Researchers have shown that AI chatbots can be made to smuggle hidden messages through normal-looking text - without the sender and receiver sharing the same prompt.
Previous logit-level steganography schemes needed both parties to start from an identical prompt, a requirement that falls apart in production systems using retrieval-augmented generation or hidden system instructions. The new method, called Synchronized Logit Steering, sidesteps that by rebuilding a proxy prompt from the generated text itself, letting sender and receiver land on matching probability distributions independently. Tested on ShareGPT, GSM8K, and SWE-bench Verified, the technique's proxy and true prompt distributions converge within 0.5 nats of KL divergence once about 40 tokens have been generated. A periodic-burst variant pushes capacity to roughly 0.20 bits per token, about ten times denser than a single-payload approach, and statistical tests found the encoded outputs nearly indistinguishable from normal greedy generation.
That last point is the one worth sitting with. Content moderation and data-loss-prevention tools that scan AI output for anomalies generally assume tampered text looks statistically off. If this holds up outside a lab, that assumption stops being reliable, and covert channels through public-facing chatbots become a realistic exfiltration route rather than a theoretical one.
This is a single arXiv preprint, not a peer-reviewed result or a demonstrated attack against a live product, so treat the capacity numbers and detection-evasion claims as promising rather than settled.