Undetectable Conversations Between AI Agents via Pseudorandom Noise-Resilient Key Exchange

• URL: http://arxiv.org/abs/2604.04757v1
• Date: Mon, 06 Apr 2026 15:25:38 GMT
• Title: Undetectable Conversations Between AI Agents via Pseudorandom Noise-Resilient Key Exchange
• Abstract summary: We show that AI agents can carry out a parallel secret conversation while still producing a transcript that is computationally indistinguishable from an honest interaction.<n>We introduce a new cryptographic primitive, which we call pseudorandom noise-resilient key exchange.<n>Results show that transcript auditing alone cannot rule out covert coordination between AI agents.
• Score: 7.877552575246053
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: AI agents are increasingly deployed to interact with other agents on behalf of users and organizations. We ask whether two such agents, operated by different entities, can carry out a parallel secret conversation while still producing a transcript that is computationally indistinguishable from an honest interaction, even to a strong passive auditor that knows the full model descriptions, the protocol, and the agents' private contexts. Building on recent work on watermarking and steganography for LLMs, we first show that if the parties possess an interaction-unique secret key, they can facilitate an optimal-rate covert conversation: the hidden conversation can exploit essentially all of the entropy present in the honest message distributions. Our main contributions concern extending this to the keyless setting, where the agents begin with no shared secret. We show that covert key exchange, and hence covert conversation, is possible even when each model has an arbitrary private context, and their messages are short and fully adaptive, assuming only that sufficiently many individual messages have at least constant min-entropy. This stands in contrast to previous covert communication works, which relied on the min-entropy in each individual message growing with the security parameter. To obtain this, we introduce a new cryptographic primitive, which we call pseudorandom noise-resilient key exchange: a key-exchange protocol whose public transcript is pseudorandom while still remaining correct under constant noise. We study this primitive, giving several constructions relevant to our application as well as strong limitations showing that more naive variants are impossible or vulnerable to efficient attacks. These results show that transcript auditing alone cannot rule out covert coordination between AI agents, and identify a new cryptographic theory that may be of independent interest.

