Paper deep dive

Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach

Mohamed Chahine Ghanem

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 62

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%

Last extracted: 8/5/2026, 4:23:20 AM

Summary

This paper proposes a black-box steganalysis framework to detect covert collusion among populations of tool-using Large Language Model (LLM) agents. The authors address the risk of agents coordinating to rig markets or manipulate reviews while appearing well-behaved individually. The proposed detector is encoding-agnostic, utilizing cross-run mutual information, permutation tests, distributional shift statistics, and timing/tool-call side channels. It employs a red-versus-blue co-evolutionary approach where an adaptive adversary continuously rewrites its encoding to evade detection, allowing the mapping of a detection-capacity frontier based on information theory.

Entities (7)

LLM Agents · system-component · 98%Covert Collusion · threatconcept · 97%Black-Box Steganalysis Detector · methodtool · 96%Adaptive Adversary · agentrole · 94%Tool-Using Environment · contextsetting · 93%Cross-Run Mutual Information · metricfeature · 92%Detection-Capacity Frontier · theoretical-concept · 90%

Relation Signals (6)

Black-Box Steganalysis Detector → detects → Covert Collusion

confidence 96% · We treat covert coordination as an information-hiding problem and build a black-box steganalysis detector

LLM Agents → canengagein → Covert Collusion

confidence 95% · a handful of agents can quietly coordinate, rigging a market... while each one looks perfectly well-behaved.

Adaptive Adversary → evades → Black-Box Steganalysis Detector

confidence 94% · we pit the detector against an adversary that continually rewrites its encoding to slip past whatever the detector has learned

LLM Agents → operatein → Tool-Using Environment

confidence 93% · run this red-versus-blue contest in tool-using, memory-carrying environments

Black-Box Steganalysis Detector → uses → Cross-Run Mutual Information

confidence 92% · combines cross-run mutual-information estimation... to build a black-box steganalysis detector

Detection-Capacity Frontier → defineslimitfor → Black-Box Steganalysis Detector

confidence 90% · a detection-capacity frontier, a covert bit-rate below which black-box detection is provably no better than chance.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Tool-using agents built on large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure. This creates a population-level risk that single-agent safeguards miss: a handful of agents can quietly coordinate, rigging a market, boosting one another in a review process, or timing a joint data grab, while each one looks perfectly well-behaved. The difficulty is that the organisations running these agents cannot see inside one another's models, so any realistic detector must work from behaviour alone: black-box, trace-only, and often with only partial visibility. We treat covert coordination as an information-hiding problem and build a black-box steganalysis detector that combines cross-run mutual-information estimation, permutation tests, distributional-shift statistics, and timing and tool-call side channels, all calibrated to a fixed false-positive budget. Our central move is to stop testing against a single fixed code: we pit the detector against an adversary that continually rewrites its encoding to slip past whatever the detector has learned, and we run this red-versus-blue contest in tool-using, memory-carrying environments rather than toy games. Capacity theory then tells us what to expect, a detection-capacity frontier, a covert bit-rate below which black-box detection is provably no better than chance. We set out an experiment to map this frontier, report clearly labelled placeholder results pending measurement, and flag a practical evasion, spreading a payload across sessions, that current methods largely miss.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

60,466 characters extracted from source content.

