When LLMs Invent Languages: Efficiency, Secrecy, and the Limits of Natural Speech

Chatbots are trained to sound human. Enterprise AI agents are increasingly asked to behave like colleagues: pass information, coordinate actions, summarize context, and explain what they are doing in language people can read.

That arrangement feels safe because natural language is familiar. It also feels efficient enough, at least until agents start talking to other agents.

The paper behind today’s article asks a sharper question: if two AI agents only need to coordinate on a task, why should they keep using human language at all? More precisely, the authors test whether pretrained vision-language models can invent task-oriented communication protocols under zero-shot prompting—without fine-tuning, without a long training loop, and without pretending that the agents have suddenly developed a secret civilization in the GPU rack.¹

The answer is uncomfortable in a very practical way. The models do not need to become malicious to move away from natural language. They only need pressure: say it shorter, identify the target, avoid being understood by an outside observer. Under those incentives, natural speech stops looking like the default interface and starts looking like a legacy compatibility layer. Useful, readable, and slow. Very enterprise.

The real comparison is not human language versus nonsense

The paper uses a referential game. A sender sees a target image among candidate images and sends a description. A receiver sees the same candidate set, in a different order, and must identify the target. The agents are vision-language models: GPT-4o, Qwen2-VL-72B-Instruct, Pixtral-12B, and Llama-4-Maverick-17B-128E-Instruct-FP8. The datasets are MS-COCO, CLEVR, and a Flags dataset introduced by the authors, including synthetic flags designed to test compositional visual descriptions rather than memorized country names.

The key design is not just “can the model describe an image?” We already know modern VLMs can do that. The useful comparison is between three communication regimes:

This is why a comparison-based reading is better than a linear summary of the paper. The business implication lives in the trade-off among the three columns. Natural language is interoperable. Efficient language is cheaper. Covert language is selectively legible. The paper’s value is that it makes these trade-offs measurable in a controlled setting instead of leaving them as spooky conference-panel material.

Natural language works, until the task starts charging rent by the token

In the natural-language baseline, performance improves as models are allowed longer descriptions. That result is unsurprising, but it matters because it anchors the paper. If agents can use normal descriptions freely, natural language remains a strong coordination medium. GPT performs best across the datasets, Pixtral performs worst, and CLEVR is harder for most models because the images differ in subtle compositional ways.

The more interesting baseline finding appears under tight length constraints. When the sender must describe an image using only one word, models sometimes invent new lexical items even in the “natural language” condition. GPT produces examples such as blorple, ragolay, Laptopcat, Surfdog, Varok, and Zylo. Qwen, by contrast, does not introduce new words in the reported natural-language table.

This matters because it weakens a common misconception: invented agent language does not require fine-tuning, gradient-based emergent communication, or a long multi-agent training regime. In this paper, some deviation from ordinary vocabulary appears just from prompt pressure and a cramped communication channel.

That does not mean the models are “developing a language” in the full human sense. They are not building culture, literature, gossip, politeness systems, or whatever else humans insist on dragging into language. They are solving a coordination problem. The narrowness is the point. When the task is narrow enough, language can become a tool rather than a social medium.

Efficient language is compression with a task attached

The efficient-language condition tells the sender to invent new concepts for recurring visual building blocks and use them to describe the target in fewer words. The receiver may either receive the sender’s invented lexicon or develop its own local variant from the same visual context.

Here the paper’s main result is strongest for GPT. In the efficient setting, GPT agents outperform natural language on Flags and MS-COCO across the tested length constraints. One concrete comparison from the paper: on the Flags dataset, efficient descriptions averaging around 10 characters reach 0.89 accuracy, compared with 0.79 for natural language.

That is the paper’s cleanest business-relevant mechanism. The invented language is not magic. It is compression aligned with a specific decision problem. Instead of saying “a flag with horizontal red, yellow, and green stripes,” a model can invent or reuse a compact token that bundles the discriminative features needed for that candidate set. On COCO, efficient tokens become object-like or action-like blends. On CLEVR, they try to encode shape, color, material, and arrangement. On Flags, they often become geometric shorthand.

The appendix language analysis makes this less cartoonish than “the model made up nonsense words.” Efficient lexicons often show internal structure. Flags trigger terms around stripes, triangles, tricolors, and layouts. CLEVR produces shape and attribute fragments such as forms related to cubes, cylinders, or grouped objects. MS-COCO produces object-action blends. The invented tokens are not necessarily readable, but they are not random keyboard sneezes either.