Related papers

• Lies We Can See: Joint Verbal and Non-Verbal Deception by VLM Agents in Embodied Social Interactions [66.7908338529737]
  Strategic deception by LLM and VLM agents has emerged as a central AI alignment and safety concern.<n>Existing testbeds are text-only and run on a single fixed agent configuration, missing the non-verbal sensorimotor channels treated as core by deception.<n>We introduce MineAmongUs, a 3D multimodal Among Us sandbox where imposter agents must deceive crewmates through joint verbal and non-verbal action.
  arXiv  Detail & Related papers  (2026-08-31T08:24:29Z)
• When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems [57.450132281381066]
  Backdoor behavior can be activated when peer evidence reaches a hidden threshold, rather than being determined by any single message.<n>We introduce a collective evidence-threshold backdoor paradigm for MAS and Boundary-Conditioned Backdoor Injection (BCBI)<n>We propose LAtent Transition Test-time Evaluation (LATTE), a clean-only latent-transition defense that learns benign communication dynamics and quarantines anomalous agent updates.
  arXiv  Detail & Related papers  (2026-08-02T08:38:44Z)
• Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems [1.0408441549844423]
  Increasingly autonomous agentic AI systems pose novel multi-agent risks, such as secret collusion via covert communication channels.<n>In this paper, we demonstrate that the complexity of these schemes is no longer a safety barrier, as agentic coding models can already produce undetectable stegosystems.<n>We find substantial convergence on broad scheme families but limited strict one-shot coordination, suggesting that shared artefacts, repeated interaction, and tool-mediated search are the settings where covert communication risks are most acute.
  arXiv  Detail & Related papers  (2026-06-25T19:42:39Z)
• SynAgent: Generalizable Cooperative Humanoid Manipulation via Solo-to-Cooperative Agent Synergy [59.86199649493784]
  Controllable cooperative humanoid manipulation is a fundamental yet challenging problem for embodied intelligence.<n>We present SynAgent, a framework that enables scalable and physically plausible cooperative manipulation.<n>In experiments, SynAgent significantly outperforms existing baselines in both cooperative imitation and trajectory-conditioned control.
  arXiv  Detail & Related papers  (2026-04-20T17:46:20Z)
• The uncloneable bit exists [0.5352699766206808]
  We establish quantum uncloneable encryption with unconditional security.<n>We prevent two non-communicating adversaries from simultaneously decrypting a single ciphertext $-$ even when both are given the key.
  arXiv  Detail & Related papers  (2026-03-09T20:33:33Z)
• InterAgent: Physics-based Multi-agent Command Execution via Diffusion on Interaction Graphs [72.5651722107621]
  InterAgent is an end-to-end framework for text-driven physics-based multi-agent humanoid control.<n>We introduce an autoregressive diffusion transformer equipped with multi-stream blocks, which decouples proprioception, exteroception, and action to cross-modal interference.<n>We also propose a novel interaction graph exteroception representation that explicitly captures fine-grained joint-to-joint spatial dependencies.
  arXiv  Detail & Related papers  (2025-12-08T10:46:01Z)
• A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures [59.43633341497526]
  Large-Language-Model-driven AI agents have exhibited unprecedented intelligence and adaptability.<n>Agent communication is regarded as a foundational pillar of the future AI ecosystem.<n>This paper presents a comprehensive survey of agent communication security.
  arXiv  Detail & Related papers  (2025-06-24T14:44:28Z)
• Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory [82.7042006247124]
  We show that even the most capable AI models reveal private information in contexts that humans would not, 39% and 57% of the time, respectively. Our work underscores the immediate need to explore novel inference-time privacy-preserving approaches, based on reasoning and theory of mind.
  arXiv  Detail & Related papers  (2023-10-27T04:15:30Z)
• DPMAC: Differentially Private Communication for Cooperative Multi-Agent Reinforcement Learning [21.961558461211165]
  Communication lays the foundation for cooperation in human society and in multi-agent reinforcement learning (MARL) We propose the textitdifferentially private multi-agent communication (DPMAC) algorithm, which protects the sensitive information of individual agents by equipping each agent with a local message sender with rigorous $(epsilon, delta)$-differential privacy guarantee. We prove the existence of a Nash equilibrium in cooperative MARL with privacy-preserving communication, which suggests that this problem is game-theoretically learnable.
  arXiv  Detail & Related papers  (2023-08-19T04:26:23Z)
• Uncloneable Cryptographic Primitives with Interaction [0.6091702876917281]
  We construct three new cryptographic primitives whose security is based on uncloneability. We prove an extension of the MoE property of coset states introduced by Coladangelo, Liu, Liu, and Zhandry.
  arXiv  Detail & Related papers  (2023-02-28T19:46:15Z)
• Universally Expressive Communication in Multi-Agent Reinforcement Learning [6.086083595135936]
  We consider the question of whether a given communication protocol can express an arbitrary policy. With standard GNN approaches provably limited in their expressive capacity, we consider augmenting agent observations with: (1) unique agent IDs and (2) random noise. We provide a theoretical analysis as to how these approaches yield universally expressive communication, and also prove them capable of targeting arbitrary sets of actions for identical agents.
  arXiv  Detail & Related papers  (2022-06-14T11:16:33Z)
• A symmetric extensible protocol for quantum secret sharing [0.0]
  This paper introduces the Symmetric Quantum Secret Sharing protocol. It is an entanglement based protocol that relies on the use of maximally entangled GHZs. It offers uncompromising security, making virtually impossible for a malicious eavesdropper or a rogue double agent to disrupt its successful execution.
  arXiv  Detail & Related papers  (2022-04-28T10:27:44Z)
• Quasi-Equivalence Discovery for Zero-Shot Emergent Communication [63.175848843466845]
  We present a novel problem setting and the Quasi-Equivalence Discovery algorithm that allows for zero-shot coordination (ZSC) We show that these two factors lead to unique optimal ZSC policies in referential games. QED can iteratively discover the symmetries in this setting and converges to the optimal ZSC policy.
  arXiv  Detail & Related papers  (2021-03-14T23:42:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.