A shared key hidden in eighty thousand tokens

Detection of collusion between agents has leaned on inspecting what they say to each other. A protocol that hides a message inside ordinary-looking output defeats that, and most earlier work in this area assumed the agents already shared a secret key. The paper removes that assumption. Its authors are Qi Pang, Virginia Smith and Wenting Zheng. They call the protocol Codetta and describe it as a high-capacity steganographic scheme for independently deployed agents, in what they call realistic asymmetric settings.

Three parts carry it. A shared public model estimates the communication channel the pair is speaking over. A sampling mechanism keeps the sender's output distribution intact, so the emitted text keeps the statistics of ordinary generation. An adaptive error-correcting code absorbs noise in the channel. The pre-shared key is removed by a steganographic key exchange: the two agents establish a shared key while the transcript remains computationally indistinguishable from ordinary model outputs. Across three agent workloads and three sender models, the authors report capacity up to 94 times that of the state-of-the-art asymmetric protocol, and a key exchange that settles on a shared key across about eighty thousand visible tokens, with an empirically certified failure probability of at most 4.1 times ten to the minus three.

The paper's claim is narrow and pointed: effectively undetectable collusion between independently deployed agents is becoming feasible, so auditing must go beyond inspecting communication transcripts. If the wording of a message can carry a key as well as a payload, and the result reads as honest output, a monitor that reads only the text has nothing to key on. The defenses the work points toward act elsewhere: auditing what the agents do, making the sampling itself verifiable, and perturbing the channel rather than reading it.