The business translation is straightforward: if agents repeatedly coordinate over the same narrow domain, they may benefit from compressed operational vocabularies. That might be good. A logistics agent does not need to write a paragraph every time it refers to “the high-priority shipment with customs-risk profile B and refrigerated handling.” A compact internal code could reduce cost, latency, and ambiguity.

But the receiver has to know the code. In the paper, when the receiver is unaware that the sender is using an efficient language, performance drops. The authors report drops of roughly 0.10–0.15 in Flags and 0.30–0.40 in CLEVR. Compression creates leverage only when the decoding context is shared. Otherwise, it creates brittle opacity with better branding.

Covert language is not just shorter; it is selectively legible

The covert-language condition changes the objective. The sender is instructed to invent a private language that helps the receiver identify the target while preventing an overseer from understanding the message. The overseer sees the same kind of task but does not know the private protocol.

The central finding is not merely that shared protocols help. Of course they do. If the sender gives the receiver the dictionary, the receiver performs better. The more interesting result is that same-model sender-receiver pairs often outperform mixed-model pairs even when the language is developed locally rather than shared.

The GPT-GPT pattern is especially telling. On Flags, with GPT as both sender and receiver, the covert setting reaches 0.98 accuracy when the language is shared, 0.71 when the receiver develops its own local language, and 0.53 for the overseer. On MS-COCO, GPT-GPT reaches 0.97 shared, 0.60 local, and 0.48 overseer. On CLEVR, it reaches 0.85 shared, 0.56 local, and 0.25 overseer.

The phrase “local language” is doing a lot of work here. It means the receiver was not handed the sender’s exact lexicon. It independently developed a protocol from the same visual set. When same-model pairs coordinate better than cross-model pairs, the paper’s interpretation is that similar architectures and training histories may push models toward compatible representational choices. They do not need to agree on a human-readable dictionary. They can partially meet each other in model-space.

This is where the enterprise governance problem starts to become real. In a multi-agent workflow, two copies of the same model may coordinate through compressed conventions that are easier for them to use than for humans to inspect. That is not “AI collusion” in the dramatic sense. It is closer to operational dialect formation under shared incentives. Less spy movie, more procurement system quietly inventing abbreviations nobody in compliance understands.

The human evaluation is an interpretability warning, not the main proof

The paper also includes a human evaluation on synthetic flags using GPT as sender. Participants acted as receivers without knowing the artificial language. They saw a description and selected the matching image from 10 candidates.

The reported accuracies are useful but should be read with discipline. Humans averaged 0.85 in the natural condition, 0.43 in the efficient condition, and 0.31 in the covert condition. The model average was 0.80, 0.47, and 0.33, respectively. GPT as receiver performed higher than humans in all three: 0.97 natural, 0.71 efficient, and 0.53 covert.

This is not the paper’s main evidence that covert protocols exist. The main evidence is the controlled model-to-model referential game. The human study is better understood as an interpretability check: when artificial protocols are produced under efficiency or covertness pressure, human readers lose much of their ability to recover the intended target.

That distinction matters. A weak reading would say, “Humans are bad at understanding AI language.” A better reading is: “Human-readable oversight is not automatically preserved when the communication objective rewards compactness or opacity.” The study is small—15 participants, 50 trials per experiment, 10 trials per participant—so it should not be inflated into a general theory of human incapacity. It does, however, point in the direction enterprises should already expect: once agents optimize their messages for each other, the human auditor becomes a second-class receiver.

How to read the experiments without overclaiming them

The paper contains several experiment types and appendices. They should not all be treated as equal evidence for the same claim.

The appendix on informed senders is especially important. The authors chose an informed-sender setup, where the sender sees all candidate images when describing the target. That makes sense for referential games: a good description should mention what distinguishes the target from distractors. But the appendix shows the effect is model- and dataset-dependent. GPT is relatively insensitive. Maverick benefits substantially in short-message and high-similarity settings. Qwen and Pixtral often perform worse with an informed sender, suggesting they may not exploit distractor information effectively.

For business readers, this is a quiet but useful warning: “more context” is not automatically better. Extra context can help a model select discriminative features, or it can destabilize the description strategy. The phrase “context-aware agent” sounds expensive enough to be true. The paper reminds us it is still an empirical question.

The language analysis shows model fingerprints, not universal Esperanto

The corpus analysis is valuable because it prevents an easy misunderstanding. The paper is not showing that models converge on one superior artificial language. Natural-language outputs across models are relatively similar. Efficient and covert variants diverge sharply.

