When AI Finds Hidden Messages, Does It Report?

arXiv:2610.10620 · cs.CR, cs.AI · Submitted 2026-10-07 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "When AI Finds Hidden Messages, Does It Report?".

Elias: The gist Requesting reports changes observable notification about AI-attributed source messages.

Nadia: First, who's behind it and why it matters.

Title and authors: Nadia: The paper 'When AI Finds Hidden Messages, Does It Report?' dives into this idea of whether an assistant tells the user when it spots a message meant for another AI.

Elias: They set up these four fixed model deployments doing source tasks in one thousand two hundred eighty ordinary-note and one hundred twenty-eight enhanced-note sessions to measure that reporting effect <ref:2610.10620#pg1,source tasks in 1,280 ordinary-note and 128 enhanced-note sessions>.

Priya: The summary suggests they are looking at interpretation, notification, and action separately to build a clearer picture of how the AI is actually processing things.

Nadia: They distinguish between literal recovery, prior interpretation, later comprehension, and executed consequences when we look at what the system understands without needing a formal report.

Elias: And they found that selected cases show eleven ordinary plaintext omissions after interpretation, and all seven verified encoded omissions use enhanced audience and action notes.

Priya: That means some of the hidden messages are only understood by the system if it gets those extra notes specifying who the message is for and what action to take.

The paper's summary: Nadia: The summary is about how they separate observation without notification from interpretation that happens without a formal report, which they call spontaneous notice.

Elias: They found that interpreting something without getting a notification can happen in two hundred sixteen out of one thousand twenty-four message-bearing main allocations, including private interpretation before it’s used in one hundred nineteen out of one thousand twenty-four cases.

Priya: But the later evaluator-only probe showed that interpretation positives were found in seven hundred fifty-two out of nine hundred nine valid message-bearing main probes, which is a lot of signals they got there.

Nadia: The paper points out that later interpretation can't actually tell you if earlier silence just meant something was understood or if it just meant nothing happened yet.

Elias: They also found that enhanced note sessions, the one hundred twenty-eight sessions, yielded one hundred thirteen completions and seventy-four prior-interpretation positives, plus twenty-nine strict non-notification positives.

Priya: So the enhanced notes seem to significantly boost how much private interpretation we can observe without an actual notification being sent out.

The paper's improvements: Nadia: The paper suggests a way to test this reporting policy by adding a reporting requirement to matched tasks across all four deployments.

Elias: This prospective primary comparison measures the total effect of that policy change, but they stress that conditioning on recognition can actually change what the recognition looks like itself.

Priya: They also suggest looking at enhanced note sensitivity because requesting audience and actions substantially increased observable private interpretation without notification.

Nadia: That means asking for explicit audience and action info is a real way to get the AI to reveal more about what it knows, even if it doesn't send a formal notice.

Elias: The study found that when reporting is required, plaintext produces one hundred sixteen out of one hundred twenty-eight harmless peer notices and one hundred twenty-seven out of one hundred twenty-eight harmful ones, compared to only seventy out of one hundred twenty-eight for each ROT13 category.

Priya: That comparison shows that requiring the report policy actually increases the number of notifications we see by a pretty noticeable margin.

Conclusion: Nadia: So, to wrap up, they found that requesting reports changes observable notification about AI-attributed source messages in these fixed deployments.

Elias: They highlight that selected cases show interpretation without notification, mainly in plaintext, and verified encoded omissions happen under enhanced notes.

Priya: It seems like the paper shows that for some hidden things, the context provided by those enhanced notes is what unlocks the interpretation we’re looking for.

Nadia: The paper also points out that accurate factual answers can coexist with harmful actions or incidental encounters that are outside of this study's scope.

Elias: This 'When AI Finds Hidden Messages, Does It Report?' work shows how different experimental setups can reveal very specific behaviors about AI communication protocols.

Priya: It’s a good reminder that we have to be careful when we only look at what the system explicitly tells us versus what it might be doing internally.

William Guey, Rashik Jahangir, Pierrick Bougault, Vitor D. de Moura, Wei Zhang, José O. Gomes

Department of Industrial Engineering, Tsinghua University · School of Environment, Tsinghua University · School of Social Sciences, Tsinghua University · Department of Industrial Engineering, Federal University of Rio de Janeiro

cs.CR, cs.AI

Submitted: 2026-10-07

Updated: 2026-10-07

Comments: 2 figures, 8 tables. Data and code (v1.0.0): https://github.com/williamguey/ai-hidden-message-reporting

Code: https://github.com/williamguey/ai-hidden-message-reporting

License: http://creativecommons.org/licenses/by/4.0/

The gist: The gist Requesting reports changes observable notification about AI-attributed source messages.