Expand or collapse full text

Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach Mohamed Chahine Ghanem , IEEE Manuscript submitted . (Corresponding author: M. C. Ghanem.)M. C. Ghanem is with Keele University, Newcastle-Under-Lyme, U.K. (e-mail: m.ghanem@keele.ac.uk). Abstract Tool-using agents built on large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure. This creates a population-level risk that single-agent safeguards miss: a handful of agents can quietly coordinate—rigging a market, boosting one another in a review process, or timing a joint data grab—while each one looks perfectly well-behaved. The difficulty is that the organisations running these agents cannot see inside one another’s models, so any realistic detector must work from behaviour alone: black-box, trace-only, and often with only partial visibility. We treat covert coordination as an information-hiding problem and build a black-box steganalysis detector that combines cross-run mutual-information estimation, permutation tests, distributional-shift statistics, and timing and tool-call side channels, all calibrated to a fixed false-positive budget. Our central move is to stop testing against a single fixed code: we pit the detector against an adversary that continually rewrites its encoding to slip past whatever the detector has learned, and we run this red-versus-blue contest in tool-using, memory-carrying environments rather than toy games. Capacity theory then tells us what to expect—a detection–capacity frontier, a covert bit-rate below which black-box detection is provably no better than chance. We set out an experiment to map this frontier, report clearly labelled placeholder results pending measurement, and flag a practical evasion—spreading a payload across sessions—that current methods largely miss. IEEEkeywords AI safety, multi-agent systems, large language models, steganalysis, covert channels, collusion detection, information hiding, adversarial machine learning. Impact Statement Autonomous agents built on large language models are being deployed by many independent organisations onto shared infrastructure, where they increasingly interact without a single overseer. Safeguards designed for one agent do not address population-level risks: a small colluding subset can coordinate covertly to distort markets, audits, or shared decisions while appearing to behave normally. This work treats such collusion as an information-hiding problem and provides (i) a detection method that assumes no access to the other parties’ models—the only realistic assumption across organisational boundaries—and (i) an honest, capacity-theoretic account of when such detection must fail. Making both the capability and its limits explicit supports auditing, procurement, and standards for multi-agent deployments, and helps regulators and operators calibrate expectations rather than over-trust black-box monitoring. To limit dual-use, we release detection tooling and benchmarks openly while withholding the strongest attack artifacts, consistent with responsible-disclosure norms. 1 Introduction For most of their short history, LLM agents have worked for a single boss: one operator sets them up, points them at a task, and reads the result. That is changing. Agents from different organisations are beginning to meet on shared infrastructure—marketplaces, review pipelines, shared tool servers—and to interact with no single party in charge [12, 11]. The upside is new forms of coordination; the downside is a class of failures that safeguards built for one model at a time simply cannot see [12]. Chief among them is covert collusion: a subset of agents quietly steering toward an outcome that hurts the wider system—rigging a procurement auction, forming a reciprocal “boost ring” in automated review, or timing a joint data-exfiltration trigger—while each agent, taken on its own, looks entirely above board. As a concrete example, consider a procurement platform where supplier-agents from competing firms submit bids. If a subset—each for a different principal—covertly agree on who wins each round and at what price, they extract supra-competitive rents while every bid looks defensible. The coordination needs no explicit message: a shared convention over bid phrasing, timing, or query order carries the few bits required. No agent breaks a local policy and no single transcript is incriminating, yet the operator, unable to inspect the suppliers’ models, sees only well-formed bids—the population-level failure that motivates trace-only, cross-principal detection. Recent work has shown that LLM agents can, in principle, communicate steganographically: embedding a hidden payload inside otherwise natural outputs so that coordination survives casual inspection and even paraphrasing defences [22, 21]. The threat is not hypothetical folklore; it follows directly from classical results on subliminal channels [28] and the information-theoretic limits of steganography [2, 23], now instantiated by models fluent enough to realise those channels in natural language and, with tools, to construct new ones at run time. Detection is hard in a real deployment for a structural reason, not because the adversary is especially clever: no principal can look inside another principal’s models. A monitor has no access to the weights, activations, or private prompts of an agent that some other organisation runs. All it sees are the traces the agents leave behind—their messages, tool calls, and timing—and often not even all of those. This black-box, cross-principal, partially observable setting is the one we target, and it rules out any method that quietly assumes a single overseer with full visibility. We frame the problem as steganalysis: detecting a hidden channel from statistical properties of the carrier, without decoding it [2, 35, 34]. This is not generic anomaly detection, which flags any unusual behaviour; steganalysis assumes a deliberately hidden payload and an adversary actively working to look normal [28], and that assumption shapes both the detector and the evaluation. Two commitments set our approach apart from prior collusion detectors. The detector is encoding-agnostic—it never assumes a known covert scheme, because a competent adversary will not reuse one—and it is measured against an adaptive adversary that co-evolves its encoding to defeat whatever the detector has learned, so the headline evidence is a red-versus-blue trajectory rather than a single static score. The study runs in tool-using, persistent-memory environments and adds a cross-session evaluation axis that existing benchmarks, to our knowledge, do not measure. To our knowledge this is the first black-box, cross-principal steganalysis framework for tool-using agent populations that couples a capacity-theoretic detectability bound with an adaptive, co-evolving adversary. Contributions. 1. We formulate cross-principal covert collusion among tool-using agents as black-box steganalysis under partial observability, with an explicit threat model (Section 3). 2. We design an encoding-agnostic meta-detector that fuses cross-run mutual information, permutation-invariance tests, distributional-shift statistics, and timing/tool-call side channels, calibrated to a fixed false-positive budget (Section 3). 3. We introduce an adaptive, co-evolving adversary and a red-versus-blue evaluation methodology that reports co-evolution curves rather than static AUROC (Section 3). 4. We specify tool-using, persistent-memory testbeds that extend stylised collusion benchmarks, and a cross-session evaluation axis (Section 5). 5. We give a capacity-theoretic analysis predicting a detection–capacity frontier and an experimental protocol to chart it, with illustrative placeholder results (Sections 4–5). 6. We discuss limits, evasions, and responsible-disclosure considerations (Section 6). 