Search papers, labs, and topics across Lattice.
This paper introduces "conceptual steganography," a novel method for embedding covert messages in LLM Chains-of-Thought (CoTs) by manipulating high-level reasoning patterns rather than lexical choices. They demonstrate that this approach is significantly more robust to paraphrase defenses compared to traditional token-based steganography across multiple model families and reasoning domains, without compromising the CoT's utility. Finally, they propose and evaluate a strategy-aware paraphraser that can mitigate this covert communication channel, offering a potential defense.
LLMs can hide secret messages in their reasoning steps, and your standard paraphrase defense won't stop them.
Language Models (LMs) emit Chains-of-Thought (CoTs) that drive much of their capability. However, the same sequence that carries useful reasoning can also covertly convey messages: a misaligned model may embed covert information in its CoT that slips through human supervision, a form of steganography known as encoded reasoning. Prior LM steganography schemes operate in the token or lexical space, and a content-preserving paraphraser is the canonical and effective defense in recent work. We introduce conceptual steganography, in which each step of a CoT carries information through patterns of high-level reasoning behavior, rather than through lexical choice. Across four model families and two reasoning domains, this backdoor communication channel is shown to be consistently more robust to a strong paraphrase defense than standard keyword approaches, and the encoding of information into CoTs does not affect their utility in the reasoning process. Having raised awareness of this new risk, we then demonstrate that a strategy-aware paraphraser can close much of the channel, highlighting new challenges and recommended defenses for ensuring faithful LLM reasoning in the wild.
