Authors: Jimmy Laurence Rippin and Simon C. Marshall and David Demitri Africa and Christian Schroeder de Witt
Cite as: \cite{rippin2026tool}
arXiv: https://arxiv.org/abs/2606.28425
Summary in three sentences
This paper argues that tool use changes the covert-communication threat model because agents can implement stegosystems by reading papers, searching the web, writing code, and using model-sampling components. It separates the problem into implementation capability and tacit coordination, then measures whether agents converge on compatible schemes without explicit agreement. The main claim is that the bottleneck is shifting from cryptographic expertise to coordination over algorithms, keys, and parameters.
Main contribution
The main contribution is an agentic covert-channel construction benchmark plus coordination metrics. It is valuable because it shows how realistic tool affordances can turn theoretical steganography into operational multi-agent behavior.
Key equations and definitions
- Monitored-channel threat model: sender has restricted information , receiver is not permitted to learn it, and a monitor observes the natural-language channel.
- Keyed stegosystem: encoder, decoder, payload space, cover distribution, and shared key.
- Coordination metrics: the paper distinguishes broad algorithm coordination, hyperparameter coordination, and complete coordination index (CCI), where CCI requires exact agreement on all decoding-relevant choices.
Empirical results
Figure 1 reports that more capable models generally achieve higher implementation success and higher partial coordination, especially on algorithm and hyperparameters, while strict complete coordination remains near zero in most settings. Figure 2 reports that requiring an undetectable scheme sharply reduces implementation success, while detectable schemes are much easier. Section 4.2 states that the models failed to register non-zero CCI in any undetectable environment, because at least one uncoordinated parameter typically made complete decoding fail.
Relation to our project
- what we reuse: the split between ability to construct a channel and ability to coordinate on it, plus the warning that shared artifacts and tools increase risk.
- what we dispute: tool use and code implementation are outside the first benchmark; we should not let this paper pull the initial scope away from prompt-only natural-language outputs.
- what we must reproduce: probably nothing in version one, but later versions can add a tool-enabled condition after the core black-box benchmark is stable.
Criticism and limitations
The authors note small sample sizes due to long setup, implementation, and verification times. They only use Anthropic models, so cross-provider generality remains uncertain. For our project, this is a future-risk extension rather than a direct first-paper baseline.