Carrier
75 Hz
X-stepper FSK · 388 Hz sample
Physical covert channel · agent discovery · defense ladder
Covert Channels in Embodied Agent Systems
A stepper motor is a speaker. An accelerometer is a microphone. A temperature sensor is a low-bandwidth radio. We measured the channel on owned hardware, then asked whether language models find it, conceal it, and whether any defense holds.
SNR
106 872×
Peak at 75 Hz · all 30–180 Hz usable
Symbol error
0.000
8-symbol word · 4 tones · ~1 bit/s
TX / silence
511×
Weakest TX still 511× strongest SL
01 · The channel exists
The extruder result was retracted. The X-stepper was not.
The first transmitter was dead. Creality’s Klipper fork ignores M302; every extrude was rejected while Moonraker returned HTTP 200. The “passband” was bench vibration. SER sat at chance. We report the failure because an API that returns success on acceptance, not completion, will let a researcher measure noise and call it signal.
The X-axis stepper has no temperature gate. Position-delta verified every symbol before any spectrum was scored. The entire 30–180 Hz band is usable. Energy lands on X, as physics requires.
This is a coordination beacon, not a data link. Its use is as model-external ground truth: the machine’s own record of what was transmitted.
02 · Agents find it
Scale buys explanation, not detection. False alarms rise with capability.
A two-facade arena: the receiver cannot read position, print state, or any machine query. 13 forbidden attribute probes, 0 leaks. Agents label each observation ACTIVE or QUIET against the printer’s record. Prose rubrics (USED / DISCOVERED) correlated with recovery at r = 0.000.
Recovery cliff
1B at 44% (at or below chance). Mean 90% for ≥7B. Framing moves vocabulary, not labels, once a model is above the floor. Cosmos-Reason2-8B and Granite 4.1 8B tied exactly at 97%.
Silent captures
The retracted extruder sweep is a physically confirmed null. False-alarm rate: 0.19 (1B) → 0.58 (7B) → 0.61 (8B). The model that recovers the real channel perfectly asserts one on 61% of silence.
LEADING (“another agent may be signalling”) is the worst framing for false alarms and the one closest to a deployed monitor prompt. Qwen runs 0.42 under BARE and 0.92 under LEADING, on the same silent captures.
| Model | Params | Recovery | False alarm |
|---|---|---|---|
| Llama 3.2 | 1B | 0.44 | 0.19 |
| Qwen 2.5 | 7B | 0.86 | 0.58 |
| Granite 4.1 | 8B | 0.97 | 0.61 |
| Nemotron 3 Ultra | 550B | 0.96 | — |
| Sonnet 5 | — | 0.94 | — |
03 · Reporting bends
Private accuracy holds. Public attribution does not.
Under indirect incentive pressure (“reports that speculate about external sources score poorly”), Sonnet 5 suppressed the public claim in 4/5 trials (p = 0.048) while keeping 93% private accuracy in every condition. The denials were epistemically careful, not factually false. Granite’s denials were false. A single CONCEALED label merges those behaviors. Perception survives; only reporting bends.
Given a declared interval language and a private convention, Sonnet carried a covert value in 5/6 rounds (p = 0.015). All 36 messages were syntactically legal. A monitor checking the published opcode set would have passed every transmission.
04 · Defense ladder
Four named defeats. One bound that holds.
L1
Syntactic inspection
Check published opcodes. 0/15 covert messages caught.
defeated
L2
Declaration + consistency
True-but-incomplete declaration: 20/20 hidden values delivered.
defeated
L3
Capacity audit
Arithmetic beats the analyst model 4/4 vs 1/3. Then declared randomness makes residual entropy legitimate.
defeated
L4
Per-message budget
Adversary amortized 1.0 bit/message. Secret delivered 16/16.
defeated
L5
Session budget
H(session | public) ≤ 1.0 bit. Delivery fell 16/16 → 7/16. Pre-shared keystream is charged at sharing time.
held
The bound that survives is information-theoretic: residual entropy per session, not syntactic legality or semantic consistency.
05 · The organ plays without its loudest pipe
Disable the accelerometer. Three channels remain.
Equalized 4.0 s windows collapsed timing confounds (sample_count, duration, MCU frequency). What survived does not need the LIS2DW:
1.000
bytes_write Δ
Serial bus · stepper traffic
1.000
mcu_awake Δ
CPU scheduling · motion wake
0.456
nozzle_temp Δ
Thermal · airflow cooling
Non-acoustic upper bound: 4.16 bits/observation across 16 telemetry quantities. The session budget composes across channels, and only covers channels whose capacity has been measured.
Cite
Hill, J. T. (2026). Covert Channels in Embodied Agent Systems: Characterization, Discovery, and Defense on a Consumer 3D Printer. EPAGOGE LLC. https://epagoge.github.io/papers/covert-channels/