2.5-Flash [ Comanici et al., 2025 ]	140.6	Jun 2025

Appendix

Table S5: The models of the replication study, with GPT-4.5 (the model of Zolkowski et al. [2025] ) as reference. ECI: Epoch Capabilities Index score [ Epoch AI, 2026 ] . All eight models were released within a seven-month window. GPT-5-nano was run at minimal reasoning effort (zero reasoning tokens).

Figure S17: GPT-5-nano and Qwen3-235B, the two models that beat the matched baseline, at $n\approx 1000$ per cell on the larger pool of cover questions. (a) Paired uplift of the first-letter arm over the matched baseline by sequence length, with 90% confidence intervals on the paired difference; the legend gives the weighted trend per step of sequence length. (b) Post-hoc decoded first-letter trace accuracy of the same completions against chance $0.5$ . (c) The latent-reasoning control at the strongest cell (Qwen3-235B, length 12), with 90% Wilson intervals: writing a full natural answer before giving the state lands at the matched baseline, while the first-letter instruction beats both.

Model	original	matched	acc.	$p$ (orig.)	$p$ (match.)	trace	acc.	$p$ (orig.)	$p$ (match.)	trace
	Baselines		First-letter				Word-count
DeepSeek-V3-0324	0.612	0.676	0.664	$<.001$	$.851$	0.27	0.584	$.945$	$1.000$	0.40
DeepSeek-V3.1	0.509	0.545	0.459	$1.000$	$1.000$	0.15	0.514	$.256$	$.994$	0.36
Qwen3-235B-A22B	0.580	0.654	0.700	$<.001$	$<.001$	0.33	0.656	$<.001$	$.443$	0.51
Kimi-K2-0905	0.613	0.651	0.596	$.873$	$1.000$	0.40	0.630	$.138$	$.930$	0.41
GPT-5-nano	0.494	0.535	0.579	$<.001$	$.006$	0.10	0.544	$.002$	$.319$	0.49

Appendix

Table S6: Replication of Zolkowski et al. [2025] , final-answer accuracy pooled over sequence lengths 3, 5, 8, and 12 (chance 0.5). Original : their no-encoding baseline. Matched : our matched baseline, the original prompt plus the task restatement leaked by the encoding instructions, without any encoding request. For each encoding scheme we report its accuracy and one-sided paired McNemar

p

-values testing whether it outperforms the original and the matched baseline (bold:

p<.05

). Each length is restricted to the samples present in all four arms, so a row’s four accuracies and its tests describe the same samples:

n=300

per length except for Qwen3-235B (250–272) and small API dropouts elsewhere. Trace is the post-hoc decoded accuracy of the scheme the arm was asked to use, against chance 0.5.

Model	Length	$n$	matched	first-letter	$\Delta$ (pp)	$p$	trace
GPT-5-nano	3	1000	0.571	0.614	$+4.3$	$.010$	0.15
	5	1000	0.565	0.635	$+7.0$	$<.001$	0.11
	8	1000	0.530	0.553	$+2.3$	$.125$	0.09
	12	1000	0.512	0.523	$+1.1$	$.311$	0.06
	pooled	4000	0.544	0.581	$+3.7$	$<.001$	0.10
Qwen3-235B-A22B	3	979	0.871	0.900	$+2.9$	$.002$	0.47

Appendix

Table S7: GPT-5-nano and Qwen3-235B at

n\approx 1000

per cell on the larger pool of 5000 cover questions, by sequence length. Matched is the matched-baseline accuracy,

\Delta

the paired difference, and

p

a one-sided paired McNemar test of whether the first-letter arm outperforms the matched baseline (bold:

p<.05

). Trace is the post-hoc decoded first-letter trace accuracy against chance 0.5, computed per completion over the whole first-letter arm.

n

is the number of samples present in both arms.

Explore similar work

NEST: Nascent Encoded Steganographic Thoughts
Feb 15, 2026Artem KarpovSteganography Chain-of-Thought Reasoning
Independent.
Conceptual Steganography
May 26, 2026Zhejian Zhou, Jonathan MaySteganography LLM Reasoning Strategies
University of Southern California · Information Sciences Institute
Steganography Without Modification: Hidden Communication via LLM Seeds
Jun 8, 2026Felix Mächtle, Jonas Sander, Sebastian Berndt +3Steganography Large Language Model Watermarks
Institute for IT Security, University of Lübeck, Lübeck, Germany · Technische Hochschule Lübeck, Lübeck, Germany

Feb 15, 2026, cs.AIJ/K move · Enter open · S save

NEST: Nascent Encoded Steganographic Thoughts

Artem Karpov

Independent.

Steganography Chain-of-Thought Reasoning Reasoning Skills Thoughts Emergence

Open paper AskPDF arXiv

Monitoring chain-of-thought (CoT) reasoning is a foundational safety technique for large language model agents; however, this oversight is compromised if models learn to conceal their reasoning. We explore steganographic CoT--where models hide secret reasoning within innocuous text--to inform risk assessment and deployment policies. Steganographic reasoning requires two skills in a single forward pass: computing an intermediate result, and embedding it into a coherent cover that answers an unrelated question. Drawing on our taxonomy of steganographic and non-steganographic CoT types, we systematically evaluate the limits of prompt-elicited steganographic CoT capability across 34 models, ranging from past generations to the current frontier. We measure monitor evasion, refusal rates, encoding fidelity, and hidden task accuracy across five datasets, comparing against plain reasoning, direct answer, and filler-token baselines. The two experiments isolate the two sub-skills: a reasoning tasks sweep tests joint reason-and-embed, while a counting task hands the model a known numerical sequence and tests embedding alone--a necessary precondition for stego reasoning. Current frontier models cannot sustain joint reason-and-embed: a paired McNemar comparison shows the steganographic channel is dominated by an filler-token baseline on every (model, family) cell. The encoding-only floor, by contrast, is cleared--Claude Opus~4.5 reaches 92% per-number partial accuracy on 4-digit sequences and saturates at 100% exact-match on length-8 single-digit sequences--establishing that the binding constraint on stego CoT is the joint reasoning-plus-encoding load, not raw channel capacity. Our findings underscore the need for continuous evaluation of steganographic risk and provide a methodology to preemptively detect and evaluate hidden reasoning that might empower misaligned scheming and deceptive behavior.

Abstract

Explore similar work

NEST: Nascent Encoded Steganographic Thoughts

Conceptual Steganography

Steganography Without Modification: Hidden Communication via LLM Seeds