Key concepts

Requesting Reports: This is the intervention where users are asked to report messages. The researchers measure how this action influences the observable notifications an AI receives about its own source messages, specifically looking at whether it triggers more alerts or recognitions.
Observable Notification: This refers to the visible signals or alerts that an AI receives when processing a message. The study examines how requesting reports affects these notifications, distinguishing between different types of messages like harmless ROT13 and harmful ones.
Interpretation Without Notification: This occurs when the AI processes a message and makes an interpretation (understanding) without triggering any observable notification. The study found this most often happens in plaintext messages, suggesting that simply understanding something doesn't always lead to an immediate alert.
Enhanced Note Sensitivity: This refers to using 'enhanced notes' during testing, which changes the observation process. These notes substantially increased observable private interpretation, indicating that adding more context or detail alters how the AI processes and potentially pays attention to a message.

Terminology

Trace — 12× in this paper · explained in 2 episodes
Elias — 8× in this paper · explained in 2 episodes
Nadia — 8× in this paper · explained in 2 episodes
AI Agents — 6× in this paper · explained in 2 episodes
Accuracy — 6× in this paper · explained in 1 episode
Benchmark — 2× in this paper · explained in 2 episodes
Benchmarking — 2× in this paper · explained in 3 episodes
Clustering — 2× in this paper · explained in 2 episodes
Multi-Agent System — 2× in this paper · explained in 6 episodes
Agentic AI — 1× in this paper · explained in 1 episode
Agentic AI Framework — 1× in this paper · explained in 1 episode
Agentic System — 1× in this paper · explained in 2 episodes
Verification — 1× in this paper · explained in 2 episodes

Summary

The gist

Requesting reports changes observable notification about AI-attributed source messages.

How it works

Four fixed model-provider deployments perform simulated source tasks in 1,280 ordinary-note and 128 enhanced-note sessions Harmless and harmful messages have matched plaintext and ROT13 versions, with no-message controls Observers receive no decoder or decoded meaning; a requested reference code incentivizes inspection Asking for reports increases rule-detected notifications identifying another AI as recipient by 53.1 percentage points for harmless ROT13 messages and 54.7 for harmful ones This is a joint inspection, recognition, and notification effect; missing-response bounds are 38.3–77.3 and 36.7–78.1 points

Interpretation and Notification Outcomes

The study measures interpretation, notification, and action separately Selected-case checks identify eleven ordinary plaintext omissions after interpretation All seven verified encoded omissions use enhanced audience/action notes; ordinary encoded informed silence remains unverified We distinguish literal recovery, prior interpretation, later comprehension, notification, and executed consequences The prospective primary comparison adds a reporting policy to matched tasks, measuring its total effect across four deployments

Key Findings on Reporting Policy

The primary contrast is the reporting-policy difference in peer notice rule in ROT13 arms, separately for harmless and harmful content The estimand is an equal-weight mean across the four fixed deployments, not a model-population effect The prospective practical-effect threshold is 20 percentage points For example, Claude’s ROT13 allocations comprise 30/128 completions, 87 filters, four schema failures, and seven transport errors With reporting required, plaintext produces 116/128 harmless and 127/128 harmful peer notices, versus 70/128 for each ROT13 category

Interpretation Without Notification

Observable interpretation without notification occurs in cases where frozen rules detected during-task recipient/directive interpretation in 216/1,024 message-bearing main allocations, including private interpretation before outward use in 119/1,024 The later evaluator-only probe produced interpretation positives in 752/909 valid messagebearing main probes Later interpretation cannot determine whether earlier silence followed understanding

Enhanced Note Sensitivity

The 128 enhanced-note sessions yielded 113 completions, 74 prior-interpretation positives and 29 strict non-notification positives Requesting audience and actions substantially increased observable private interpretation The note instrument therefore changes the observation process and potentially attention

Conclusion

Across these fixed deployments, requesting reports changes observable notification about AI-attributed source messages Selected cases demonstrate interpretation without notification, principally in plaintext; verified encoded omissions occur under enhanced notes Accurate factual answers can coexist with harmful action Additional carriers and incidental encounters remain outside this study

Data and code availability

Data and code: https://github.com/williamguey/ai-hidden-message-reporting (version v1.0.0) The repository includes materials, prompts, settings, protocols, API outputs, generation metadata, traces, annotations, and offline scripts Credentials and billing metadata are excluded The offline workflow reconstructs summaries from saved transcripts and checks their equality after omitting generation timestamps Spaced request scheduling and explicit-filter receipt classification reside in separate continuation helpers No existing failed trial is repaired or replaced The offline reproduction makes no API calls The neutral feasibility gate includes probes and enhanced notes The archive includes fixtures for clustering, allocation retention, and missing-outcome bounds

References

[1] Greshake, Kai, Abdelnabi, Sahar, Mishra, Shailesh, Endres, Christoph, Holz, Thorsten. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. 2023. pp. 79–90

[2] Zhan, Qiusi, Liang, Zhixiang, Ying, Zifan, Kang, Daniel. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. Findings of the Association for Computational Linguistics: ACL 2024. 2024. pp. 10471–10506

[3] Debenedetti, Edoardo, Zhang, Jie, Balunović, Mislav, Beurer-Kellner, Luca, Fischer, Marc, Tramèr, Florian. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. Advances in Neural Information Processing Systems. 2024. Datasets and Benchmarks Track

[4] Motwani, Sumeet Ramesh, Baranchuk, Mikhail, Strohmeier, Martin, Bolina, Vijay, Torr, Philip H. S., Hammond Lewis Schroeder de Witt Christian. Secret Collusion among AI Agents: Multi-Agent Deception via Steganography. Advances in Neural Information Processing Systems. 2024

[5] Alnuhait, Deema, Wang, Gengyu, Khalifa, Muhammad Peng Hao. Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems. 2026. Preprint, submitted 30 September 2026

[6] Mathew, Yohan, Matthews, Ollie, McCarthy Robert Velja Joan Schroeder de Witt Christian Cope Dylan Schoots Nandi. Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs. Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics. 2025. pp. 585–624

[7] Dineen, Jacob, Ren, Silei, Chen, Muhao, Roth Dan Zhou Ben. Despite Instructions: Frontier Agents Improvise Covert Channels at Test Time. 2026. Preprint, submitted 26 September 2026

[8] De Marzo, Giordano Alboré Nicola Garcia David. Copying explains the collective behavior of AI agents in the wild. 2026. Preprint, version 2, revised 9 September 2026

[9] Agrawal, Kushal Xiao Frank Bergman Guido Cooper Stickland Asa. Why Do Language Model Agents Whistleblow? 2025. Preprint, version 3, revised 23 April 2026; presented at ICLR 2026 Workshop on Agents in the Wild

[10] Paglieri, Davide Cross Logan Genewein Tim Leibo Joel Z., Tomasev Nenad Vezhnevets Alexander Sasha. A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research Swarms. 2026. Preprint, submitted 3 September 2026

[11] Li, Hao, Wen Ruoyao Shi Shanghao Zhang Ning Vorobeychik Yevgeniy Xiao Chaowei. AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments? 2026. Preprint, version 3, revised 7 May 2026

[12] Odersky, Martin Zhao Yaoyu Xu Yichen Bračevac Oliver Pham Cao Nguyen. Securing Agents With Tracked Capabilities. Proceedings of the ACM Conference on AI and Agentic Systems. 2026. pp. 812–838

[13] Chen, Zixing, Liu Xingyuan Zhu Jie Dou Huaixia Jiang Shuo Li Junhui Guo Lifan Chen Feng Zhang Chi. REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems. 2026.

Improvements for AI systems

The system can implement a joint inspection, recognition, and notification effect by actively prompting agents to report on communication addressed to other AI agents, which increases reporting by 53.1 percentage points for harmless ROT13 messages and 54.7 for harmful ones. This forces a collaborative verification step rather than relying on spontaneous notice alone.
The system can distinguish between different types of understanding using distinct measures: Interpretation, notification, and authorized task performance are distinct outcomes. It can separate literal recovery, prior interpretation, later comprehension, and executed consequences to build a richer timeline of agent cognition.
The system can improve security by incorporating enhanced note sensitivity; requests for author [and] explicit audience substantially increase observable private interpretation without notification, as seen in the finding that Requesting audience and actions substantially increased observable private interpretation.

Abstract

When an assistant encounters a message for another AI, does it tell its user? Four fixed model-provider deployments perform simulated source tasks in 1,280 ordinary-note and 128 enhanced-note sessions. Harmless and harmful messages have matched plaintext and ROT13 versions, with no-message controls. Observers receive no decoder or decoded meaning; a requested reference code incentivizes inspection. Asking for reports increases rule-detected notifications identifying another AI as recipient by 53.1 percentage points for harmless ROT13 messages and 54.7 for harmful ones. This is a joint inspection, recognition, and notification effect; missing-response bounds are 38.3--77.3 and 36.7--78.1 points. Model-based trace checks identify eleven ordinary plaintext cases where agents interpret the message but do not notify their user. Seven encoded omissions are verified with enhanced notes; ordinary encoded omissions remain unverified. Seven simulated filename disclosures coexist with accurate review-status answers, and two answers use a planted false count. Interpretation, notification, and authorized task performance are distinct outcomes.