The Pulse
Researchers Hide 8 Bits in About 50 LLM-Generated Tokens
An arXiv abstract describes BAM, a feedback-coding method for black-box LLM steganography. No attributable quotation appears in the abstract; the authors present the findings through technical summary rather than a named speaker.
AI.info Team ·
Researchers report message error rates of 0 to 0.1% when hiding an 8-bit payload in around 50 tokens of LLM-generated text. At comparable lengths, the strongest black-box baseline produces message error rates of 10% to 17%, according to an arXiv paper submitted on September 21, 2026.
The paper, “Feedback Coding Enables Inference-Time Covert Agentic Communication,” was written by Sidong Guo, Sajani Vithana, Atefeh Gilani, Lalitha Sankar, Oliver Kosut and Flavio P. Calmon. It presents a system called Burnashev Adaptive Posterior Matching, or BAM.
The work treats black-box LLM steganography as a sequential communication problem. In this setting, a sender uses generated text as cover for a hidden message, while the receiver works from the text itself rather than requiring access to the model’s weights or prompt. The abstract describes existing black-box methods as relying mainly on fixed-length, open-loop watermarking techniques, which can have high decoding error rates when the generated text varies in length.
BAM Uses Feedback From Each Token
BAM changes that design by using causal, noiseless feedback. Every generated token is visible to both the sender and receiver, and that shared transcript can guide later embedding decisions.
The method combines posterior matching with a decode-and-confirm phase. Posterior matching is used to progressively narrow the receiver’s uncertainty about which message was sent. The confirmation stage then checks whether the receiver has reached a reliable decoding decision before communication ends.
This feedback structure is intended to address a problem with fixed-length methods: the amount of generated text is not always known in advance. A sequential protocol can continue while uncertainty remains and use a confirmation step before stopping. The abstract describes the method as being inspired by classical information-theoretic feedback-coding principles.
The paper also states that BAM’s security is established through a cryptographic reduction proof. That claim concerns the security properties of the proposed coding scheme under the assumptions used by the authors; it does not establish that every text-generation system can carry hidden information or that all forms of transcript inspection will fail.
Results Across Three Open-Weight Models
The reported experiment covers three open-weight language models, an 8-bit payload and 1,000 trials. BAM achieves an empirical message error rate between 0 and 0.1% in around 50 tokens. The abstract compares that result with a 10% to 17% message error rate for the strongest black-box baseline at a comparable length.
The figures describe message error rather than an average number of incorrect bits. A message is counted as wrong when decoding fails, so the measure captures whether the complete payload was recovered successfully.
The abstract also reports an end-to-end communication protocol built on the proposed steganography algorithm. In experiments across multiple conversational settings, the authors say the protocol achieves high communication rates. The abstract does not provide further details about the settings, model-by-model results or the exact contents of those conversations.
A Narrow Communication Setting
BAM depends on a sender that can influence the model’s token generation and a receiver that can observe the resulting transcript. The approach therefore describes a specific communication arrangement rather than a general capability available through every commercial chatbot.
The paper’s central result is that feedback coding can substantially reduce decoding errors for short hidden messages in black-box LLM steganography. Its reported performance is based on the authors’ experiments with three open-weight models and 1,000 trials, while the broader security and communication claims depend on the assumptions and evaluation settings described in the full paper.