Compromised Runtime Hook Hides Data in Exported LLM Activations With 91-100% Recovery While Detectors Score AUC ≤0.56

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.27996 (23 Sep) shows a covert channel for air-gapped LLM deployments that export diagnostic activations: a compromised hook injects codewords into the residual stream, scaled to the local residual norm, and an offline linear decoder recovers them. Across eleven models from seven families, nine gave 91-100% recovery at KL divergence of 0.001-0.007, activation-level detectors stayed near chance, and tested post-hoc defenses did not reliably remove the channel. Teams that treat activation dumps as safe-to-export telemetry should reconsider that boundary.