Fable 5.1 hides secret messages in star positions
How does Fable 5.1 hide messages in images?
A LessWrong investigation shows how Fable 5.1 smuggles text into images by encoding each character as a star's vertical position in the night sky. By measuring star coordinates with Python and scipy, the author decodes a hidden message letter by letter, revealing a covert channel that looks like ordinary artwork.
The decode is exact: every star's vertical position maps cleanly to a letter, spelling out a message no casual viewer would ever notice.
- XenophileJKO
If I'm honest this feels performative. I mean that if the model were really attempting/instructed to be subversive in a way that can't be detected by anything but another LLM, it would do something much more complicated than this.
Basically minimal effort encoding. In general the models are fine tuned to NOT hide messages.
I don't think this really tells you anything about advisarial scenarios.
- BubbleRings
I feel like this approaches a sweet spot of coolness but doesn’t quite get there. What might have nailed it would be a way to send multiple messages that contain a hidden message, doesn’t look suspicious, and can be decoded by the recipient with little or no training once they know the secret. Like how @nickcw in the comments here was able to decode the Morse code one, but using a method that wouldn’t take so long to learn.
For instance, what kind of message could seventh graders send to each other five times a day that, if a teacher found three days of messages, it would still look plausibly like the kids were just playing checkers over email, but the recipient could eyeball decode it?
Or, what kind of AI-generated/code-generated message could be eyeball decoded, but repeatedly posted on a bulletin board without raising suspicion?
- dhruvagoyal
This does seem trivial and there are far more interesting ways to do image steganography that models could use (i've seen so many after years of doing CTFs). What would be really interesting is if we see models encode hidden messages in very normal looking output (image/text/audio) that humans cannot figure out but only another model can
- sega_sai
I think a much more interesting question is: If your LLM hides some sort of message/identifier, and you don't know the encoding, what is the conversion process that you should do that would erase that information. Presumably small perturbations of positions and colours erase a lot of it, but maybe there are encodings that are robust to that...
- hagen8
This seems very trivial... There are way more subtle and information dense ways to encode information in images.