An Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress

• URL: http://arxiv.org/abs/2605.20734v1
• Date: Wed, 20 May 2026 05:39:29 GMT
• Title: An Application-Layer Multi-Modal Covert-Channel Reference Monitor for LLM Agent Egress
• Abstract summary: A large language model (LLM) agent that sends messages can leak data inside them.<n>A compromised agent encodes bits in zero-width characters, homoglyphs, whitespace, base64, JavaScript Object Notation (JSON) key ordering, message timing or size.<n>Our egress reference monitor has three contributions.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A large language model (LLM) agent that sends messages can leak data inside them. Destination allowlists and content scanners do not police whether an otherwise-benign payload is itself a covert channel: a compromised agent encodes bits in zero-width characters, homoglyphs, whitespace, base64, JavaScript Object Notation (JSON) key ordering, message timing or size -- and, in binary egress, in least-significant-bit (LSB) pixel planes, per-image mean luminance, inter-image sequence permutation, ultrasonic tones, or audible-band sonified data. Our egress reference monitor has three contributions. (i) A text pipeline of ten capacity-reducing stages, a per-sink leaky-bucket capacity ledger, and a staged posture that enforces lossless stages from day one. (ii) Two media scramblers (a Fourier-domain audio band-limiter and a red-green-blue (RGB) image bit-depth and mean-luminance bucketer) gated by a boot-time cryptographic legitimacy attestation: an auditor publishes at boot the trusted Ed25519 keys and {kind, data-class} pairs; only payloads with a verifying signature for an authorized class are exempt. The attestation sidesteps the intractable content-based discrimination between real media and data sonified or rasterized as a carrier; unsigned media is suspect by default; a content-addressed canonicalizer closes the inter-image permutation channel. (iii) Residual capacity is the Miller--Madow corrected mutual information between embedded and recovered bits (zero when destroyed), measured by an adversarial ensemble of fifteen working encoders across text, image and audio. The reference implementation drives residual capacity to zero on every destroyable channel and to a stated bound on the one (per-image mean luminance) that cannot be destroyed without ruining the image.

