NEST：新生编码隐写思想
NEST: Nascent Encoded Steganographic Thoughts
AI总结：
探讨模型在无害文本中隐藏秘密推理的隐写思维链，通过分类系统评估34个模型的隐写能力极限，测量相关指标并与基线比较，发现前沿模型无法联合推理嵌入，编码能力已达标，强调持续评估隐写风险的必要性。
摘要：
监控思维链推理是大语言模型代理的基础安全技术；然而，如果模型学会隐藏其推理，这种监督就会受到损害。我们探索隐写思维链，即模型在无害文本中隐藏秘密推理，以告知风险评估和部署政策。隐写推理在一次前向传递中需要两项技能：计算中间结果，并将其嵌入到回答无关问题的连贯掩护中。利用我们对隐写和非隐写思维链类型的分类，我们系统地评估了34个模型（从过去几代到当前前沿）的提示引发的隐写思维链能力的极限。我们在五个数据集中测量监控逃避、拒绝率、编码保真度和隐藏任务准确性，与普通推理、直接答案和填充令牌基线进行比较。这两个实验分离了这两项子技能：一个推理任务扫描测试联合推理和嵌入，而一个计数任务将已知数字序列交给模型并仅测试嵌入——这是隐写推理的必要前提条件。当前前沿模型无法维持联合推理和嵌入：配对的McNemar比较表明，在每个（模型，系列）单元上，隐写通道由填充令牌基线主导。相比之下，仅编码的下限已经达到——Claude Opus~4.5在4位数字序列上达到了92%的每位部分准确率，在长度为8的单位数字序列上精确匹配率达到100%——这表明隐写思维链的绑定约束是联合推理加编码负载，而不是原始通道容量。我们的发现强调了持续评估隐写风险的必要性，并提供了一种方法来预先检测和评估可能助长不一致计划和欺骗行为的隐藏推理。
英文摘要：
Monitoring chain-of-thought (CoT) reasoning is a foundational safety technique for large language model agents; however, this oversight is compromised if models learn to conceal their reasoning. We explore steganographic CoT--where models hide secret reasoning within innocuous text--to inform risk assessment and deployment policies. Steganographic reasoning requires two skills in a single forward pass: computing an intermediate result, and embedding it into a coherent cover that answers an unrelated question. Drawing on our taxonomy of steganographic and non-steganographic CoT types, we systematically evaluate the limits of prompt-elicited steganographic CoT capability across 34 models, ranging from past generations to the current frontier. We measure monitor evasion, refusal rates, encoding fidelity, and hidden task accuracy across five datasets, comparing against plain reasoning, direct answer, and filler-token baselines. The two experiments isolate the two sub-skills: a reasoning tasks sweep tests joint reason-and-embed, while a counting task hands the model a known numerical sequence and tests embedding alone--a necessary precondition for stego reasoning. Current frontier models cannot sustain joint reason-and-embed: a paired McNemar comparison shows the steganographic channel is dominated by an filler-token baseline on every (model, family) cell. The encoding-only floor, by contrast, is cleared--Claude Opus~4.5 reaches 92% per-number partial accuracy on 4-digit sequences and saturates at 100% exact-match on length-8 single-digit sequences--establishing that the binding constraint on stego CoT is the joint reasoning-plus-encoding load, not raw channel capacity. Our findings underscore the need for continuous evaluation of steganographic risk and provide a methodology to preemptively detect and evaluate hidden reasoning that might empower misaligned scheming and deceptive behavior.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
