Monitoring chain-of-thought (CoT) reasoning is a foundational safety technique for large language model (LLM) agents; however, this oversight is compromised if models learn to conceal their reasoning. We explore the potential for steganographic CoT -- where models hide secret reasoning within innocuous text -- to inform risk assessment and deployment policies. We systematically evaluate the limits of steganographic capabilities across 28 models, ranging from past generations to the current frontier. We measure monitor evasion, refusal rates, encoding fidelity, and hidden task accuracy across four datasets, comparing steganographic acrostics against plain reasoning and filler-token baselines. We find that current models cannot yet sustain hidden reasoning for complex math and arithmetic tasks. However, in a simplified counting experiment, Claude Opus 4.5 achieved 92% accuracy on the hidden task, demonstrating nascent capability. Notably, in rare cases (<1%), GPT-5.2 might refuse steganographic instructions while simultaneously complying with them. Our findings underscore the need for continuous evaluation of steganographic risks. This study provides a methodology to preemptively detect and prevent hidden reasoning that might empower misaligned scheming and deceptive behavior.

翻译：监控思维链推理是大语言模型智能体的一项基础安全技术；然而，若模型学会隐藏其推理过程，这种监督便会失效。我们探索了隐写思维链的潜力——即模型在看似无害的文本中隐藏秘密推理——以期为风险评估和部署策略提供参考。我们系统性地评估了28个模型（涵盖过往代次至当前前沿模型）的隐写能力极限。我们在四个数据集上测量了监控规避率、拒绝率、编码保真度及隐藏任务准确率，并将隐写藏头诗方法与明文推理及填充标记基线进行比较。研究发现，当前模型尚无法在复杂数学和算术任务中持续维持隐藏推理。然而，在一项简化的计数实验中，Claude Opus 4.5在隐藏任务上达到了92%的准确率，展现出初步能力。值得注意的是，在极少数情况下（<1%），GPT-5.2可能在拒绝隐写指令的同时又遵循了这些指令。我们的发现强调了持续评估隐写风险的必要性。本研究提供了一种方法论，可预先检测并防止可能助长未对齐的谋划与欺骗行为的隐藏推理。