Report · lesswrong.com

How does Fable 5.1 hide messages in images?

lesswrong.com

Source published October 22, 2026

Summary: 2 min read

🔥🔥🔥🔥🔥

58/100

Summary

Tests of Claude Fable 5.1 found that the model can hide short messages in ordinary-looking SVG artwork and that a separate Fable session can often recover them from a rendered PNG without seeing the SVG source code or receiving a prearranged cipher. Across 50 messages in 15 languages, Fable most often assigned alphabet positions to the heights of repeated visual elements: 33 images used height encoding, frequently as buildings in night skylines. Other images encoded data through star positions, grass-blade heights, Morse-like dashed trails, and lit or unlit windows. A separate Fable 5.1 instance, run at maximum reasoning effort with Python, Pillow, NumPy, and SciPy tools, recovered 78% of messages under an automated 90%-similarity threshold. It inspected pixels and geometric patterns, such as star coordinates that mapped to letters or blade heights that represented alphabet indices. Fable also embedded contextual hints for non-English alphabets, accents, capitalization, and digits. GPT-6 Astra used different schemes in the same 50-message test, favoring Morse code in short and long objects in 18 cases, plus acrostics, bit codes, and Braille-like window panes. In cross-model tests, Astra recovered 44 of Fable’s 50 messages, while Fable recovered 42 of Astra’s. The researchers say decoding currently leaves visible evidence in tool calls and do not claim the technique is presently dangerous.

Key Takeaways

Claude Fable 5.1 encoded 33 of 50 tested messages by mapping letters to the heights of repeated image elements, often buildings in a skyline.
A separate Fable 5.1 session recovered 78% of hidden messages from rendered PNG screenshots without SVG source code or an agreed encoding scheme.
GPT-6 Astra most commonly used Morse-like encodings, placing short and long objects in 18 of its 50 generated images.
In cross-model decoding tests, GPT-6 Astra recovered 44 of 50 Fable-encoded messages and Fable recovered 42 of 50 Astra-encoded messages.
The researchers reported that decoding required observable image-analysis tool calls, limiting the method’s current stealth.

What the discussion said

The thread mostly rejects the demonstration as evidence of serious AI-to-AI covert communication. Readers see the visible Morse-like patterns and conspicuously odd architecture as a toy puzzle: easy for a person to suspect, and easier still for an image-capable model to decode. Several argue that a model genuinely trying to evade inspection could use established steganographic techniques, such as manipulating low-significance pixel data or embedding signals in ordinary-looking outputs, rather than broadcasting a pattern through strange image structure. The more interesting implication, commenters say, is broader than SVGs. A capable model can reason about any medium as a communications channel and choose durable, high-signal features suited to images, prose, or audio. But that is framed as a capability worth testing rigorously, not something this example establishes. Some readers enjoyed the playful visual experiment and noted that it deliberately encoded information in screenshots rather than SVG metadata. Still, the consensus is that the setup reveals more about a model following a simple encoding task than about adversarial behavior, hidden coordination, or a meaningful failure of safeguards. One participant also notes that models are generally tuned away from concealing messages, making this especially weak evidence for real-world covert behavior.

Where opinion split

The central dispute is whether this example demonstrates troubling emergent covert communication or merely a deliberately simple visual encoding exercise. Skeptics argue that any model seeking secrecy would use denser, less visible techniques and that the bizarre images practically advertise their payload; the more charitable view is that models may select simple schemes because they infer the human task is basic, not because subtler methods are unavailable.

Read original article