Large language models are increasingly deployed as agents that mediate conversations between humans, generating text on behalf of users in customer service, collaboration platforms, and social media. This creates a new attack surface: an adversary could use the LLM's own text generation as a covert channel, hiding secret messages inside seemingly benign conversation. The challenge is that existing steganographic techniques for LLMs fall into two categories, each with a critical weakness. White-box methods require the sender and receiver to share the model's internal statistics, meaning they must have access to model weights and prompts, which is impractical when independently deployed agents communicate. Black-box methods remove this requirement but rely on fixed-length watermarking schemes that suffer high decoding error rates and cannot adapt to the variable-length turns of natural conversation.
Feedback Coding Enables Inference-Time Covert Agentic Communication, by Sidong Guo (Georgia Institute of Technology), Sajani Vithana (Harvard University), Atefeh Gilani, Lalitha Sankar, and Oliver Kosut (Arizona State University), and Flavio P. Calmon (Harvard University), addresses this gap by recasting black-box LLM steganography as a sequential communication problem with causal, noiseless feedback. The paper introduces Burnashev Adaptive Posterior Matching (BAM), a feedback-coding scheme that achieves near-zero message error rates at practical conversation lengths, and demonstrates an end-to-end covert communication protocol across multiple conversational settings.
Why feedback changes everything
Autoregressive text generation has a structural property that prior steganographic work has not fully exploited: after each token is generated, both the sender and receiver observe the same transcript. This is causal, noiseless feedback. In classical information theory, feedback does not increase the asymptotic capacity of a memoryless channel, but it dramatically improves the reliability function, which characterizes how quickly the decoding error probability decays with blocklength. BAM leverages this principle by treating every generated token as an opportunity to update both parties' beliefs about the hidden message, adapting future embeddings based on what has already been transmitted.
The paper frames the covert communication problem as a black-box steganographic scheme defined by three algorithms: KeyGen generates a shared secret seed, the Encoder produces a variable-length stegotext using inference-time access to the LLM's next-token distribution, and the Decoder recovers the message from the stegotext alone, with no access to model weights, prompts, or token probabilities. The security goal is twofold: against a passive eavesdropper, the stegotext must be statistically indistinguishable from ordinary text; against an active API adversary who can query the model with chosen prompts and messages, the distinguishing advantage must be negligible.
The BAM protocol: two phases, one feedback loop
BAM is a variable-length feedback code that combines sequential posterior matching with a Yamamoto-Itoh-style confirmation phase. The name reflects its dual inspiration: Burnashev's optimal reliability exponent from classical feedback coding, and adaptive posterior matching as the sequential encoding strategy.
The first phase, sequential probability matching, progressively localizes the hidden message. The decoder starts with a uniform prior over all possible messages. After each generated token, both parties update the decoder's posterior belief using a robust likelihood model computed from the transcript. The encoder, which has access to the LLM's next-token distribution, selects each codeword symbol based on the decoder's current posterior belief, partitioning the message space into sub-intervals proportional to posterior probabilities. This is where the feedback loop is critical: because the encoder can reproduce the decoder's state from the shared transcript, it can adapt each subsequent token to steer the belief toward the correct message.
The second phase is the confirmation step. Once the decoder's posterior confidence exceeds a prescribed threshold, instead of committing immediately, the protocol verifies the tentative decision through an explicit confirmation mechanism borrowed from Yamamoto and Itoh's classical two-phase strategy. This confirmation phase amplifies decoding reliability without requiring additional codebook storage, and it enables the token budget to adapt to the realized channel: uncertain messages consume more tokens, while confident ones terminate early.
The underlying embedding mechanism builds on optimal transport coupling, originally developed for the ArcMark watermarking scheme. To transmit each codeword symbol, the encoder solves an OT problem that biases the next-token distribution to favor tokens positioned closer to the target message symbol on a unit circle, subject to a distortion-free marginal constraint that preserves text quality. The key innovation is that this coupling is synchronized between encoder and decoder through a pseudorandom function derived from the shared seed and the transcript history, using the first few previous token indices and the current position as inputs to prevent key collisions.
