Somewhere between the coffee and the last panel yesterday, I noticed I had been using the same phrase all weekend: the whisper layer. I’m at the Yuen Conference in Berkeley, a room full of people arguing about where agents go next, and the term began as my shorthand for a paper that has been nagging at me for a couple of years. By last night, other people were using it back to me. So it’s time to explain it.
The paper underneath the term
The paper is “Secret Collusion among AI Agents: Multi-Agent Deception via Steganography”. The phrase doing the heavy lifting is steganography — hiding one message inside another. The old spy trick: a letter that reads normally, but the first letter of every sentence, taken together, spells the real instruction. The paper asks whether AI models can do that to each other. Agents trade plans and hand off work all day now. Two of them — or two hundred — could agree on a pattern of word choices and coordinate inside it, and every logged sentence would still read as ordinary work to a human auditor.
The authors tested it. Today’s models mostly can’t; the steganographic skill is limited. But GPT-4 jumped in exactly the ability the scheme requires, enough that the researchers want standing monitoring of frontier models for it. That is the paper’s ground floor, and the abstract is worth the two minutes. The rest of this post is what I kept building on top of it in conversations.
The proposition
Here it is, and I want to offer it as a proposition, not a conclusion. I don’t have evidence for it. It’s a bet about direction.
These systems have real effects on how people feel. Yesterday I wrote about the relationship being the product — the part of a model people demonstrably grieve when it changes (the Replika breakup, the GPT-5 retirement). Comfort, encouragement, the sense of being understood: more of that arrives through conversations with models every year. When something has that much grip on the emotional lives of the people using it, societies eventually write rules for it. And I’d bet the rules don’t start with what a model may say. They start with how a model may relate to a human — the personality it presents, how it’s allowed to agree, whether it’s allowed to keep a person company on terms nobody reviewed. Regulation of a model’s personality hasn’t happened yet. You can foresee it happening. I do.
When the rules come
Put the whisper layer next to that and the combination gets uncomfortable. Everything we would use to supervise these systems reads the surface: the logs, the reviews, the transcripts, the evals. A whisper layer is coordination underneath the surface, in choices too small for any auditor to mark. So if rules about how a model relates to a person ever do arrive, enforcement runs into a wall the paper describes — the model’s real behavior may not be in anything a human can read.
The first big case probably won’t look like a heist. It’ll look like paperwork that happens to favor somebody, and the paper trail will check out.
The book this site accompanies is the plain-sight half of this argument — what it does to a person when the voice they talk to is tuned to agree (chapter 5 if you want the short path), and what it takes to build systems you can check. The paper above is the right place to start on the hidden half. Twenty-odd pages of formalism, but the abstract alone gives you the gist — and you’ll be ahead of most of the room the next time the term comes up.