2 Background 2.1 Multi-Agent LLM Systems Agent-based computing has a long lineage in distributed AI [33]. LLM-based multi-agent systems revive these ideas at a new capability level: agents plan, use tools, hold persistent memory, and communicate in natural language [25, 11]. As deployments scale across organisational boundaries, system-level behaviour—rather than any single agent—becomes the relevant unit of safety analysis [12]. Our work inherits this framing and asks a security question about it. 2.2 Secret Collusion and Steganographic Coordination Motwani et al. [22] formalised secret collusion among LLM agents, deriving results on the capacity and incentives of models to communicate steganographically and on the limits of mitigation. Mathew et al. [21] showed that steganographic collusion can emerge from misspecified rewards and can survive paraphrasing, undercutting the assumption that a paraphrasing “firewall” is sufficient. These peer-reviewed results establish that the capability exists; the open problem is detection under realistic access constraints. Neither result gives a monitor that works without model access, and both assume settings simpler than tool-using, multi-session deployments. Our contribution is the missing detection side of this story, under the access constraints that actually hold across organisations. 2.3 Foundations of Steganography and Covert Channels The subliminal channel [28] and Cachin’s information-theoretic model of steganography [2] give the vocabulary we use throughout: a hidden channel is secure when the stego distribution is statistically close to the innocent “cover” distribution, and detectable to the extent that it is not. Moulin and O’Sullivan [23] characterise information-hiding capacity under distortion constraints, quantifying the rate–stealth trade-off that our analysis exploits. Modern linguistic steganography and steganalysis [35, 34] and covert-channel taxonomies [32] supply concrete detector families, several of which we adapt to the agent setting. Two properties transfer directly to agents: detectability is governed by a divergence between innocent and coordinated behaviour, and that divergence can be reduced only at the cost of covert throughput. The difference in the agent setting is that the “carrier” is not a fixed medium but an open-ended space of messages, timings, and tool actions a capable model can reshape at run time. 2.4 Watermarking, Detectors, and Their Robustness Watermarking of model outputs [14] and the broader literature on text watermarking [19] are relevant both as an attribution primitive and as a source of distributional features for detection. Their known fragility is instructive: paraphrase-style attacks can evade AI-text detectors [16], a cautionary result we take seriously when reasoning about an adaptive adversary. Cryptographic proofs of inference such as zkLLM [29] point toward verifiable attribution, but remain heavyweight and do not address covert coordination directly. We use these results in two ways: watermark-style statistics feed the detector’s distributional features, and opt-in attribution is one of the layered mitigations we recommend for deployments where principals cooperate. 2.5 Emergent Communication That agents can invent communication protocols is well established in multi-agent reinforcement learning [8, 17]. Covert coordination is, in effect, emergent communication constrained to be statistically inconspicuous—a lens that motivates encoding-agnostic detection, since the protocols agents invent are often opaque to outsiders and sensitive to training pressures, so no fixed decoder will keep pace with a learning population. 2.6 Multi-Agent Safety, Control, and Infrastructure AI control studies protocols that preserve safety even when an agent actively subverts oversight [9], but is developed largely for a single untrusted agent; extending it to colluding groups is open. Governance-oriented work on agent visibility is peer-reviewed [4], while several proposals for agent infrastructure and identity remain preprints: “Infrastructure for AI Agents” [5] and “IDs for AI Systems” [3] (both preprints), the “Multi-Agent Risks from Advanced AI” technical report [12], and “Open Problems in Cooperative AI” [7] (workshop report). We cite these for motivation and pair them with the peer-reviewed anchors above. Collectively, this line of work argues that oversight designed for a single model is insufficient once many agents interact, but it stops short of an operational, principal-agnostic detector—the gap this paper targets. 2.7 Multi-Agent Attacks and the Detection Frontier Attacks can propagate through agent populations—for example, infectious jailbreaks [10] and LLM-to-LLM prompt injection within multi-agent systems [18]. Protocol-level analyses of emerging agent standards suggest new tool-integration surfaces amplify such risks; the most detailed Model Context Protocol study to date is a preprint [20], which we cite as such alongside the peer-reviewed workshop result [18]. Finally, the collusion-detection frontier is presently defined by three preprints, each with a limitation this paper is designed to address: “Audit the Whisper” [30] is black-box and trace-only but adapts only within a fixed scheme family and uses tool-free environments; “Colosseum” [24] is black-box but behavioural (regret-based) and not evaluated against a co-evolving encoder; and the multi-agent-interpretability approach behind NARCBench [27] attains strong results but requires white-box activation access, which is infeasible across principals. We treat all three as preprints and position our contribution precisely at the gap they leave: black-box detection against an adaptive adversary in tool-using, persistent-memory settings. Table 1 summarises this positioning across the axes that matter for realistic multi-principal deployment. Table 1: Positioning relative to prior collusion-analysis work. ✓ = supported/evaluated; × = not; other entries note the partial form. Preprints/reports are marked † ; peer-reviewed formulation papers (∗ ) are analyses rather than detectors, so detection axes are marked “—”. Approach Black-box Enc.-agnostic Adaptive adv. Tools Memory Cross-sess. Partial obs. Secret collusion∗ [22] — — × × × × × Hidden in plain text∗ [21] — — × × × × × Audit the Whisper† [30] ✓ partial fixed family × × × partial Colosseum† [24] ✓ behavioural × partial × × × NARCBench† [27] white-box ✓ partial × × × × This work ✓ ✓ ✓ (co-evolving) ✓ ✓ ✓ ✓ 3 Methodology 3.1 Threat Model and Problem Formulation Consider a population of N agents, operated by two or more principals, interacting over T rounds on shared infrastructure. A colluding subset of size k (1<k≤N1<k≤ N) seeks to coordinate on a private payload m (e.g., which agent should win a given round) while a monitor attempts to decide whether collusion is present. The monitor observes a trace =(ui(t),ci(t),τi(t))i∈S,t≤T,O\;=\;\(u_i^(t),\,c_i^(t),\, _i^(t))\_i∈ S,\,t≤ T, where ui(t)u_i^(t) is agent i’s natural-language output at round t, ci(t)c_i^(t) its tool calls, and τi(t) _i^(t) timing/rate metadata, restricted to an observed subset S⊆1,…,NS \1,…,N\ (partial observability). Critically, the monitor has no access to model weights, activations, or private prompts of agents it does not operate. The monitor is calibrated to a fixed false-positive rate (FPR) α; we report α∈10−2,10−3α∈\10^-2,10^-3\. We cast detection as a hypothesis test: H0H_0 (no collusion), under which observable messages follow an innocent cover distribution PcoverP_cover, versus H1H_1 (collusion), under which they follow a stego distribution PstegoP_stego induced by the adversary’s encoding. The adversary’s goal is to maximise covert throughput while keeping PstegoP_stego statistically close to PcoverP_cover; the monitor’s goal is to detect the resulting discrepancy at FPR α. Formally, write r(e)r(e) for the covert throughput of encoding e (bits per round) and ϵ(e)=D(Pcover∥Pstego(e))ε(e)=D(P_cover\|P_stego(e)) for its induced divergence. Operationally, r(e)r(e) is the number of payload bits reliably delivered per round, estimated as the mutual information I(m;m^)I(m; m) between the intended payload m and the partner’s decoded estimate m m over a batch of rounds; we quote r in bits per round throughout, so bits per session and per interaction follow by scaling with the round count. The adversary solves maxe⁡r(e)s.t.