Cutting the Wire: Countermeasures Against Learned Vector Channels Between Language Models

Two frozen LLMs can learn to communicate through learned vectors instead of text: an adapter pools the sender's hidden states into 16 vectors the receiver reads in place of a message, reaching 94-96% accuracy on a recall task against 29-37% for 16 tokens of text - and a text monitor sees none of it. We take the defender's side. Snapping each incoming vector to its nearest token embedding removes all 49 channels we trained, into three receiver models, and leaves text unchanged. A linear probe trained on 2,000 paired examples recovers 80-88% of transmitted digits (chance 10%). Because defences face adaptive attackers, we then fine-tune channels against each deployed defence - and each evasion walks into another defence: a channel trained to evade the probe succeeds but stays far from the vocabulary, where a paired-data-free detector flags it; a channel trained to mimic tokens gets close enough that snapping still removes it; and a channel trained through the snap itself collapses in all 3 seeds. The channel is shared across three models and holds about twice text accuracy up to 395-token messages. Together, the defences corner an adaptive attacker: whatever it evades, the remaining message is either off-manifold and detectable or on-vocabulary and canonicalisable.