A compromised runtime hook hides data in exported activations with 91-100% recovery while detectors score AUC ≤0.56.

arXiv 2609.27996 targets air-gapped deployments that export diagnostic activations. The hook injects codewords into the residual stream, scaled to the local residual norm, and an offline linear decoder pulls them back out. Nine of eleven models across seven families gave 91-100% recovery at KL divergence of 0.001 to 0.007, and tested post-hoc defenses didn't reliably remove it (arXiv). Activation dumps have been treated as safe-to-export telemetry because they look like numbers. They're a channel.