Independent testing will determine whether Steganeur's token-choice encoding provides a reliable and practically usable covert channel in natural-looking LLM-generated text.
state: expiredheat: lowuncertainty: highconvergesscott: mediumllm-steganography covert-channels model-securityMarc Snid
What is this?
Steganeur is described in the supplied case as Rust software by Marc Snid that encodes secret messages through an LLM’s token choices, aiming to produce natural-looking carrier text. The web snippets establish that LLM-generated text can theoretically and experimentally serve as a covert channel, with capacity tied to token-distribution entropy, and that related protocols can encode messages in plausible text. However, none of the supplied results independently tests Steganeur itself, so its reliability, detectability, and practical usability remain unverified here.
Why it matters to Scott
If independently validated, Steganeur would expose a concrete way for untrusted models or agents to smuggle data through apparently benign text, extending Scott’s SiloOS and padded-cell threat model to the outbound language channel itself. That could require output-channel controls beyond ordinary auditing or capability gates, but the supplied evidence does not yet establish that the channel is reliable, covert, or operationally practical.
ip:framework.separation-of-powers-for-cognitionip:framework.siloosdev:concept.padded-cell-agent-architecturedev:project.silo-osradar:concept.llm-securityradar:concept.side-channel-attacksradar:concept.agent-security
queries asked of Scott's wikis
- LLM token-choice covert channels and data exfiltration
- steganography detection versus model output monitoring
- sampling controls, token entropy, and reproducible decoding
- agent security against hidden inter-agent communication
- LLM watermarking and steganographic channel tradeoffs
- covert-channel threat models for local and hosted models
Measured heat
no measured readings yet — the hourly heat pass fills this in
How the heat travelled
no chain yet — the hourly chain pass fills this in
Evidence (2) — ⭐ canonical anchor
Interpretation history
2026-08-23T18:30:54Z
The release has drawn no independent testing, implementation uptake, or discussion after the observation horizon, leaving the practical covert-channel claim unvalidated and with no near-term confirmation expected.
2026-08-21T17:53:19Z
No independent testing or implementation evidence has arrived, so the case remains a testable but unvalidated security hypothesis. The unchanged HN activity adds no corroboration or urgency.
2026-08-21T17:43:23Z
grounded: converges/medium — If independently validated, Steganeur would expose a concrete way for untrusted models or agents to smuggle data through apparently benign text, extending Scott
2026-08-21T17:40:25Z
origin walked (codex/luna, conf 0.98): anchor hn.story.49390543 -> echo.github.33d21784e2 by Marc Snider
2026-08-21T17:39:32Z
case created — The released Rust implementation makes the proposed model-mediated covert channel directly testable.
Decision trace
- 08-24 04:30expireThe release has drawn no independent testing, implementation uptake, or discussion after the observation horizon, leaving the practical covert-channel claim unvalidated and with no near-term confirmat
- 08-24 04:30alert_silentThis is only a staleness check with unchanged evidence; the original public release was already considered, and there is no new consequential delta to surface.
- 08-24 04:30alert_routeThis is only a staleness check with unchanged evidence; the original public release was already considered, and there is no new consequential delta to surface.
- 08-22 03:53repriceNo independent testing or implementation evidence has arrived, so the case remains a testable but unvalidated security hypothesis. The unchanged HN activity adds no corroboration or urgency.
- 08-22 03:53alert_silentThis look contains only an administrative re-evaluation and unchanged engagement; the established public release was already routed, with no new consequential delta to surface.
- 08-22 03:53alert_routeThis look contains only an administrative re-evaluation and unchanged engagement; the established public release was already routed, with no new consequential delta to surface.
- 08-22 03:48alert_shadowThe public Rust release provides a concrete, testable artifact for hiding data in apparently natural LLM output, directly relevant to outbound-channel controls in Scott’s agent containment work. The r
- 08-22 03:48alert_routeThe public Rust release provides a concrete, testable artifact for hiding data in apparently natural LLM output, directly relevant to outbound-channel controls in Scott’s agent containment work. The r
- 08-22 03:43groundIf independently validated, Steganeur would expose a concrete way for untrusted models or agents to smuggle data through apparently benign text, extending Scott’s SiloOS and padded-cell threat model t
- 08-22 03:40promote_anchororigin walk conf 0.98
- 08-22 03:39createThe released Rust implementation makes the proposed model-mediated covert channel directly testable.