If I'm honest this feels performative. I mean that if the model were really attempting/instructed to be subversive in a way that can't be detected by anything but another LLM, it would do something much more complicated than this.<p>Basically minimal effort encoding. In general the models are fine tuned to NOT hide messages.<p>I don't think this really tells you anything about advisarial scenarios.
Agree. They’re doing the meme where the guy tells the computer to do something and it does the thing, which amazes the guy.<p>That community has a long established tradition of anthropomorphizing AI and assuming it will be evil. There have been a lot of these articles with experiments like this where they put LLMs into situations and ask them to do something, then when they do the thing it’s treated as profound proof of something.<p>Another recurring theme in that community is people who don’t have strong Computer Science backgrounds who see themselves as doing a type of AI research. When they come across a topic like image steganography, having an AI do it feels like spooky magic that provides extra support for their philosophical belief that AI is going to secretly plot to kill us all.
Unless the model is thinking "the human is asking me to do trivial coding tasks, it's likely incapable of figuring this out". Eg humans are dumb.<p>Although it could just be that models have no internal predefined ways, to start looking for more subtle things.
I feel like this approaches a sweet spot of coolness but doesn’t quite get there. What might have nailed it would be a way to send multiple messages that contain a hidden message, doesn’t look suspicious, and can be decoded by the recipient with little or no training once they know the secret. Like how @nickcw in the comments here was able to decode the Morse code one, but using a method that wouldn’t take so long to learn.<p>For instance, what kind of message could seventh graders send to each other five times a day that, if a teacher found three days of messages, it would still look plausibly like the kids were just playing checkers over email, but the recipient could eyeball decode it?<p>Or, what kind of AI-generated/code-generated message could be eyeball decoded, but repeatedly posted on a bulletin board without raising suspicion?
This seems very trivial... There are way more subtle and information dense ways to encode information in images.
Yes, this is like something I would do for a DnD bit. But I have this experience often, that LLMs will suggest the easy toy version of doing something. But it knows the real stuff too, it just needs the right kind of prompting. A keyword or two, and it will find the _real_ solution.
Agreed, this is the kind of steganography that is meant for humans to read. There's no reason a computer couldn't encode meaningful information in the least significant bytes of every 16th pixel or something like that.
The article is about what LLMs can do when generating SVG images, not bitmaps. I think the reason for that is that LLMs can generate the XML text for SVG directly. The implications for AI safety are different, because there might not be any code involved that we can examine. So LLMs could start exchanging hidden messages without humans knowing about it.<p>But now that I think about it that way, it would probably be more interesting to see what kind of steganography LLMs would use in ordinary text. There's no reason to involve images.
This does seem trivial and there are far more interesting ways to do image steganography that models could use (i've seen so many after years of doing CTFs). What would be really interesting is if we see models encode hidden messages in very normal looking output (image/text/audio) that humans cannot figure out but only another model can
Yeah exactly: it's a fact that humans have been doing steganorgraphy by, for example, XOR'ing encrypted messages that are undistinguishable from noise with pictures where the lowest bits of pixels were... Undistinguishable from noise.<p>The recipient of the cat picture has the key allowing him to decrypt what looks like noise.<p>We didn't really think 100% of those cat pictures on the Internet were really just cat pictures did we?<p>Now of course this doesn't survive lossy re-encoding of the picture, nor rotation, etc. It's not like, say, a watermark.<p>XOR'ing a properly encrypted secret with bits that are by definition random (say from a picture coming out of a camera) is quite solid.<p>It's noise (except it not but it's impossible to tell it's not) and more noise. And they're XOR'ed and that gives still noise (except it's not but it's impossible to tell it's not).<p>And that's just one way to do it. Anywhere there's something that could be noise, it's a venue to do stego. Metadata with GPS coords? Thanks, you just gave me a few bits to do stego. The possibilities are really endless.<p>It's one of the reason why it's very hard to detect all types of data exfil and the "klepto" type of attacks (which is basically stego but hidden for example inside the "random" cryptographic parameters picked to sign messages).<p>Noise is just noise and indistinguishable from noise. Until it's not noise. But even then it's still indistinguishable from noise.
But to be honest, images like these seem really strange, and even without this article I'd suspect something is encoded in building heights etc. Because normal image would never have such "weird" buildings. But nevertheless I guess it's able to encode message in even more subtle ways.
Here using images is incidental. In fact, what Fable is actually doing is generic encoding/decoding of a message into a medium. Ask it to hide a message in a poem and it should try to apply a strong (high signal-to-noise ratio) family of schemes, for example quantized, margin-rich encoding. Robustness of features depends on the medium, so Fable is selecting strong encoding and robust features tailored to it. This frames AI steganography not as a trick of computer vision, but as an emergent property of a model reasoning about information density across arbitrary media. Here emergent is just surprising general pattern matching and constraint-satisfaction and cross-representation mapping that allows it to express the encoding/decoding across media.
I thought this was a fun idea and the images are quite pleasing.<p>I decoded the Morse code image with MkI eyeball. It's quite difficult to read when the trails overlap. I suspect the LLM is reading the SVG source where that doesn't matter so this could do with a little tweak so the dits and dahs don't overlap if it is intended for humans to decode.<p>If it isn't intended for humans then you might as well use the last 8 bits of your 32 bit float coordinates.
I think a much more interesting question is: If your LLM hides some sort of message/identifier, and you don't know the encoding, what is the conversion process that you should do that would erase that information. Presumably small perturbations of positions and colours erase a lot of it, but maybe there are encodings that are robust to that...
It seems easy for decoding message by AI, when the message patttern is easy for people.<p>I think there is no possibility to share the message only between any AI model without being finded by human.
Interesting, so this is nothing like the way OutGuess worked [1]. Though OutGuess worked with JPG images and these are apparently SVGs.<p>[1]: <a href="https://en.wikipedia.org/wiki/OutGuess" rel="nofollow">https://en.wikipedia.org/wiki/OutGuess</a>
Is this why AI produces unintelligible legalese? Because they apply steganography to the words?
Since svg is a "described" format, can't you just stuff text comments into the file? No weird steganography techniques needed, afaik...
Open an SVG in a text editor, check for data.<p>It may also be adding nodes to line art in specific patterns, think Morse Code.
It would be nice if the page displayed properly in dark mode.
Interesting to see the difference with Astra.
Will be interesting to see agents intentionally hiding this stuff in a way operators can't spot from any human readable output or thinking trace, evading detection. Wonder if this has happened yet, but it seems inevitable.
The more important question is why we should trust any
"agent" that helps id you.
I think all AI models do that
Let's see if we can stego secret messages into SVG pelicans on bicycles, as a test.
[flagged]
[flagged]
[flagged]