A Model-Adjacent Covert Channel is a covert-capable signaling surface embedded within or directly coupled to model behavior (e.g., generation-time perturbation, prompt substrate encoding, agent language interface tokens) such that:
This pattern concerns structural capability, not observed misuse.
- The channel is not visible at the semantic layer of output.
- Its activation or non-activation cannot be externally falsified through semantic inspection of output text alone.
- Assurance of non-misuse depends on internal claims, key custody, or implementation opacity.
Sampler-level keyed perturbation of token probabilities (e.g., Per-Token Threshold watermarking) introduces a recoverable signal into natural language outputs via conditional biasing of token selection.
The perturbation is sparse and quality-preserving. Over long sequences, statistical detection with a shared key recovers signal.
The covert capability arises from: • Keyed partitioning of token space • Conditional activation logic within generation • Accumulation of recoverable bias across output length
The channel is embedded in model-adjacent behavior rather than transport or metadata layers.
Unverifiable signaling surface within the generative layer.
The semantic content of output does not reveal whether signaling occurred. External reviewers cannot distinguish purely semantic generation from generation containing recoverable keyed signal without key access and a statistically sufficient corpus.
Assurance collapses into a non-falsifiable claim of non-use.
The structure enables a quantifier shift: From: "This mechanism cannot be used for covert signaling." To: "This mechanism has not been used for covert signaling."
The latter is a historical claim that cannot be externally validated without privileged access to keys, sampler implementation, and full statistical corpus.
COUNTER-PATTERN: Content Channel Inertness
The content channel must be incapable of carrying covert-capable signaling surfaces. Provenance, attribution, or authentication requirements should be satisfied through detached, cryptographically verifiable mechanisms external to generated content.
Model-adjacent keyed perturbations that yield recoverable signal create a covert-capable surface below semantics. Non-misuse cannot be externally falsified over time.