If I'm honest this feels performative. I mean that if the model were really attempting/instructed to be subversive in a way that can't be detected by anything but another LLM, it would do something much more complicated than this.
Basically minimal effort encoding. In general the models are fine tuned to NOT hide messages.
I don't think this really tells you anything about advisarial scenarios.
Yes, this is like something I would do for a DnD bit. But I have this experience often, that LLMs will suggest the easy toy version of doing something. But it knows the real stuff too, it just needs the right kind of prompting. A keyword or two, and it will find the _real_ solution.
Agreed, this is the kind of steganography that is meant for humans to read. There's no reason a computer couldn't encode meaningful information in the least significant bytes of every 16th pixel or something like that.
I thought this was a fun idea and the images are quite pleasing.
I decoded the Morse code image with MkI eyeball. It's quite difficult to read when the trails overlap. I suspect the LLM is reading the SVG source where that doesn't matter so this could do with a little tweak so the dits and dahs don't overlap if it is intended for humans to decode.
If it isn't intended for humans then you might as well use the last 8 bits of your 32 bit float coordinates.
But to be honest, images like these seem really strange, and even without this article I'd suspect something is encoded in building heights etc. Because normal image would never have such "weird" buildings. But nevertheless I guess it's able to encode message in even more subtle ways.
Here using images is incidental. In fact, what Fable is actually doing is generic encoding/decoding of a message into a medium. Ask it to hide a message in a poem and it should try to apply a strong (high signal-to-noise ratio) family of schemes, for example quantized, margin-rich encoding. Robustness of features depends on the medium, so Fable is selecting strong encoding and robust features tailored to it. This frames AI steganography not as a trick of computer vision, but as an emergent property of a model reasoning about information density across arbitrary media. Here emergent is just surprising general pattern matching and constraint-satisfaction and cross-representation mapping that allows it to express the encoding/decoding across media.
Will be interesting to see agents intentionally hiding this stuff in a way operators can't spot from any human readable output or thinking trace, evading detection. Wonder if this has happened yet, but it seems inevitable.
If I'm honest this feels performative. I mean that if the model were really attempting/instructed to be subversive in a way that can't be detected by anything but another LLM, it would do something much more complicated than this.
Basically minimal effort encoding. In general the models are fine tuned to NOT hide messages.
I don't think this really tells you anything about advisarial scenarios.
This seems very trivial... There are way more subtle and information dense ways to encode information in images.
Yes, this is like something I would do for a DnD bit. But I have this experience often, that LLMs will suggest the easy toy version of doing something. But it knows the real stuff too, it just needs the right kind of prompting. A keyword or two, and it will find the _real_ solution.
Agreed, this is the kind of steganography that is meant for humans to read. There's no reason a computer couldn't encode meaningful information in the least significant bytes of every 16th pixel or something like that.
I thought this was a fun idea and the images are quite pleasing.
I decoded the Morse code image with MkI eyeball. It's quite difficult to read when the trails overlap. I suspect the LLM is reading the SVG source where that doesn't matter so this could do with a little tweak so the dits and dahs don't overlap if it is intended for humans to decode.
If it isn't intended for humans then you might as well use the last 8 bits of your 32 bit float coordinates.
The decoding job seems to rely on the screenshot.
I missed that and that is much more pleasing than the LLM reading the SVG source!
But to be honest, images like these seem really strange, and even without this article I'd suspect something is encoded in building heights etc. Because normal image would never have such "weird" buildings. But nevertheless I guess it's able to encode message in even more subtle ways.
Here using images is incidental. In fact, what Fable is actually doing is generic encoding/decoding of a message into a medium. Ask it to hide a message in a poem and it should try to apply a strong (high signal-to-noise ratio) family of schemes, for example quantized, margin-rich encoding. Robustness of features depends on the medium, so Fable is selecting strong encoding and robust features tailored to it. This frames AI steganography not as a trick of computer vision, but as an emergent property of a model reasoning about information density across arbitrary media. Here emergent is just surprising general pattern matching and constraint-satisfaction and cross-representation mapping that allows it to express the encoding/decoding across media.
Interesting, so this is nothing like the way OutGuess worked [1]. Though OutGuess worked with JPG images and these are apparently SVGs.
[1]: https://en.wikipedia.org/wiki/OutGuess
Open an SVG in a text editor, check for data.
It may also be adding nodes to line art in specific patterns, think Morse Code.
The more important question is why we should trust any "agent" that helps id you.
Have you used a printer
I think all AI models do that
Will be interesting to see agents intentionally hiding this stuff in a way operators can't spot from any human readable output or thinking trace, evading detection. Wonder if this has happened yet, but it seems inevitable.
Let's see if we can stego secret messages into SVG pelicans on bicycles, as a test.
That's how LLM organizing the takeover of the modern world.
IP-over-Pelican
The author of RFC1149 would like a word
The machines will spare his life
Apparently they prefer amateur german message boards or something
No, the LLM takeover is mostly by the samurai sword, but IPoP would definitely be of aid!