# Early Signs of Steganographic Capabilities in Frontier LLMs

arXiv: https://arxiv.org/abs/2507.02737 · HTML: https://mlsanity.com/paper/2507.02737/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Jul 2025.

## Built on by (most cited first, 19 of 19)

- [Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability](https://mlsanity.com/paper/2510.19851/) (2025)
- [Measuring Chain-of-Thought Monitorability Through Faithfulness and Verbosity](https://mlsanity.com/paper/2510.27378/) (2025)
- [A Pragmatic Way to Measure Chain-of-Thought Monitorability](https://mlsanity.com/paper/2510.23966/) (2025)
- [Analyzing and Improving Chain-of-Thought Monitorability Through Information Theory](https://mlsanity.com/paper/2602.18297/) (2026)
- [A Decision-Theoretic Formalisation of Steganography With Applications to LLM Monitoring](https://mlsanity.com/paper/2602.23163/) (2026)
- [Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMs](https://mlsanity.com/paper/2602.08563/) (2026)
- [State over Tokens: Characterizing the Role of Reasoning Tokens](https://mlsanity.com/paper/2512.12777/) (2025)
- [Chain-of-thought obfuscation learned from output supervision can generalise to unseen tasks](https://mlsanity.com/paper/2601.23086/) (2026)
- [Unsupervised decoding of encoded reasoning using language model interpretability](https://mlsanity.com/paper/2512.01222/) (2025)
- [A Concrete Roadmap towards Safety Cases based on Chain-of-Thought Monitoring](https://mlsanity.com/paper/2510.19476/) (2025)
- [SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoors](https://mlsanity.com/paper/2511.14301/) (2025)
- [Despite Instructions: Frontier Agents Improvise Covert Channels at Test Time](https://mlsanity.com/paper/2609.32701/) (2026)
- [NEST: Nascent Encoded Steganographic Thoughts](https://mlsanity.com/paper/2602.14095/) (2026)
- [Risk Reporting for Developers' Internal AI Model Use](https://mlsanity.com/paper/2604.24966/) (2026)
- [CoT-Guard: Small Models for Strong Monitoring](https://mlsanity.com/paper/2605.12746/) (2026)
- [SchemeArena: Factorized Stress Testing of Scheming in LLM Agents](https://mlsanity.com/paper/2609.08126/) (2026)
- [Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection](https://mlsanity.com/paper/2609.15989/) (2026)
- [Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning](https://mlsanity.com/paper/2609.31121/) (2026)
- [Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hard](https://mlsanity.com/paper/2609.39838/) (2026)

## Abstract (arXiv)

Monitoring Large Language Model (LLM) outputs is crucial for mitigating risks from misuse and misalignment. However, LLMs could evade monitoring through steganography: Encoding hidden information within seemingly benign generations. In this paper, we evaluate the steganography capabilities in frontier LLMs to better understand the risk they pose. We focus on two types of steganography: passing encoded messages and performing encoded reasoning. We find that current models are unable to encode short messages in their outputs without a monitor noticing under standard affordances. They can succeed, however, if given additional affordances like using an unmonitored scratchpad and coordinating on what encoding scheme to use. We additionally find early signs that models can perform basic encoded reasoning in a simple state-tracking problem. This includes some ability to reason with their own and pre-defined schemes, including encoding schemes such as Hexadecimal. Despite this, they can rarely hide reasoning subtly within a cover task to fool a monitor. Overall, our results indicate that current LLMs exhibit nascent steganographic capabilities. While these capabilities are likely insufficient to bypass well-designed monitors at present, this could change in the future.