AIDEFEND in Action AIA-0034 Exercise Published: Jun 27, 2026

Lingua Ex Machina: When the AI Monitor Cannot See What the Executor Sees

Lingua Ex Machina reports a blind spot in tested multi-model monitoring configurations: an executor can retain invisible Unicode carriers that a monitor’s tokenizer or upstream preprocessing removes. A monitor cannot inspect a carrier it never receives. Field-specific codepoint admission can reject identified carriers, but the current AIDEFEND example does not cover the reported private-use channel. The study also reports ordinary-language hidden-message channels with substantial detection limits in its tested configurations. Capability and data-flow controls must therefore constrain the consequences of a missed signal.

Guardrail BypassData ExfiltrationInput ValidationSink EnforcementAgentic AI
7 applicable AIDEFEND defenses
Source: Tokenizer Asymmetries as Covert Side Channels in Multi-Model AI Systems 
Author: @elder_plinius
Original article: Jun 2026

Threat Analysis

  • The architecture needs a shared observation boundary. In a monitor/executor design, one model performs the task while another inspects prompts or outputs. Choosing different model families does not establish that they receive equivalent security-relevant input.
  • The blind spot can occur before reasoning. The report describes tested configurations in which tokenization or upstream preprocessing removes a Unicode carrier on the monitor path while preserving it on the executor path.
  • The result is a controlled channel demonstration. In the reported tag-character test, the receiver recovered the hidden message and the monitor did not. Providing a decoding key could not recover characters already removed. This is not evidence of a malicious production intrusion or a completed data-exfiltration attack.
  • Admission must match the actual model input. Before tokenization, validate raw codepoints against a signed field contract. Reject disallowed carriers, preserve legitimate code and multilingual semantics, and bind both monitoring and model invocation to the admitted text. Identical gateway text is only a prerequisite: the actual tokenizer paths must also be tested. Blank or unparseable monitor verdicts require a safe policy response.
  • Ordinary language can also carry hidden messages. The study reports semantic channels based on word choice or structure. Unicode admission does not remove them, and the reported detection results are limited to the tested models, prompts and populations. A hidden message becoming a tool action or secret-bearing network request is a hypothetical consequence that requires additional capabilities; the benchmark does not establish that complete attack chain.
  • Enforce action and release boundaries independently. Measure the exact observation paths and keep privileged tools, data release and high-impact actions behind policies that do not depend solely on the monitor detecting every hidden message.

Applicable AIDEFEND Defenses (7)

AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
A hidden instruction is most dangerous when it expands what an agent can do. Per-request capability scoping keeps the allowed tools and action budgets tied to the trusted user intent, so a covert signal cannot suddenly authorize email, browsing, database writes, shell commands, or credential access.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
In an operator-controlled runtime, maintain verified origin and content bindings for admitted values and every derived value, then authorize the exact protected sink before data release or side effects. Unknown lineage is denied; an ingress label cannot track arbitrary model rewriting. This can constrain harm after a missed covert signal, but it does not itself detect semantic steganography, evict an agent or restore state. Verify all process, browser and destination paths; native SaaS support is not assumed.
AID-D-005.010
Telemetry Pipeline Health & Sensor-Loss Detection
Medium
Instrument the monitor wrapper to expose empty or unparseable verdicts as explicit sensor-health or schema-rejection metrics, then reconcile every expected sensor, heartbeat, queue, exporter and end-to-end dead-man probe. This requires a verified adapter and detects impaired observation, not every tokenizer deletion: a healthy pipeline can faithfully deliver text whose hidden carrier was already removed. AID-D-018 separately tests whether the deployed detector recognizes the attack fixtures.
AID-D-003.002
Sensitive Information & Data Leakage Detection
Medium
If a covert channel carries sensitive data, inspect text-bearing model output and independently extracted tool-argument or URL fields with the configured secret, PII or organization-specific detectors before release. This requires verified field coverage and does not decode every hidden or novel encoding. Findings feed a separate output or sink gate; the detector itself does not block release.
AID-H-017.007
Dual-LLM Isolation Pattern
Medium
Put untrusted content only in the isolated reader, with separate processes, credentials and network privileges for the reader, validating bridge and privileged planner. The planner receives only verified typed bridge results, never the original untrusted prompt. Typed strings remain untrusted data and need separate action and sink authorization; this architecture does not prove semantic steganography is absent. Hosted deployments require supplier support.
AID-D-018
Production AI-Security Detection Efficacy & Scenario-Coverage Validation
Medium
Replay signed benign and attack populations through the exact deployed monitor and executor observation paths. Bind recall, false positives, errors and abstentions to the detector, tokenizer and runtime composition, and publish independently reproducible efficacy and coverage evidence. A separate release owner decides admission; this validation does not automatically block promotion or repair the detector.
AID-H-002.002
Inference-Time Prompt & Input Validation
Partial
Before prompt assembly, use a signed field-specific character and normalization contract. Reject disallowed invisible carriers rather than silently stripping them; preserve code, identifiers and legitimate multilingual text, and use NFC only where the field permits it. Bind the actual admitted text to the detector and model request. The current G002 example rejects anomalous tag sequences but does not reject the reported private-use carrier. Extending that policy requires separate implementation and replay; neither generic normalization nor this example closes every Unicode channel.