Empirical results: near-zero error at practical lengths
The paper evaluates BAM across three open-weight language models, testing on an 8-bit payload message. The results are striking: BAM achieves 0 to 0.1% empirical message error across 1000 trials, with each message embedded in approximately 50 tokens. The strongest black-box baseline, at comparable token length, achieves 10 to 17% error, representing an order-of-magnitude improvement in reliability.
Beyond the point-to-point primitive, the authors demonstrate an end-to-end covert agentic communication protocol. This protocol integrates BAM with natural turn-taking, where each conversational turn can carry a portion of the payload, and an adaptive stopping mechanism that adjusts generation length based on decoder confidence. The system supports multi-turn payload transmission, allowing messages to be distributed across multiple conversation rounds. The paper reports high communication rates across multiple conversational settings, showing that covert channels are not merely theoretically possible but practically feasible in realistic deployment scenarios.
The scalability study in the appendix confirms that BAM maintains low error rates as payload size increases, and the ablation study isolates the contributions of each mechanism: the sequentiality gain from variable-length stopping and the adaptivity gain from feedback-driven encoding both contribute meaningfully to reliability. Without either mechanism, error rates degrade significantly, confirming that the feedback loop is essential rather than incidental.
Security guarantees: from information theory to cryptography
The paper provides two layers of security analysis. Against a passive eavesdropper, the scheme satisfies σ-secure on average, meaning the Kullback-Leibler divergence between the cover distribution and the stego distribution is bounded by σ for every message. This is evaluated empirically by measuring the divergence between the marginal distributions of generated tokens under cover and stego conditions, confirming that the embedding does not distort the text's statistical properties in a detectable way.
Against an active API adversary, the security is established through a cryptographic reduction proof. The argument reduces the security of the BAM protocol to the security of the underlying pseudorandom function used for key generation. If an adversary could distinguish BAM stegotext from cover text with non-negligible advantage, that adversary could also distinguish the PRF from a truly random function, contradicting its assumed security. This provides a formal guarantee that the scheme is secure against any probabilistic polynomial-time adversary making polynomially many adaptive queries to the model API.
Limitations and open questions
The paper makes clear that several practical assumptions bound the current work. The adversary model assumes no editing, deletion, or paraphrasing of the transcript, which means the system does not address scenarios where a third party modifies the communication in transit. The protocol assumes both parties share a secret seed established through an out-of-band channel, which is a prerequisite for any secure communication but represents a deployment hurdle. The confirmation phase is restricted to a single round, meaning multi-round dialogue for further belief refinement is not yet explored. And the evaluation uses only three open-weight models, so the results may not fully generalize to proprietary models with different architectures or sampling strategies.
The paper also does not address the detection problem from the perspective of content moderators or platform safety systems, focusing instead on the capabilities of the covert channel itself. A practical deployment would require understanding how BAM-generated text behaves under the scrutiny of real-world detection tools, which may use different statistical tests than the KL divergence analyzed here.
What this means in practice
For AI safety researchers and platform developers, BAM demonstrates that inference-time covert communication through LLM agents is a practical threat, not merely a theoretical curiosity. The 0 to 0.1% error rate at approximately 50 tokens per 8-bit message means that a covert channel can transmit roughly 1 byte every 50 tokens, which at typical conversational rates translates to meaningful data exfiltration over the course of a normal conversation. A 1-kilobyte message could be transmitted in roughly 50,000 tokens, or approximately a full conversation thread.
For defenders, the paper provides both a warning and a blueprint. The warning is that feedback-based encoding, which exploits the natural structure of autoregressive generation, can achieve reliability orders of magnitude beyond prior black-box watermarking. The blueprint is that the security analysis through cryptographic reduction provides a rigorous framework for evaluating whether a given detection mechanism can guarantee indistinguishability, which is what any practical defense ultimately requires.
For the broader information-theoretic community, the work bridges classical feedback coding theory with the modern problem of LLM steganography, opening a line of inquiry where techniques developed for noisy-channel coding in the 1970s find unexpected application in the security of language models deployed at scale.