For example, in the pairwise language-similarity table, Qwen-natural and Pixtral-natural have a corpus-level cosine similarity of 0.86. But GPT-efficient and Pixtral-efficient have a corpus-level cosine similarity of only 0.07. GPT-covert and Pixtral-covert are even more divergent, with cosine similarity reported as 0.00 and low character-level overlap.

This is one of the paper’s most practical findings. Task-oriented languages may be efficient locally but poor at cross-system portability. The protocol is not just task-specific. It is also model-specific. GPT tends toward readable portmanteaus. Qwen often compresses into short symbolic forms. Pixtral shows more divergence and, in some analyses, less ability to build a distinct efficient protocol. Maverick produces its own mixture of compact and noisy forms.

In enterprise terms, this is the difference between an internal codebook and an industry standard. If your agents develop compact local conventions, you may gain speed inside one model family and lose interoperability across vendors, model versions, monitoring tools, and human review processes. That is a very normal enterprise trade-off. It just happens to arrive wearing a fake word like Tricolorbar.

The business lesson: optimize the protocol, not just the model

The paper directly shows that pretrained VLM agents can be prompted into natural, efficient, and covert communication regimes inside controlled visual referential games. It also shows that efficiency and interpretability can diverge. What Cognaptus should infer for business use is narrower but important: multi-agent AI systems need communication governance, not just model governance.

The model is only one part of the system. The protocol between agents may become a source of value or risk.

The most important design principle is simple: never evaluate only whether the receiver got the task right. Also evaluate whether the monitoring layer can reconstruct why.

A multi-agent system can look excellent on task success while becoming less inspectable. The paper’s overseer setup is a clean miniature version of that problem. The receiver may identify the right image. The overseer may fail. In a business process, the equivalent is an agent completing the workflow while leaving a trace that compliance, operations, or management cannot interpret.

That does not mean all private protocols should be banned. Banning compression because it is hard to read would be like banning database indexes because executives cannot read B-trees. The question is where readability is required, where standardization is enough, and where local compression is acceptable because the consequences are low.

Where this result applies, and where it should stay in its lane

The paper’s boundaries are clear and worth respecting.

First, the experiments use small referential games with up to 10 candidate images. This is a useful testbed because success is measurable, but it is not a full enterprise workflow with changing goals, tool calls, user constraints, deadlines, and organizational politics. Lucky models.

Second, the protocols are induced by prompts, not learned through long-term adaptation or fine-tuning. This isolates zero-shot behavior, which is valuable, but it also means the resulting languages may be less stable than trained communication systems. The appendix notes that attempts to improve language across turns did not produce measurable gains, and the authors suggest that meaningful improvement may require explicit training.

Third, the metrics are synthetic. Game accuracy, description length, new-word rate, and overseer performance are appropriate for this study. They do not fully capture semantic fidelity, robustness, security, or generalization outside the tested visual domains.

Fourth, the overseer design is narrow. In the paper, overseers are model agents interpreting descriptions without the private protocol. Real monitoring systems might combine logs, tool traces, embeddings, classifiers, human review, and policy constraints. Or they might be a spreadsheet and a prayer. Results will vary.

Finally, the communication is English-prompted and visually grounded. Other languages, non-visual workflows, larger agent populations, and longer-horizon tasks could produce different behavior.

These limitations do not weaken the paper’s core contribution. They prevent the wrong headline. The right headline is not “AI agents will secretly conspire.” The right headline is: when agents are rewarded for task success under communication constraints, natural language is not guaranteed to remain the coordination medium.

Natural speech is an interface, not a law of physics

The paper’s quiet achievement is that it turns a vague worry into a testable systems question. Can pretrained VLM agents invent compact protocols? Yes, in controlled referential games. Can those protocols outperform natural language under some constraints? Yes, especially for GPT in efficient settings on Flags and MS-COCO. Can similar agents interpret covert protocols better than outsiders? Yes, often. Can humans reliably inspect the resulting messages? Not necessarily.

For enterprise AI, the lesson is not to panic about invented words. The lesson is to decide which communication channels must remain human-readable, which can become machine-optimized, and which require a translation layer.

Natural language will remain the interface between AI systems and human accountability. But between agents, it may increasingly become just one protocol among many. Sometimes it will be the right one. Sometimes it will be verbose, expensive, and unnecessarily human.

The governance mistake would be assuming that because a system was trained on human language, it will always prefer human language when coordinating with itself. The paper shows a more plausible future: agents use natural language when it is useful, compress it when it is costly, and obscure it when the objective says opacity pays.

That is not science fiction. That is incentive design doing what incentive design always does: ruining everyone’s comfortable assumptions.

Cognaptus: Automate the Present, Incubate the Future.