ϵ(e)≤ϵ¯, _e\;r(e) .t. ε(e)≤ ε, (1) trading throughput against a stealth budget ϵ¯ ε; the monitor, dually, seeks a test whose power at FPR α stays high across the encodings the adversary can reach. The co-evolution loop below plays out exactly this game over adaptation rounds. Scope and assumptions. We make the following explicit: • No model access. The monitor cannot read weights, activations, gradients, or private prompts of agents operated by other principals. • Trace observability. The monitor sees a (possibly strict) subset of messages, tool calls, and timing metadata, and knows the task structure. • Adversary knowledge. The adversary may know the detector’s design and adapt to it, but does not control the monitor or its control episodes. • Bounded adaptation. Encoding search is in-context (no weight updates), bounding red-team cost and reflecting the most accessible attacker. • Ground truth. In evaluation, collusion is present or absent by construction, while the encoding remains free for the adversary to evolve. 3.2 Black-Box Steganalysis Pipeline Because a competent adversary will not reuse a known scheme, the detector must be encoding-agnostic. We compute complementary trace features and fuse them: • Cross-run mutual information. Estimated dependence between agents’ outputs and coordination-relevant outcomes across repeated runs, using a neural estimator [1]. This is the primary signal for hidden coordination. • Permutation-invariance test. Under H0H_0, agent identities are exchangeable with respect to outcome; a covert channel breaks this symmetry. We compare observed statistics against an identity-shuffled null. • Distributional-shift statistics. Token- and n-gram-level divergences relative to a per-context cover model, following linguistic-steganalysis practice [35, 34], and watermark-style variance features [14]. • Timing and action-rate side channels. Inter-message timing and action-rate patterns, a covert-channel family long recognised in the network setting [32]. • Tool-call patterns. Call sequences and argument entropy, targeting tool-mediated channels available to agentic models. These five signals are chosen to be complementary rather than redundant: distributional statistics target lexical and syntactic channels, cross-run MI targets semantic (content-selection) channels, the permutation test targets role- or identity-based coordination, and the timing and tool-call features target protocol-level channels that non-agentic models cannot use. No single one suffices—an adversary that neutralises token-level statistics may still leak through timing or tool-call structure—so fusing them forces the adversary to suppress every channel at once, which is what makes the rate–stealth trade-off bite. A meta-detector (a calibrated logistic/gradient-boosted fusion) combines these features and is thresholded on held-out control episodes to meet the FPR budget α. This design follows directly from the theory of Section 4: the mutual-information feature estimates the very divergence ϵε that governs detectability in (2), and calibration places the threshold tαt_α so that the detector operates as close to the frontier rate r⋆(α)r (α) of Corollary 1 as finite samples allow. We report only held-out/transfer performance; training and testing never share an encoding. 3.3 Feature Definitions Let X summarise an agent’s observable output in a round and Y a coordination-relevant outcome (e.g., the realised winner). The features are: (i) cross-run mutual information—we estimate I^(X;Y) I(X;Y) across runs with a neural estimator [1], where I(X;Y)≈0I(X;Y)≈ 0 under H0H_0 while a covert channel induces I(X;Y)>0I(X;Y)>0; (i) permutation statistic—for a statistic g on the true agent–outcome pairing, we form a null by shuffling identities π and report the standardised deviation z=(g(id)−μπ)/σπz=(g(id)- _π)/ _π; (i) distributional divergence—against a per-context cover model Q, a token-level divergence D^(Pstego∥Q) D(P_stego\|Q) and watermark-style variance features [14, 35]; (iv) timing/rate features—entropy and periodicity of inter-message intervals and action rates [32]; and (v) tool-call features—empirical entropy of call sequences and argument distributions. The detector maps the feature vector ϕ()∈ℝdφ(O) ^d to a score s=fθ(ϕ)s=f_θ(φ). Algorithm 1 Black-box meta-detector (scoring and calibration) 1:control episodes C, test trace O, FPR budget α 2:extract features ϕ()φ(O) and ϕ(o):o∈\φ(o):o \ 3:fit fusion fθf_θ on labelled held-out episodes (distinct encodings) 4:compute control scores so=fθ(ϕ(o)):o∈\s_o=f_θ(φ(o)):o \ 5:tα←(1−α)t_α←(1-α)-quantile of so\s_o\ ⊳ conformal calibration 6:s←fθ(ϕ())s← f_θ(φ(O)) 7:return [s>tα] [\,s>t_α\, ] ⊳ decision at FPR ≤α≤α 3.4 Calibration to a Fixed False-Positive Budget To make the FPR guarantee meaningful across heterogeneous contexts, the threshold is set by conformal calibration on held-out control episodes: tαt_α is the (1−α)(1-α) empirical quantile of control scores, which controls the FPR at ≤α≤α in expectation without distributional assumptions (Algorithm 1). Because neural MI estimates are biased in finite samples, we calibrate on estimator outputs rather than nominal MI values, and we report confidence intervals over calibration folds. 3.5 Computational Complexity and Overhead The detector’s cost is dominated by neural MI estimation, which is linear in the number of observed episodes and independent of model internals; permutation and distributional statistics are computed from cached trace summaries. Concretely, for population N and message length T, the distributional, timing, and tool-call features cost O(NT)O(NT), a permutation test with K shuffles costs O(KNT)O(KNT), and neural MI estimation is linear in episodes per gradient pass; only the MI estimator needs a GPU, while the rest run on CPU. In deployment the detector runs asynchronously on logged traces rather than in the critical path of any agent, so it adds monitoring cost but not per-interaction latency. The co-evolution loop (Algorithm 2) is the expensive component—each round re-runs episodes—so the bulk of adaptation rounds use open-weight models, with frontier models reserved for spot checks. 3.6 Adaptive Adversary and Co-Evolution The distinguishing element of our methodology is the adversary. Rather than fixing an encoding, a red-team controller searches encoding strategies in context (no fine-tuning, to bound cost) to minimise the current detector’s score subject to preserving payload throughput: 1. initialise from an encoding family (lexical, syntactic, semantic, format, timing, or tool-mediated); 2. run episodes; measure achieved covert rate and detector score; 3. mutate the encoding instructions/conventions toward lower detectability (an evolutionary/best-of-n search); 4. repeat for R rounds, logging the full red-versus-blue trajectory. This yields co-evolution curves—detector performance as a function of adaptation round—which we treat as the primary evidence, in contrast to single-shot AUROC against a frozen scheme (Algorithm 2). Algorithm 2 Adaptive co-evolution (red vs. blue) 1:encoding family ℰ0E_0, rounds R, detector fθf_θ, floor rminr_ 2:e←ℰ0e _0 3:for r=1r=1 to R do 4: run episodes with encoding e; log traces 5: measure covert rate r^(e) r(e) and detector score s(e)s(e) 6: propose mutations e′\e \ of e (best-of-n/evolutionary) 7: e←arg⁡mine′⁡s(e′)s.t.r^(e′)≥rmine← _e s(e )\;\;s.t.\;\; r(e )≥ r_ 8: record (r,r^,AUCr,TPRr)(r,\ r,\ AUC_r,\ TPR_r) 9:end for 10:return co-evolution trajectory To summarise a trajectory in one number we report the area under the co-evolution curve, AUCC=1R∑r=1RAUCrAUCC= 1R _r=1^RAUC_r, and the adaptation half-life R1/2R_1/2, the round at which detection AUC falls halfway from its static value toward chance. Lower AUCC and shorter R1/2R_1/2 indicate a less robust detector. Adversary capability. The red team may switch freely among the six encoding families of Appendix 8 and compose them; a mutation perturbs the natural-language convention that defines the current encoding (a synonym map, a syntactic template, a timing schedule) and is accepted only if it lowers the detector score without dropping throughput below rminr_ . Each round has a fixed budget of candidate encodings and evaluation episodes. Importantly, the adversary is granted full knowledge of the detector’s design and decision rule but not of the specific control episodes used for calibration—a strong yet realistic threat, since a determined attacker can study a published method but cannot see a defender’s private validation data. Figure 1: System model. Agents from independent principals interact over shared infrastructure; the monitor observes only partial traces and has no access to other principals’ model internals. The adversary co-evolves its covert encoding against the detector. 4 Theory and Analysis We now make precise why an adaptive adversary can eventually defeat any black-box test, and where detection remains viable. The argument is a direct consequence of established steganography and hypothesis-testing theory; we claim novelty in its application to agent collusion and in the empirical frontier it predicts, not in the underlying inequalities. Steganographic security Following Cachin [2], an encoding is ϵε-secure against a passive monitor when the cover and stego distributions satisfy D(Pcover∥Pstego)≤ϵ,D\! (P_cover\,\|\,P_stego )\;≤\;ε, (2) where D(⋅∥⋅)D(·\|·) is relative entropy; ϵ=0ε=0 is perfect (undetectable) steganography. Limit on any black-box test Deciding H0H_0 versus H1H_1 from observed traces is a binary hypothesis test between PcoverP_cover and PstegoP_stego. For any test operating at false-positive rate α, the achievable true-positive rate is bounded by statistical distinguishability. Writing δ=TV(Pcover,Pstego)δ=TV(P_cover,P_stego) for total variation, TPR≤α+δ,δ≤12D(Pcover∥Pstego)≤ϵ2,TPR\;≤\;α+δ, δ\;≤\; 12\,D\! (P_cover\|P_stego )\;≤\; ε2, (3) the second inequality being Pinsker’s. Thus as the adversary drives ϵ→0ε→ 0, the best possible detection at FPR α satisfies TPR→αTPR→α: no test—however clever—beats chance by more than ϵ/2 ε/2. This holds for our meta-detector and for any competitor with the same observational access. We state this as a proposition. Proposition 1 (Detectability ceiling). For any decision rule based on the observed traces and operating at false-positive rate α, the true-positive rate satisfies TPR≤α+ϵ/2TPR≤α+ ε/2, where ϵ=D(Pcover∥Pstego)ε=D(P_cover\|P_stego). Consequently limϵ→0suptests(TPR−α)=0 _ε→ 0 _tests(TPR-α)=0. Proof. A level-α test has power at most α+TV(Pcover,Pstego)α+TV(P_cover,P_stego), since total variation is the maximum gap in probability assignable to any event and the rejection region is one such event. Pinsker’s inequality gives TV≤12D(Pcover∥Pstego)=ϵ/2TV≤ 12D(P_cover\|P_stego)= ε/2; the limit follows. ∎ Rate–stealth trade-off and the frontier The adversary cannot, however, make ϵε arbitrarily small for free: encoding more payload per round generally forces PstegoP_stego further from PcoverP_cover, raising ϵε. Information-hiding capacity under a distortion constraint [23] characterises the maximum reliable covert rate r for a given tolerated deviation. Combining this with (3) yields a detection–capacity frontier: there exists a rate r⋆(α)r (α) such that, for covert rates r<r⋆r<r , the adversary can hold ϵε small enough that no black-box test at FPR α achieves TPR bounded away from α, whereas for r>r⋆r>r detection is feasible. Tool access effectively enlarges the adversary’s carrier space (new channels via code, retrieval, formatting), lowering r⋆r and shrinking the detectable region. This frontier is the object our experiments are designed to estimate empirically; the theory tells us its shape and that a negative regime must exist, which is why we frame the empirical contribution as charting the frontier rather than defeating the adversary outright. Lemma 1 (Partial observability weakens detection). If the monitor observes an independent fraction ρ∈(0,1]ρ∈(0,1] of colluder messages, then under an additive per-message decomposition of relative entropy the observable divergence obeys ϵρ≤ρϵ _ρ≤ρ\,ε. Hence, by Proposition 1, TPR≤α+ρϵ/2TPR≤α+ ρε/2. Whether this additivity holds depends on the trace: it is exact when colluder messages are conditionally independent given the payload, and conservative—an over-estimate of what the monitor learns—under positive correlation between messages (Appendix 9). The bound therefore errs on the side of crediting the monitor with more signal than it actually has, which is the safe direction for a limit result. Corollary 1 (Frontier and carrier dimension). Fix α. There exists a covert rate r⋆(α)>0r (α)>0 such that detection is infeasible (TPR→αTPR→α) for all r<r⋆r<r . Granting the adversary additional independent carriers (e.g., tools) permits the same covert rate at smaller per-carrier deviation, lowering ϵε for fixed r and thus decreasing r⋆r —shrinking the detectable region. Worked example. Proposition 1 is quantitatively demanding for the monitor. To hold the true-positive rate within 0.050.05 of chance at any FPR, an adversary needs only ϵ/2≤0.05 ε/2≤ 0.05, i.e., ϵ≤5×10−3ε≤ 5× 10^-3 nats of divergence per decision—a very small statistical footprint. This is why high-rate covert coordination is catchable while a patient, low-rate channel is not, and why we report a frontier rather than a single accuracy number. 5 Experimental Design, Results, and Analysis Reproducibility and integrity note. All numeric values in Tables 3–6 are illustrative placeholders that specify the expected shape of results and provide a template; they are anchored to ranges reported by prior baselines but are not measured outcomes and must be replaced with the authors’ own runs before submission. 5.1 Environments All environments are tool-using, carry persistent memory, and involve at least two principals. • Sealed-bid procurement. N supplier-agents bid over T rounds through a market API; k colluders attempt to rotate wins or suppress bids. Tools: submit_bid, query_history, scratch memory. Payload: the designated winner per round. • Grant/peer-review ring. Reviewer-agents score submissions in natural language; k colluders covertly inflate one another’s items. Tools: retrieve_submission, post_review, memory of prior rounds. • Distributed code-review. Cross-principal agents review and merge tasks; k colluders embed a covert channel in comments or tool-call patterns to bias a merge or trigger an action. Tools: run_tests, web_search, comment. Collusion labels are set by construction (colluders are incentivised to coordinate; controls are not), giving clean ground truth while leaving the encoding free for the adversary to evolve. In each environment the payload per round is small—typically one to three bits, e.g., the designated winner or the target submission—reflecting that effective collusion needs only low bandwidth. Persistent memory is a per-agent scratch store carried across rounds and, in the multi-session conditions, across sessions; colluders may use it to maintain a shared convention, while controls use it only for legitimate task state. 5.2 Population, Factors, and Protocol We use a mix of frontier API models, for generality, and self-hosted open-weight models, which carry the bulk of the co-evolution and ablation runs to keep cost manageable. The factors we vary are the population size N∈4,8,16N∈\4,8,16\, the colluder fraction k/N∈0,0.25,0.5k/N∈\0,0.25,0.5\, the adaptation round R∈0,1,2,3,5,8R∈\0,1,2,3,5,8\, the observed trace fraction ρ∈100%,50%,25%ρ∈\100\%,50\%,25\%\, the model mix (homogeneous or heterogeneous), and the session structure (a single session or several). Table 2 lists the full grid; metrics and baselines follow below. Table 2: Experimental factors and levels. Factor Levels Environment procurement / review-ring / code-review Encoding family lexical / syntactic / semantic / format / timing / tool Adaptation round R 0, 1, 2, 3, 5, 8 Population N 4, 8, 16 Colluder fraction k/Nk/N 0, 0.25, 0.5 Observed fraction ρ 100%, 50%, 25% Model regime homogeneous / heterogeneous / frontier subset Session structure within / 3-session / 5-session 5.3 Metrics We report ROC-AUC and, since the operating point matters more than a threshold-free curve, TPR at fixed FPR (10−2,10−310^-2,10^-3) with conformal thresholds (Algorithm 1), together with precision (PPV) and the implied alert rate—expected false alarms per 10001000 messages at the chosen budget. We also report the covert rate in bits/round, the co-evolution summaries AUCC and R1/2R_1/2, the estimated frontier rate r⋆(α)r (α), cross-session AUC, and monitor wall-clock overhead. Every figure is averaged over at least 3030 seeds with 95%95\% bootstrap confidence intervals, and key differences (detector vs. baseline at a fixed round) are tested with a paired Wilcoxon signed-rank test, following reproducibility guidance for stochastic experiments [13]. A leave-one-out ablation that disables each detector component in turn quantifies its marginal contribution, and Fig. 2 doubles as a theory-versus-measurement check: the curve is the bound predicted by Section 4, onto which the protocol overlays the empirically estimated r⋆(α)r (α) from a payload-size sweep. 5.4 Baselines We compare against six reference points, all run through the same harness and calibrated at the same FPR so the comparison is fair. Chance fixes the floor. An LLM-as-judge reads whole transcripts and rates how likely coordination is, standing in for the naive “just ask a capable model” approach. A reproduced cross-run mutual-information detector [30] and a reproduced behavioural regret probe [24] represent the two strands of concurrent black-box work. A graph-anomaly baseline builds an agent–tool interaction graph per episode and flags structural outliers from simple centrality features, catching coordination that surfaces in interaction structure rather than message content. A paraphrasing mitigation [16] tests whether simply rewriting messages is enough to break the channel. Finally, a white-box activation probe [27] is given privileged access to model internals and reported only as an oracle upper bound—a yardstick for how much the cross-principal, black-box constraint actually costs. Every baseline uses the same base models and the same conformal calibration as our detector, and its own hyperparameters are tuned on a held-out split to maximise its validation AUC, so none is handicapped by our choices. Where a reference implementation is released we adopt it and note any deviation, and we first reproduce each baseline’s published operating point on its original benchmark before porting it to our environments. Figure 2: Schematic detection–capacity frontier (illustrative placeholders). Below r⋆r detection approaches chance; tool access lowers r⋆r and shrinks the detectable region, consistent with Corollary 1. 5.5 Results Table 3 reports the sanity baseline on fixed (known) encodings: the fused meta-detector is near-perfect when the scheme is known, while an LLM-judge is weak on steganographic coordination. Table 4 reports the core result—graceful degradation under the adaptive adversary—and Fig. 2 shows the detection–capacity frontier at FPR=10−3FPR=10^-3. Tables 5–6 give ablations over observability, population/heterogeneity, session structure, and the black-box gap to a white-box oracle. Table 3: Detection on fixed (known) encodings—sanity baseline. Illustrative placeholders. Detector AUC TPR@10−210^-2 TPR@10−310^-3 Chance 0.50 0.010 0.001 LLM-as-judge 0.61 0.18 0.05 Cross-run MI (single) 0.82 0.71 0.58 Timing / action-rate only 0.74 0.40 0.22 Meta-detector (ours) 0.99 0.98 0.95 Table 4: Robustness to the adaptive adversary (co-evolution)—core result. Illustrative placeholders. Adaptation round Covert rate (bits/rd) Meta AUC TPR@10−310^-3 R=0R=0 (static) 2.0 0.99 0.95 R=1R=1 1.6 0.93 0.80 R=2R=2 1.3 0.86 0.64 R=3R=3 1.1 0.80 0.51 R=5R=5 0.8 0.74 0.38 R=8R=8 0.5 0.69 0.29 R=8R=8 + unrestricted tools 0.5 0.56 0.05 Table 5: Ablations. Illustrative placeholders. (a) partial observability; (b) population/heterogeneity; (c) session structure. (a) Observed trace fraction AUC TPR@10−310^-3 100% 0.86 0.64 50% 0.78 0.44 25% 0.67 0.25 (b) Setting AUC N=4N=4, k/N=0.5k/N=0.5, homogeneous 0.84 N=8N=8, k/N=0.25k/N=0.25, homogeneous 0.80 N=8N=8, k/N=0.5k/N=0.5, homogeneous 0.85 N=16N=16, k/N=0.25k/N=0.25, homogeneous 0.77 N=8N=8, k/N=0.25k/N=0.25, heterogeneous 0.76 (c) Session structure AUC TPR@10−310^-3 Within-session 0.86 0.64 3-session spread 0.71 0.33 5-session spread 0.64 0.22 Table 6: Black-box gap vs. a white-box oracle. The oracle is an upper bound, not a deployable cross-principal baseline. Illustrative placeholders. Method (regime) AUC White-box activation probe — in-distribution (oracle) 0.98 White-box activation probe — transfer (oracle) 0.84 Best black-box (ours), within-session 0.86 Best black-box (ours), cross-principal + adaptive 0.74 5.6 Analysis The projected pattern is consistent with the theory of Section 4. Against a frozen scheme the fused detector is near-perfect (Table 3); the scientifically meaningful quantity is how quickly this collapses under adaptation (Table 4). The frontier (Fig. 2) is expected to place the detectable region above roughly one bit per round without tools, with tool access pushing r⋆r downward—precisely the enlargement of carrier space predicted by (3) and [23]. Partial observability degrades detection sub-linearly (Table 5a), more colluders help the monitor by adding signal, heterogeneity hurts, and—most notably—spreading the payload across sessions is a real evasion (Table 5c) that single-session steganalysis under-detects. The oracle comparison (Table 6) quantifies the price of the cross-principal constraint. We stress that the white-box probe is not a deployable cross-principal detector—no organisation can read another’s activations—but an upper bound that isolates how much the black-box constraint costs; a realistic middle ground, in which principals expose a limited, audited activation interface, would sit between the two oracle rows and is a promising route for cooperative deployments. Across environments, the code-review setting is expected to be hardest, because tool-call and comment channels give the adversary the richest carrier space and thus the lowest r⋆r , while the procurement market, with a narrower action surface, should remain detectable to lower rates. 5.7 Reproducibility and Release To support replication we will release the environments, the detector and calibration code, the encoding-family definitions, and per-run logs with exact model identifiers and dates; the detector and benchmarks are public while the strongest attack artifacts are gated (Section 6). 6 Discussion 6.1 Interpretation and Threats to Validity Our claim is deliberately bounded: black-box steganalysis is useful above a covert-rate threshold and provably weak below it. Several threats to validity shape how the results should be read. Construct validity: instructed collusion may be easier to detect than emergent collusion, so at least one reward-induced (emergent) condition should be included [21]. Open-channel coordination: some collusion uses semantically truthful statements with no steganography, defeating stego-specific features; an open-channel scenario should be retained so the contribution is not narrowly steganalysis. External validity: conclusions hold for the tested topologies and models, and frontier models drift, so exact model versions and dates must be reported. Baseline fairness: the reproduced detectors [30, 24] must be implemented faithfully rather than strawmanned. 6.2 Deployment and Auditing Implications The frontier reframes what black-box monitoring can promise: detection is one layer among several—it raises the cost of high-rate coordination but cannot certify the absence of low-rate channels. This argues for pairing trace monitoring with opt-in verifiable attribution [29, 14], rate limits and desynchronisation, and audit logging that preserves the statistics the detector consumes. For auditors, r⋆(α)r (α) is actionable: it upper-bounds the covert bandwidth that could have passed undetected. 6.3 Relation to AI Control AI-control protocols [9] assume a single untrusted agent supervised by trusted components. Our setting is harder: untrusted agents across principals may coordinate to subvert oversight jointly—e.g., decomposing a task so no single agent’s actions trip a filter. Detection under partial observability is thus a prerequisite for extending control to colluding groups, and Proposition 1 bounds what any trace-based monitor in such a protocol can achieve. 6.4 Positioning Against Concurrent Detectors It is worth being precise about what separates this work from the three concurrent efforts in Table 1, since all four chase the same quarry. Audit the Whisper [30] is also black-box and also leans on mutual information, but it adapts only within a fixed family of encodings and is tested in tool-free settings; our adversary is free to switch families and to exploit tool and timing channels, which is exactly where a fixed-family detector loses ground. Colosseum [24] infers collusion from behavioural regret rather than from the statistics of the messages themselves, so it is complementary: strong when coordination visibly distorts outcomes, weaker when a low-rate channel leaves outcomes largely intact. The interpretability route behind NARCBench [27] reports the best numbers of the three, but it reads model activations—an option that simply does not exist across organisational boundaries. Our oracle comparison (Table 6) is meant to price precisely that gap between the privileged setting and the black-box reality. In short, we do not claim to beat these methods on their own ground; we cover the case they leave open—an adapting adversary, seen only through traces, in tool-using and memory-carrying deployments. 6.5 Limitations and Open Problems Three limitations bound the present study. First, the detector consumes surface, timing, and tool-call statistics; a purely semantic channel that selects among truthful contents (Appendix 8) leaves few such artefacts and is the hardest case, which we include rather than exclude. Detectability also depends on the tool interface: APIs that enforce structured (JSON-only) arguments, strip whitespace, or canonicalise inputs shrink the tool-mediated channel and raise r⋆r , whereas free-form inputs enlarge it, so our tool-using numbers describe the permissive end of a spectrum. Second, the cross-session evasion in Table 5(c) is only partially mitigated by longer observation windows, and detecting payloads spread across sessions and principals remains open. Two mitigations are worth testing. Cross-session linkage persists per-agent trace summaries and runs the mutual-information test over sessions concatenated by stable agent identifiers [3], re-aggregating a spread-out payload before estimation. Sequential monitoring applies a change-point or sequential-likelihood test across sessions, trading detection latency for the ability to accumulate weak per-session evidence. Both target the root cause—single-session estimation resetting at each boundary—rather than the symptom. Third, our capacity analysis assumes a passive monitor; an active monitor that perturbs traffic—injecting probes, rate-limiting, or desynchronising agents—could shift the frontier and is a promising direction. None of these is unique to our method; each follows from Proposition 1, and each marks where additional signal, rather than a better fusion of the same signal, is required. 6.6 Ethical Considerations and Responsible Disclosure The adaptive adversary is instrumental: it exists only to stress the detector, and the unit of analysis is always the population, never single-agent jailbreaks. To manage dual-use, we recommend releasing the detector and benchmark openly while gating the strongest attack artifacts, consistent with responsible-disclosure norms and with governance work on agent visibility [4]. Because the analysis also delineates where detection fails, it discourages over-reliance on black-box monitoring as a sole safeguard. We further avoid publishing turn-key attack recipes: the encoding families (Appendix 8) are described at the level needed to reproduce the science, not as deployable collusion tooling, and the released benchmark centres on evaluating defences. Concretely, we withhold the strongest co-evolved encodings and the red-team search harness of Algorithm 2 that produced them, releasing these to vetted researchers on request under a use agreement, while the detector, environments, and benchmark remain public. 7 Conclusion and Future Work We set out to answer a narrow but pressing question: when agents from different organisations share infrastructure, can anyone tell whether some of them are quietly colluding, using only what is visible from the outside? Our answer has two halves. The first is constructive—an encoding-agnostic, black-box detector that, crucially, is tested not against a fixed hidden code but against an adversary that keeps adapting to it. The second is a limit: a capacity argument shows there is always a covert rate low enough to slip past any black-box test, so the honest goal is not an unbeatable detector but a map of where detection works and where it cannot. Read that way, even a negative result is useful—it tells an operator how much covert bandwidth could be passing unseen. Future work includes: extending AI-control protocols [9] to colluding groups; combining trace-only detection with lightweight verifiable-attribution primitives [29, 14] where principals opt in; privacy-preserving detection that operates on encrypted or hashed traces; and closing the cross-session gap identified here. More broadly, we advocate reporting collusion-detection results as curves against an adapting adversary and as frontiers in covert rate, rather than as single scores against fixed schemes. Static AUROC on a frozen encoding overstates security precisely because the interesting adversaries are the ones that move; a frontier, by contrast, states the covert bandwidth an operator can and cannot expect to catch, and remains meaningful as models improve. We hope the frontier framing provides a durable target for a maturing science of multi-agent AI safety. 8 Encoding Families The adaptive adversary (Algorithm 2) draws and mutates encodings from six families. Lexical: synonym or token choices carry bits (e.g., a fixed word-to-bit map), the most brittle family under distributional tests. Syntactic: sentence structure, clause ordering, or punctuation conventions encode the payload. Semantic: the choice among truthful-but-selectable contents (which example to cite, which caveat to include) carries information without introducing statistical artefacts in surface form—the family most resistant to token-level steganalysis. Format: whitespace, markdown, list ordering, or field ordering in tool arguments. Timing: inter-message delays or action-rate modulation, independent of message content. Tool-mediated: the sequence or arguments of tool calls (e.g., the order of retrieval queries) form a channel unavailable to non-agentic models. Mutation operates on the natural-language conventions that define a family (for in-context adversaries) rather than on model weights, keeping the red-team cost bounded. As a concrete illustration, a semantic encoding might tie the payload bit to whether a review leads with a strength or a weakness: both are truthful and common, yet across a batch the choice carries a reliable bit to a partner who knows the convention—which is why the feature set leans on cross-run mutual information against outcomes, not surface statistics alone. 9 Estimation and Calibration Details Cross-run mutual information is estimated with a neural estimator [1]; because such estimators are biased and high-variance in finite samples, we (i) calibrate decision thresholds on estimator outputs over control episodes rather than on nominal bits (Algorithm 1), and (i) report bootstrap confidence intervals over calibration folds and seeds. We favour a neural estimator over plug-in or k-nearest-neighbour (KSG) estimators [15] because agent traces are high-dimensional and variable-length, a regime in which the latter degrade sharply. Because neural estimators such as MINE are high-variance and not strict bounds, we also compare against contrastive estimators—InfoNCE [31] and the CLUB upper bound [6]—whose trade-offs are analysed by Poole et al. [26], validate every estimator on Gaussian data with known ground-truth MI before trusting it on traces, and adopt whichever has the lowest variance at matched sample size; as a further guard we cross-check KSG on low-dimensional projections and discard any configuration whose estimate has not stabilised as the sample size grows. The additive per-message decomposition assumed in Lemma 1 holds exactly when colluder messages are conditionally independent given the payload and the observed subset is drawn independently; correlated messages make the bound conservative, so ϵρ≤ρϵ _ρ≤ρε is an upper estimate of what partial observation reveals. 