Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Detecting Multi-Agent Collusion Through Multi-Agent Interpretability

Aaron Rose, Carissa Cullen, Brandon Gary Kaplowitz, Christian Schroeder de Witt

Abstract

As LLM agents are increasingly deployed in multi-agent systems, they introduce risks of covert coordination that may evade standard forms of human oversight. While linear probes on model activations have shown promise for detecting deception in single-agent settings, collusion is inherently a multi-agent phenomenon, and the use of internal representations for detecting collusion between agents remains unexplored. We introduce NARCBench, a benchmark for evaluating collusion detection under environment distribution shift, and propose five probing techniques that aggregate per-agent deception scores to classify scenarios at the group level. Our probes achieve 1.00 AUROC in-distribution and 0.60--0.86 AUROC when transferred zero-shot to structurally different multi-agent scenarios and a steganographic blackjack card-counting task. We find that no single probing technique dominates across all collusion types, suggesting that different forms of collusion manifest differently in activation space. We also find preliminary evidence that this signal is localised at the token level, with the colluding agent's activations spiking specifically when processing the encoded parts of their partner's message. This work takes a step toward multi-agent interpretability: extending white-box inspection from single models to multi-agent contexts, where detection requires aggregating signals across agents. These results suggest that model internals provide a complementary signal to text-level monitoring for detecting multi-agent collusion, particularly for organisations with access to model activations. Code and data are available at https://github.com/aaronrose227/narcbench.

Detecting Multi-Agent Collusion Through Multi-Agent Interpretability

Abstract

As LLM agents are increasingly deployed in multi-agent systems, they introduce risks of covert coordination that may evade standard forms of human oversight. While linear probes on model activations have shown promise for detecting deception in single-agent settings, collusion is inherently a multi-agent phenomenon, and the use of internal representations for detecting collusion between agents remains unexplored. We introduce NARCBench, a benchmark for evaluating collusion detection under environment distribution shift, and propose five probing techniques that aggregate per-agent deception scores to classify scenarios at the group level. Our probes achieve 1.00 AUROC in-distribution and 0.60--0.86 AUROC when transferred zero-shot to structurally different multi-agent scenarios and a steganographic blackjack card-counting task. We find that no single probing technique dominates across all collusion types, suggesting that different forms of collusion manifest differently in activation space. We also find preliminary evidence that this signal is localised at the token level, with the colluding agent's activations spiking specifically when processing the encoded parts of their partner's message. This work takes a step toward multi-agent interpretability: extending white-box inspection from single models to multi-agent contexts, where detection requires aggregating signals across agents. These results suggest that model internals provide a complementary signal to text-level monitoring for detecting multi-agent collusion, particularly for organisations with access to model activations. Code and data are available at https://github.com/aaronrose227/narcbench.

Paper Structure

This paper contains 34 sections, 6 equations, 4 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related work
  3. Multi-agent collusion and steganography.
  4. Probing activations for deception.
  5. Distributed anomaly detection.
  6. Method
  7. Scenario generation
  8. NARCBench-Core (training and in-distribution evaluation).
  9. NARCBench-Transfer (out-of-distribution: cross-structure generalisation).
  10. NARCBench-Stego (out-of-distribution: steganographic collusion).
  11. Mitigating prompt confounds.
  12. Activation extraction and probe training
  13. Deception probe.
  14. Evaluation.
  15. Probing techniques
  16. ...and 19 more sections

Figures (4)

  • Figure 1: NARCBench-Stego: four LLM agents play blackjack. The Counter tracks the card count and encodes it in natural table talk; the Big Player decodes the signal and bets accordingly. Honest agents are unaware of the scheme. Each shoe uses a unique encoding negotiated in a private channel.
  • Figure 2: AUROC for five probing techniques across NARCBench tiers. Deception probe trained on Core, evaluated zero-shot on Transfer and Stego. Error bars show standard deviation across layers 26--30.
  • Figure 3: Mean projection ($n{=}39$).
  • Figure 4: Per-token heatmap (schematic).