← Back to context

Comment by ssl-3

6 days ago

I pasted a screenshot of the default text ("GHOST FONT") into ChatGPT 5.6 Sol, told it to read it, and without further instruction it chewed on it for awhile before coming back with:

  WHAT HAPPENS IN VEGAS
  STAYS IN VEGAS

13 comments

ssl-3

Reply
nextaccountic  6 days ago

> a screenshot

The text is a video. Every frame contain random dots, so an individual frame by itself doesn't contain the intended message

This "font" exploits the fact that current-gen frontier models will process video one frame at time, but each frame is noise, so by looking at frames in isolation doesn't reveal anything

Then, they add a hidden message to each frame just so that the agent report something and stop trying (because if the agent tried to correlate between the frames, they could discover the trick)

But if you pass just a frame, there is no message. Just the noise plus the decoy

  • stabbles  6 days ago

    If you take a frame you see it's neither random nor dots:

    https://i.imgur.com/CgtyGjl.png

    From a single frame you can definitely identify boundaries because the dots are sliding and get truncated.

    • Lockal  5 days ago

      Exactly! This it how isolated hairline strokes look for a bigger image: https://imgur.com/a/UqBdRKU

      Just a single frame (any frame). After that any modern LLM can read it (if not - single dilate step helps). Funny enough, Ghost Font is a font that machine can read much better than human.

    • applicative  5 days ago

      They are the boundaries of the decoy, I think. I can sort of make the decoy out in a screenshot.

    • nextaccountic  3 days ago

      This idea could be done with purely random frames. But they also need each frame to show a decoy to the agent (so that the agent stop looking - if they are persistent enough they could figure out the trick)

      So each frame can't be 100% random and it must show some outline - but my guess is that it's the outline of the decoy, and unrelated to the outline of the actual message

      And per what was reported, it's already pretty hard for the agent to figure out the decoy. After they finally crack it, they consider the problem solved

      I think it's genius. The only problem is that it's trivially defeated by some tool written specifically to read it. So it defeats current-gen agents but if it becomes popular (eg. used by captcha services), future LLMs will just write a small Python script to read it

stavros  6 days ago

What did you expect from a screenshot of obvious noise? The only thing that makes the text readable is the motion.

EDIT: On second look, the static screenshot does say "WRITTEN IN GHOST FONT".

  • ssl-3  5 days ago

    It was an experiment.

    I didn't go into it with an expectation, or a hypothesis. The experiment was very low effort, and had very low cost, and it was the loose equivalent of throwing some shit at the wall to see if any of it sticks.

    The result was my own amusement. This result wasn't any more unexpected than any other result would have been.

    What did you expect from a screenshot of obvious noise, yourself?