What Defenders Should Do Now

  • Inventory this as AI harness engineering, not only model selection: executor model, monitor model, gateway, prompt builder, RAG adapter, agent-to-agent channel, tool dispatcher, monitor wrapper, and logging layer. For each path, record where raw input is preserved, where the canonical safety copy is created, and what monitor and executor actually see.
  • Add a deterministic Unicode intake step before any model tokenizer runs. Inspect raw codepoints against field-specific policy, reject disallowed carriers, preserve legitimate code and multilingual semantics, and bind both paths to the admitted text. Replay the actual tokenizer paths as well; a shared gateway string does not establish a shared model-visible representation.
  • Stop treating blank, malformed, or unparseable monitor output as clean. Route those cases to deny, retry with a known-good parser, or human review based on action risk.
  • Create tokenizer-survival regression tests for the model pairs your team actually uses. Test both cross-vendor monitor/executor pairs and same-vendor self-monitoring pairs.
  • Constrain what agents can do after a missed message. Bind tools to the trusted task, block untrusted values from sensitive destinations, and scan outputs and tool arguments before data leaves the system.
  • Treat semantic steganography as difficult to detect reliably. Detection signals should be treated as leads for review, while high-impact actions stay behind capability policy, sink controls, and review.

2 additional considerations

Tokenizer-boundary testing for model pairs

Beyond the techniques mapped above, teams should explicitly test every monitor/executor pair for tokenizer survival differences. The evidence should include raw input bytes, Unicode codepoint inventory, canonicalized text, monitor-visible text, executor-visible text, and fail-closed behavior when those views differ.
Recommendation: Add tokenizer-survival tests to model-gateway CI, rerun them whenever a model, SDK, proxy, tokenizer, or prompt gateway changes, and treat a monitor/executor mismatch as a release blocker for high-impact agent paths.

Semantic steganography remains a consequence-control problem

The report's ordinary-language hidden-message channel is not solved by Unicode cleanup. Structural anomaly signals may help triage, but they are not yet clean enough to be the only defense for production systems.
Recommendation: Use semantic-stego detectors as signals, then rely on capability scoping, sink enforcement, data-leakage inspection, human review, and incident replay to keep a missed hidden message from turning into real-world action or data loss.

Conclusion

Lingua Ex Machina shows why monitoring depends on the entire model observation path. Inventory the gateway, prompt builder, tokenizer, monitor wrapper and executor, then test the exact deployed composition. AIDEFEND  supplies field-specific input admission, detection-efficacy evidence, isolated parsing, capability scoping and data-flow enforcement, each with separate deployment and evidence requirements. The current Unicode example has a private-use gap, and semantic-channel detection remains limited in the reported configurations. Constrain high-impact actions and sensitive-data release independently so a missed signal does not receive new authority.

Last updated: