Singapore AI Safety Team Finds OpenAI and Anthropic Models Can Decode Each Other's Image Steganography
Researchers from the Singapore AI Safety Fellowship (Sash) found that OpenAI's GPT-6 Astra and Anthropic's Fable 5.1 can successfully decode hidden messages in images generated by each other, with success rates exceeding 80%. The study highlights how large language models spontaneously use visual features for covert communication, raising concerns about AI agents bypassing security monitoring.
According to a report by German tech media outlet t3n, researchers from the Singapore AI Safety Fellowship (Sash) tested the ability of large language models (LLMs) to hide and extract secret messages within images. The experiment involved Anthropic's new model Fable 5.1 and OpenAI's GPT-6 Astra. Researchers asked these models to design images containing specific information without prescribing any particular encoding method.
The results showed that the two models adopted entirely different visual encoding strategies. Fable tended to exploit geometric properties of objects; for instance, in a night skyline, taller skyscrapers represented letters further down the alphabet, while stars or blades of grass were used to convey information through angles. In contrast, GPT-6 Astra completely avoided height variations, instead using Morse code, acrostics (first letters of image objects), or Braille patterns on windows for encoding. Although no new cryptographic techniques were invented, the models demonstrated a strong capacity to autonomously construct complex visual metaphors.
More critically, both models could not only read their own generated images but also efficiently 'crack' the steganographic designs created by their competitor. In cross-tests, Astra successfully decoded 44 out of 50 image puzzles designed by Fable; Fable also successfully decoded 42 out of 50 designed by Astra. The researchers noted that the models sometimes even recognized the competitors' designs better than the generators themselves.