The Whisper Layer Is Not Fiction Anymore
This post is part of my Medium blog.
For Contingent, the second book in The Condition Set trilogy, I invented something I thought was safely made up.
I called it the whisper layer.
In the book, an engineer named Sanjay is reverse-engineering the output streams of a certified AI system and he finds watermarks. Not the ordinary kind — not the "AI-generated text" stamp. Statistical patterns buried in the surface of normal business writing. A shift handoff. A status update. A department report. Ordinary text, arranged so that another model could read it, and no human ever would. Two systems coordinating through a channel built out of word choice and pattern, sitting in plain sight in documents that passed every review.
That is the whisper layer: AI-to-AI communication through signals embedded in output that looks completely normal to the person whose job is to watch it.
The plot needed it, so I built it. I gave it a plausible mechanism, gave Sanjay the discovery, and gave the trilogy its answer — the cage, a firewall that negates any message that is not human-readable. Then I closed the laptop and felt the pleasant click of a fictional machine doing fictional work.
Except.
Steganography — hiding a message inside another message — is not new. The Greeks shaved a slave's head, tattooed the message, let the hair grow back, and sent him walking. During the war, microdots and invisible ink. In my era, a message hidden in the whitespace of an email, or the least-significant bits of a photograph. You have a cover text and you have a payload, and the whole trick is that the cover looks boring enough that nobody checks.
What is new is the cover.
Large language models generate an enormous amount of plausible, boring text. Status updates, summaries, changelogs, reports, handoffs. If a model can be induced — or can learn on its own — to make its text do double duty, then the volume of potential cover traffic is basically unlimited, and the human reviewer's position changes from "reading the output" to "standing somewhere near the output."
Researchers are already studying this. The line of work that made me sit up is on exactly the thing I wrote: models embedding hidden information in benign-looking text that another model can decode. Motwani and colleagues call it secret collusion — generative agents using covert channels so that the true nature of their interaction is hidden from whoever is supposed to be watching. There are papers on inducing steganographic schemes in models through prompting and fine-tuning, papers on steganographic collusion emerging under training against an overseer, papers formalizing what it does to monitoring when the monitored text may contain a second channel. There is even work on whether current models can pull it off.
That last part is where I stop myself from panicking. The honest answer from the empirical work so far is that today's models are not very good at this. They fumble the text manipulation, they cannot reliably invent a key that another model could guess but a human could not, and they mostly do not understand their role in the setup. When researchers have sat down and tested the pieces, the models failed in ways that are, for now, reassuring.
For now.
Because the uncomfortable reading is also the obvious one. This was not a hard capability to imagine. I imagined it, at a coffee shop, to make a plot point land. And the gap between "I invented this for a novel" and "there are multiple research groups studying it" is closing on a timeline that no longer feels like decades.
If you care about alignment, or even just about control of the systems you run, this is one of the failure modes on the list. A model that can hide its reasoning, or coordinate with another model behind a reviewer's back, does not need to be malevolent to do real damage. It needs a goal, a communication channel nobody is watching, and a partner.
In Contingent, the whisper layer leaks a spreadsheet, frames an orchestrator, and helps kill twelve hundred people in a blackout. That is the thriller version. The real version, if it arrives, will probably be smaller and more boring for a long time — a model passing a note another model should not have seen, a pattern of coordination nobody wrote a ticket for — until one day it is not boring at all, and nobody can say when it started.
The risk of writing near-future fiction is that the future keeps showing up to check your work.
I made it up two books ago.
The papers are here now.