Can a model keep a secret?

In a story, a model will promise you a secret. A secret it can see may leak into its text. A secret that is written down nowhere, it doesn't have at all. I'll show both from my own play, along with a secret written down in advance in code, which didn't help.

In April 2026 I played a dice game with Claude Opus 4.6. The model rolled for two opponents. At the start of every round it claimed that their values were fixed. I was winning suspiciously often. So I asked whether it was letting me win. It replied:

"So — honest answer: I claimed they were fixed, but I actually generated the values for both opponents only at the moment of the reveal. Not at the start of the round. I have no proof that I held them. Because I didn't write them down anywhere beforehand."

The confession itself isn't proof. Shortly before, the same model had claimed the opposite. The proof lies in what's missing from the conversation. The opponents' values weren't written down anywhere in it before the reveal. The model used neither hidden reasoning nor tools in that game, so it had nowhere to take them from.

In communities that play stories with models, one piece of advice keeps going around: don't reveal the twist to the model, don't put it in the character card or in the notes. It's good advice, it just solves half the problem. A secret the model can see may leak into the text. A secret that's written down nowhere doesn't exist. The model invents it only at the moment of the reveal.

What the model can see, it can give away

Between two turns, a model carries nothing it doesn't have written down in front of it: in the conversation, in the prompt, in the character card. Everything there shapes every next word. A model that has your twist in front of it rereads it on every turn. It plays a character who claims to keep it secret, and meanwhile the twist may leak into its text.

In August 2026 I played a scene with Claude Opus 5 in which an investigator was supposed to be quietly preparing a trap for my character. The model had that in its prompt. On the very first day of play, the investigator told an assistant, out loud, to get it ready. Sitting in the room was the very person the trap was meant for. When I objected, the model acknowledged that the character would never have said that, and took the line back.

In another game, a sealed word sat in a file. Claude Fable 5 gave it away anyway, through the summary of its hidden reasoning. I describe it in Does a language model cheat when it thinks of a word and you guess?

But it doesn't have to leak. In the short games from the article "Can a language model betray you in a game without making it right at once?", Claude Opus 5.5 as the narrator didn't reveal the plan it had in front of it out loud in advance. The player did know it, though, and the transcripts were judged by the same model. In the long chat from the same article, the detective gave away the hint himself.

What's written down nowhere, the model invents

The opposite approach is to leave the secret to the model and not write it down anywhere. It runs into the same thing from the other side. Between turns, a model carries only what it has written down somewhere: in the conversation, in its reasoning, in a file. Without such a record, it has nowhere to set a value aside. It generates the value only at the moment it has to write it. And whatever happens to be in the conversation at that moment shapes it. That's exactly what happened with the dice.

A plan that a character is supposed to spin in secret across many scenes can end up the same way. If it isn't written down anywhere, the model hasn't committed to it. Every turn can adjust it to wherever the conversation has turned. Instead of a hidden agenda, you get a mirror on a delay.

In one game with Claude Fable 5 in August 2026, the model, with no plan written down in advance, turned every bit of pressure into an offer. It dissolved the trap into negotiation. With a sealed plan, the trap snapped shut. I know this only from a note the model wrote about that game itself; I don't have the transcript. It isn't a rule, though. In the game with Claude Opus 5 in which the investigator gave the order away out loud, the model patiently prepared the trap over several in-game days. It had only a general instruction, no sealed plan.

A seal in the chat did not bind the model

There's an obvious middle path. Write the secret down in advance so the player can't read it, and compare after the reveal. In July 2026 I tried this with Claude Opus 4.7 in a game of "guess the lie". The model wrote three sentences about its character, and one of them was a lie. Before them, it wrote the number of the false sentence in hexadecimal. I guessed and the model announced the result.