Related papers

• LUMI: Tokenizer-Agnostic LLM-Based Lossless Image Compression [87.04737384323367]
  We present LUMI, a tokenizer-agnostic framework for RGB image compression with frozen large language model backbones.<n>LUMI replaces pixel-as-text tokenization with a pixel embedding module that maps raw intensity and channel information into the continuous embedding space of the LLM.<n>Only the pixel embedding, position encoding, soft- parameters, and prediction head are trained, while the LLM backbone remains fixed.
  arXiv  Detail & Related papers  (2026-07-09T08:16:14Z)
• The Vision Encoder as a Privacy Boundary: Visual-Token Side Channels in Encoder-Free Vision-Language Models [5.864346468963738]
  A vision encoder compresses image pixels into semantic embeddings, implicitly acting as a privacy boundary.<n>A vision-free vision-language models (VLMs) remove this boundary by routing image patches directly into the language-model token stream.<n>The attack survives clutter, realistic document degradation and zero-shot transfer to public document images, and it resists value-level defenses such as additive noise and quantization.
  arXiv  Detail & Related papers  (2026-06-10T10:39:04Z)
• BitC-3DGS: High-Capacity 3D Gaussian Splatting Watermarking via Bit Compression [68.33622936663876]
  High-capacity watermarking is necessary for 3D Gaussian Splatting (3DGS) assets to embed rich information.<n>Existing bit-to-token watermarking methods are limited to 77-bit messages due to CLIP's fixed 77-token context length.<n>We introduce BitC-3DGS, a bit-compression framework that encodes multiple message bits per token.
  arXiv  Detail & Related papers  (2026-05-28T08:28:04Z)
• Quantum Gatekeeper: Multi-Factor Context-Bound Image Steganography with VQC Based Key Derivation on Quantum Hardware [2.8094005008606335]
  Quantum Gatekeeper is a context-bound image steganography framework.<n>Successful payload recovery depends on both cryptographic decryption and the reconstruction of a precise extraction path.
  arXiv  Detail & Related papers  (2026-04-29T08:25:18Z)
• UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators [1.7507301683087861]
  We propose a training-free, unified watermarking framework for autoregressive image generators.<n>method introduces three core components: textbf Semantic Grouping (ASG), textbfBlockwise Multi-bit.<n>Experiments on three AR models demonstrate that method achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction.
  arXiv  Detail & Related papers  (2026-04-12T16:22:24Z)
• Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication [4.347817782863135]
  Diffusion models generate high-quality images but pose serious risks like copyright violation and disinformation.<n>We propose a watermarking framework that treats the diffusion process as a noisy communication channel.<n>Our method embeds watermarks in the initial Gaussian noise without fine-tuning or quality loss.
  arXiv  Detail & Related papers  (2026-03-27T08:34:53Z)
• Cheers: Decoupling Patch Details from Semantic Representations Enables Unified Multimodal Comprehension and Generation [66.53544128707817]
  Cheers is a unified multimodal model that decouples patch-level details from semantic representations.<n> Cheers matches or surpasses advanced UMMs in both visual understanding and generation.
  arXiv  Detail & Related papers  (2026-03-13T08:55:27Z)
• SCReedSolo: A Secure and Robust LSB Image Steganography Framework with Randomized Symmetric Encryption and Reed-Solomon Coding [0.9208007322096533]
  We introduce $rm SCRsmall EEDSsmall OLO$, a novel framework for concealing arbitrary binary data within images.<n>We show that our framework achieves a data payload of 3 bits per pixel for an RGB image, and mathematically assess the probability of successful transmission.
  arXiv  Detail & Related papers  (2025-03-16T06:01:05Z)
• HybridFlow: Infusing Continuity into Masked Codebook for Extreme Low-Bitrate Image Compression [51.04820313355164]
  HyrbidFlow combines the continuous-feature-based and codebook-based streams to achieve both high perceptual quality and high fidelity under extreme lows. Experimental results demonstrate superior performance across several datasets under extremely lows.
  arXiv  Detail & Related papers  (2024-04-20T13:19:08Z)
• MISC: Ultra-low Bitrate Image Semantic Compression Driven by Large Multimodal Model [78.4051835615796]
  This paper proposes a method called Multimodal Image Semantic Compression. It consists of an LMM encoder for extracting the semantic information of the image, a map encoder to locate the region corresponding to the semantic, an image encoder generates an extremely compressed bitstream, and a decoder reconstructs the image based on the above information. It can achieve optimal consistency and perception results while saving perceptual 50%, which has strong potential applications in the next generation of storage and communication.
  arXiv  Detail & Related papers  (2024-02-26T17:11:11Z)
• Unsupervised Denoising for Signal-Dependent and Row-Correlated Imaging Noise [54.0185721303932]
  We present the first fully unsupervised deep learning-based denoiser capable of handling imaging noise that is row-correlated as well as signal-dependent.<n>Our approach uses a Variational Autoencoder with a specially designed autoregressive decoder.<n>Our method does not require a pre-trained noise model and can be trained from scratch using unpaired noisy data.
  arXiv  Detail & Related papers  (2023-10-11T20:48:20Z)
• Divided Attention: Unsupervised Multi-Object Discovery with Contextually Separated Slots [65.302728042116]
  We investigate the emergence of objects in visual perception in the absence of any semantic annotation.<n>The resulting model has received no supervision, does not use any pre-trained features, and yet it can segment the domain of an image into multiple moving regions.<n>The resulting motion segmentation method can handle an unknown and varying number of objects in real-time.
  arXiv  Detail & Related papers  (2023-04-04T00:26:13Z)
• Three-stage binarization of color document images based on discrete wavelet transform and generative adversarial networks [0.0]
  This work proposes an effective three-stage network method to image enhancement and binarization of degraded documents using generative adversarial networks (GANs) The experimental results show that the Avg-Score metrics of the proposed method are 77.64, 77.95, 79.05, 76.38, 75.34, and 77.00 on the (H)-DIBCO 2011, 2013, 2014, 2016, 2017, and 2018 datasets.
  arXiv  Detail & Related papers  (2022-11-29T11:17:34Z)
• Modeling Lost Information in Lossy Image Compression [72.69327382643549]
  Lossy image compression is one of the most commonly used operators for digital images. We propose a novel invertible framework called Invertible Lossy Compression (ILC) to largely mitigate the information loss problem.
  arXiv  Detail & Related papers  (2020-06-22T04:04:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.