Hacker News Reader

Comment by hagen8 | Hacker News Reader

This seems very trivial... There are way more subtle and information dense ways to encode information in images.

Yes, this is like something I would do for a DnD bit. But I have this experience often, that LLMs will suggest the easy toy version of doing something. But it knows the real stuff too, it just needs the right kind of prompting. A keyword or two, and it will find the _real_ solution.

I think this maybe used to be true but no longer. With the right harness extremely prompts like "find all the vulnerabilities in php" are very effective. No fancy prompting required.

Well yeah, but that's because the harness is iteratively using the model to massage the prompt and feed it back. It's not magic; prompting is the only interface it has, so "fancy prompting" is what it automates for you.

Agreed, this is the kind of steganography that is meant for humans to read. There's no reason a computer couldn't encode meaningful information in the least significant bytes of every 16th pixel or something like that.

The article is about what LLMs can do when generating SVG images, not bitmaps. I think the reason for that is that LLMs can generate the XML text for SVG directly. The implications for AI safety are different, because there might not be any code involved that we can examine. So LLMs could start exchanging hidden messages without humans knowing about it.

But now that I think about it that way, it would probably be more interesting to see what kind of steganography LLMs would use in ordinary text. There's no reason to involve images.

> The implications for AI safety are different

Like when your printer adds secret massages for cops? https://en.wikipedia.org/wiki/Printer_tracking_dots

> Like when your printer adds secret massages for cops

That's not going to have a happy ending...

I've assumed this is why printers are so hell-bent on having internet connectivity: a link between the printed ID and IP address.

>The article is about what LLMs can do when generating SVG images, not bitmaps.

Aha... that is an interesting distinction. I did not think of that. Alongside this, it means you could resize the image and not lose the information.

> to see what kind of steganography LLMs would use in ordinary text.

Isn't the "watermarking" of LLM text already an example?

That watermarking is not something the LLM chooses to add, neither through training nor in response to any prompt. This article is about the choices LLMs make when explicitly told to hide messages.

You are missing the point. The goal is not to find good ways to do steganography, or get the models to do the best possible steganography. The point is to naturalistically observe their initial impulses towards weak simple cooperative steganography, to try to get an idea of where any 'steganographic left turn' would begin and what it would look like and perhaps how one would go about detecting or preventing it or looking for it out in the wild, etc. OP was perfectly clear about this:

>This could be a precursor to steganography in images. Currently, the act of decoding the hidden messages is still obvious if you monitor the tool calls of the decoding model, so we don't claim it is currently dangerous.

Might be effective against humans. A typical person might see it, say "Gross, an AI slop image" and scroll on past.

I'm finding it hard to blame the article for anything because I don't really see it asserting much. It asked the models to encode/decode and showed the results. I don't really see the point. The results are things hard for a human to find but easy for an LLM.

>We highlight ways that a language model can encode messages in images. These can be decoded by the same language model even if no information about the encoding method is passed.

>Still, the encoded messaging was surprisingly hard to spot. This phenomenon was interesting to us, so we are sharing this to get feedback on next steps.

I guess the interesting thing to me, who doesnt have deep expertise in image stenogrpahy, is that the models encoded the information within the image's "semantics" (not sure if there is a better term). It actually steered the implementation/how it looked rather than hiding it in every nth pixel or whatever. And that it's kind of interesting that it coudl decode it but at the same time if it's used to encode and picks from a common set of ways that it would search a similar set of ways on decode. The lack of differences across models (still very succesful) is more intersting because it implies something like similarity in training material, natural limits, or just similar local optimums.

Reply on news.ycombinator.com