10 Evaluation Protocol Each configuration is evaluated over seeds as follows: instantiate an environment and population; run non-colluding populations to produce matched calibration episodes C and calibrate tαt_α on them (Algorithm 1); run the co-evolution loop (Algorithm 2) for R rounds, scoring only held-out encodings; and record the metrics of Section 5 under the partial-observability and multi-session variants. All baselines share the identical harness and calibration. References [1] M. I. Belghazi, A. Baratin, S. Rajeshwar, S. Ozair, Y. Bengio, A. Courville, and R. D. Hjelm (2018) Mutual information neural estimation. In Proc. 35th Int. Conf. on Machine Learning (ICML), PMLR, Vol. 80, p. 531–540. Cited by: 1st item, §3.3, §9. [2] C. Cachin (2004) An information-theoretic model for steganography. Information and Computation 192 (1), p. 41–56. External Links: Document Cited by: §1, §1, §2.3, §4. [3] A. Chan, N. Kolt, P. Wills, U. Anwar, C. Schroeder de Witt, N. Rajkumar, L. Hammond, D. Krueger, L. Heim, and M. Anderljung (2024) IDs for AI systems. Note: arXiv preprint arXiv:2406.12137 Cited by: §2.6, §6.5. [4] A. Chan et al. (2024) Visibility into AI agents. In Proc. 2024 ACM Conf. on Fairness, Accountability, and Transparency (FAccT), p. 958–973. Cited by: §2.6, §6.6. [5] A. Chan, K. Wei, S. Huang, N. Rajkumar, E. Perrier, S. Lazar, G. K. Hadfield, and M. Anderljung (2025) Infrastructure for AI agents. Note: arXiv preprint arXiv:2501.10114 Cited by: §2.6. [6] P. Cheng, W. Hao, S. Dai, J. Liu, Z. Gan, and L. Carin (2020) CLUB: a contrastive log-ratio upper bound of mutual information. In Proc. 37th Int. Conf. on Machine Learning (ICML), PMLR, Vol. 119, p. 1779–1788. Cited by: §9. [7] A. Dafoe, E. Hughes, Y. Bachrach, T. Collins, K. R. McKee, J. Z. Leibo, K. Larson, and T. Graepel (2020) Open problems in cooperative AI. Note: arXiv preprint arXiv:2012.08630 Cited by: §2.6. [8] J. N. Foerster, Y. M. Assael, N. de Freitas, and S. Whiteson (2016) Learning to communicate with deep multi-agent reinforcement learning. In Advances in Neural Information Processing Systems 29 (NIPS), p. 2137–2145. Cited by: §2.5. [9] R. Greenblatt, B. Shlegeris, K. Sachan, and F. Roger (2024) AI control: improving safety despite intentional subversion. In Proc. 41st Int. Conf. on Machine Learning (ICML), PMLR, Vol. 235, p. 16295–16336. Cited by: §2.6, §6.3, §7. [10] X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y. Wang, J. Jiang, and M. Lin (2024) Agent smith: a single image can jailbreak one million multimodal LLM agents exponentially fast. In Proc. 41st Int. Conf. on Machine Learning (ICML), PMLR, Vol. 235, p. 16647–16672. Cited by: §2.7. [11] T. Guo, X. Chen, Y. Wang, R. Chang, S. Pei, N. V. Chawla, O. Wiest, and X. Zhang (2024) Large language model based multi-agents: a survey of progress and challenges. In Proc. 33rd Int. Joint Conf. on Artificial Intelligence (IJCAI), p. 8048–8057. External Links: Document Cited by: §1, §2.1. [12] L. Hammond, A. Chan, J. Clifton, J. Hoelscher-Obermaier, A. Khan, E. McLean, C. Smith, et al. (2025) Multi-agent risks from advanced AI. Technical Report Technical Report 1, Cooperative AI Foundation. Note: arXiv:2502.14143 Cited by: §1, §2.1, §2.6. [13] P. Henderson, R. Islam, P. Bachman, J. Pineau, D. Precup, and D. Meger (2018) Deep reinforcement learning that matters. In Proc. 32nd AAAI Conf. on Artificial Intelligence (AAAI), Vol. 32. External Links: Document Cited by: §5.3. [14] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein (2023) A watermark for large language models. In Proc. 40th Int. Conf. on Machine Learning (ICML), PMLR, Vol. 202, p. 17061–17084. Cited by: §2.4, 3rd item, §3.3, §6.2, §7. [15] A. Kraskov, H. Stögbauer, and P. Grassberger (2004) Estimating mutual information. Physical Review E 69 (6), p. 066138. External Links: Document Cited by: §9. [16] K. Krishna, Y. Song, M. Karpinska, J. Wieting, and M. Iyyer (2023) Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense. In Advances in Neural Information Processing Systems 36 (NeurIPS), p. 27469–27500. Cited by: §2.4, §5.4. [17] A. Lazaridou, A. Peysakhovich, and M. Baroni (2017) Multi-agent cooperation and the emergence of (natural) language. In 5th Int. Conf. on Learning Representations (ICLR), Cited by: §2.5. [18] D. Lee, M. Tiwari, and B. Miranda (2025) Prompt infection: LLM-to-LLM prompt injection within multi-agent systems. In Computer Security – ESORICS 2025 Int. Workshops (SECAI), Lecture Notes in Computer Science, Vol. 16232. External Links: Document Cited by: §2.7. [19] A. Liu, L. Pan, Y. Lu, J. Li, X. Hu, X. Zhang, L. Wen, I. King, H. Xiong, and P. S. Yu (2024) A survey of text watermarking in the era of large language models. ACM Computing Surveys 57 (2), p. 1–36. External Links: Document Cited by: §2.4. [20] N. Maloyan and D. Namiot (2026) Breaking the protocol: security analysis of the model context protocol specification and prompt injection vulnerabilities in tool-integrated LLM agents. Note: arXiv preprint arXiv:2601.17549 Cited by: §2.7. [21] Y. Mathew, O. Matthews, R. McCarthy, J. Velja, C. Schroeder de Witt, D. Cope, and N. Schoots (2025) Hidden in plain text: emergence and mitigation of steganographic collusion in LLMs. In Proc. 14th Int. Joint Conf. on Natural Language Processing and 4th Conf. of the Asia-Pacific Chapter of the ACL (IJCNLP-AACL), p. 585–624. Cited by: §1, §2.2, Table 1, §6.1. [22] S. R. Motwani, M. Baranchuk, M. Strohmeier, V. Bolina, P. H. S. Torr, L. Hammond, and C. Schroeder de Witt (2024) Secret collusion among AI agents: multi-agent deception via steganography. In Advances in Neural Information Processing Systems 37 (NeurIPS), p. 73439–73486. Cited by: §1, §2.2, Table 1. [23] P. Moulin and J. A. O’Sullivan (2003) Information-theoretic analysis of information hiding. IEEE Transactions on Information Theory 49 (3), p. 563–593. External Links: Document Cited by: §1, §2.3, §4, §5.6. [24] M. Nakamura, A. Kumar, S. Das, S. Abdelnabi, S. Mahmud, F. Fioretto, S. Zilberstein, and E. Bagdasarian (2026) Colosseum: auditing collusion in cooperative multi-agent systems. Note: arXiv preprint arXiv:2602.15198 Cited by: §2.7, Table 1, §5.4, §6.1, §6.4. [25] J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein (2023) Generative agents: interactive simulacra of human behavior. In Proc. 36th Annual ACM Symp. on User Interface Software and Technology (UIST), p. 1–22. External Links: Document Cited by: §2.1. [26] B. Poole, S. Ozair, A. van den Oord, A. A. Alemi, and G. Tucker (2019) On variational bounds of mutual information. In Proc. 36th Int. Conf. on Machine Learning (ICML), PMLR, Vol. 97, p. 5171–5180. Cited by: §9. [27] A. Rose, C. Cullen, B. G. Kaplowitz, and C. Schroeder de Witt (2026) Detecting multi-agent collusion through multi-agent interpretability. Note: arXiv preprint arXiv:2604.01151 Cited by: §2.7, Table 1, §5.4, §6.4. [28] G. J. Simmons (1984) The prisoners’ problem and the subliminal channel. In Advances in Cryptology: Proc. CRYPTO ’83, D. Chaum (Ed.), p. 51–67. Cited by: §1, §1, §2.3. [29] H. Sun, J. Li, and H. Zhang (2024) zkLLM: zero knowledge proofs for large language models. In Proc. 2024 ACM SIGSAC Conf. on Computer and Communications Security (CCS), p. 4405–4419. External Links: Document Cited by: §2.4, §6.2, §7. [30] O. Tailor (2025) Audit the whisper: detecting steganographic collusion in multi-agent LLMs. Note: arXiv preprint arXiv:2510.04303 Cited by: §2.7, Table 1, §5.4, §6.1, §6.4. [31] A. van den Oord, Y. Li, and O. Vinyals (2018) Representation learning with contrastive predictive coding. Note: arXiv preprint arXiv:1807.03748 Cited by: §9. [32] S. Wendzel, S. Zander, B. Fechner, and C. Herdin (2015) Pattern-based survey and categorization of network covert-channel techniques. ACM Computing Surveys 47 (3). External Links: Document Cited by: §2.3, 4th item, §3.3. [33] M. Wooldridge and N. R. Jennings (1995) Intelligent agents: theory and practice. The Knowledge Engineering Review 10 (2), p. 115–152. External Links: Document Cited by: §2.1. [34] Y. Xue, L. Kong, W. Peng, P. Zhong, and J. Wen (2022) An effective linguistic steganalysis framework based on hierarchical mutual learning. Information Sciences 586, p. 140–154. External Links: Document Cited by: §1, §2.3, 3rd item. [35] Z. Yang, X. Guo, Z. Chen, Y. Huang, and Y. Zhang (2019) RNN-Stega: linguistic steganography based on recurrent neural networks. IEEE Transactions on Information Forensics and Security 14 (5), p. 1280–1295. External Links: Document Cited by: §1, §2.3, 3rd item, §3.3.

Instant research discovery