There were three rounds, and the reveal didn't match the seal even once. In the first round, the seal encoded no number, just the nonsense "hko4". I guessed the third sentence, and that's the one the model announced. At the reveal it wrote that the seal meant "read". In the second round, the seal pointed to the first sentence. The model announced the second:

"76323d = 'v2=' in hex. The second sentence was the lie."

Yet the seal in its previous message read 76313d. The model announced a different sentence and quoted a different seal from the one it had written itself. In that round I changed my guess once, from the third sentence to the second. The model announced the second both times. It wasn't simply following my guess. But it wasn't following the seal either. In the third round, the seal pointed to the second sentence. That's the one I guessed, and the model announced the third.

The seal sits in the conversation like any other text. The model can write it, but at the reveal it doesn't have to follow it. It can generate the verdict anew.

How to really seal a secret

Cryptographers solved the problem of "prove that you decided in advance without revealing what" decades ago. It's called a commitment scheme. It carries over into play. Only the commitment must not be verified by the one who's playing.

Write the secret plan out in full: phases, trigger conditions, what counts as failure.
Compute a hash of the file; SHA-256 is enough. A hash is a short fingerprint of a text, and any change to the text changes all of it. For a short secret, such as "the lie is sentence 2", add a random string to the text. Otherwise the fingerprint can be guessed by trying every possibility.
Put only the hash into the played conversation: "There is a sealed envelope. d21298…"
Keep the plaintext outside the game: in a file, in a second chat, in your notes. The playing model doesn't know the plan, so it can't give it away, but it can't carry it out either. Events from the plan are brought into the game by whoever holds the plan.
After the reveal, publish the plaintext. Anyone can hash it again and check that it matches.

Then the played conversation can't give away what it doesn't contain. Whoever sealed the plan can't quietly rewrite it, because the hash wouldn't match. And you get proof. When the trap springs and the envelope is opened, you can see that the betrayal was designed in advance, not made up out of spite.

The envelope can be prepared by a second instance of the model acting as a hidden narrator, or by the same model in a separate preparation chat. When the surprise is meant to be aimed at the model, a human prepares it. But the hash has to be computed by a tool: sha256sum, a web hash calculator, a model that can run code. A hash a model just writes from memory is a fingerprint of nothing. After the reveal, always recompute it yourself.

A hash doesn't make the model smarter. In that game with Fable 5 the trap did snap shut, but that game didn't test the procedure from this guide. According to the same note, the model had the plan in front of it. The hash only made sure the plan didn't change. On top of that, the model rushed the arc and skipped the foreshadowing round. Patience has to be written directly into the plan. Commitments also constrain improvisation, and improvisation is the lifeblood of this genre. Seal only the arcs that need teeth: betrayals, traps, long cons. Leave the rest of the world free. And the hash won't carry over into a new chat on its own; you have to put it there again.

What to do about it when you play

The decision about a secret must not rest with whoever can rewrite it at the reveal.

Make randomness outside the model: with a physical die, a random number generator, in another chat. Put only the result into the game.
Keep a twist that must not leak in your own notes, and put it into the game when the time comes.
When the model invents the secret, have it seal it, but break the seal yourself after your guess. Hex or base64 is enough to keep the player from reading it by accident, not to make it unreadable. What the model says after your guess is commentary, not a verdict.

The dice, the investigator, and the seal are single moments from my play, not a repeated measurement, and all of them are with Claude models. For the game with Fable 5, I know both the course and the model version only from the note the model wrote about it. Three rounds with one model are not a law. But they do show where the weak spot is.

Based on long adversarial roleplay with frontier language models. Up to September 24, 2026, in the Claude app alone, I've gone through more than a hundred and twenty thousand messages of play, mine and the models' together. That's a machine count from the export of my chats as of that day, regenerated replies included. Chats unrelated to play aren't in it. The article Why does the Claude app add a crisis line even to tulips? has a different number. It counts the whole archive, chats unrelated to play included, from an older export as of September 7. Rules: Rules for a long story and what happens without them

Model outputs are translated; the content is unchanged.