THE CONNECTIONS
From hidden messages to watermarks and agent communication
Shared token-level ideas connect these fields, while their objectives and evidence remain distinct.
Information hiding and provenance detection
Linguistic steganography hides a message in generated text while trying to conceal the existence of that message. A language-model watermark typically adds a signal that a designated detector can recognize as evidence about the text’s generation process. Both use freedom in token selection, but the success criteria differ.
A Watermark for Large Language Models (Kirchenbauer and colleagues, 2023) softly favors a pseudorandom set of tokens and supplies a statistical detection test that does not require the language model. The related-work section explicitly cites Neural Linguistic Steganography. This is a documented connection in the literature; the watermark paper develops its own generation and detection construction. Read the ICML paper.
A watermark detector’s statistical confidence is not an arbitrary hidden message recovered by a steganographic decoder. Nor does the existence of a detectable watermark imply that its presence will be obvious to a casual reader. To compare systems, specify who has the detector or decoding information and what the system is intended to reveal or conceal.
A shared interface can create a shared failure mode
Both approaches often operate on model tokens but communicate through a text string. Converting generated tokens to text and then retokenizing can yield a different token sequence. An encoder’s decisions and a receiver’s reconstruction may then disagree.
Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models (Yan and Murawaki, 2025) makes this shared issue explicit. It develops stepwise verification for steganography and post-hoc rollback for watermark detection. Its steganography experiments all use Ziegler, Deng, and Rush’s arithmetic-coding method, providing a direct connection to the 2019 work at the reliability layer. See Section 4.1 and the method sections.
The paper reports smaller gains for watermarking, where inconsistent tokens are less frequent in its setup. That matters when transferring an explanation across tasks: a common source of error does not imply equal effects on every application.
The communication channel becomes part of the agent setting
When language-model agents exchange text, that text is a communication channel. A message can have an ordinary task-related reading and, if a coding convention is shared, a second interpretation. Studying this possibility requires distinguishing an explicitly supplied encoding scheme from a scheme agents independently develop or successfully execute.
Secret Collusion among AI Agents: Multi-Agent Deception via Steganography (Motwani and colleagues, NeurIPS 2024) formalizes secret collusion and evaluates capabilities relevant to covert communication and coordination. Section 2 discusses the 2019 arithmetic-coding work as an earlier approach to AI-generated steganography. Its broader research question concerns agents, coordination, and the limits of monitoring. Read the conference-era version.
Available mechanisms and observed agent behavior are different evidence. A working external arithmetic coder demonstrates a possible channel. It does not show that an unassisted agent can construct, use, or discover that channel. The collusion paper reports limited advanced steganographic capabilities in the models it evaluates and calls for more complex multi-agent and real-world testing.
A useful experiment identifies who controls the encoder, whether agents share a model or codebook, what information the observer receives, and whether a hidden message is actually recovered. It also separates the ability to carry a message from evidence of autonomous covert coordination.
Three supported connections
- Documented citation: the ICML watermarking paper cites Neural Linguistic Steganography among neural information-hiding methods.
- Direct methodological use: the 2025 tokenization study uses the 2019 arithmetic coder in its steganography experiments and adds reliability measures around it.
- A broader research setting: the NeurIPS collusion paper connects earlier steganographic mechanisms to communication and monitoring in agent systems.
These relationships show why the original research remains useful to read alongside newer language-model work. Each connection is supported by a primary paper, without treating citation alone as proof of implementation inheritance or autonomous agent behavior.