Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach

• URL: http://arxiv.org/abs/2608.02698v1
• Date: Mon, 03 Aug 2026 13:00:25 GMT
• Title: Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach
• Abstract summary: Large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure.<n>This creates a population-level risk that single-agent safeguards miss.<n>We build a black-box steganalysis detector that combines cross-run mutual-information estimation, permutation tests, distributional-shift statistics, and timing and tool-call side channels.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Tool-using agents built on large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure. This creates a population-level risk that single-agent safeguards miss: a handful of agents can quietly coordinate, rigging a market, boosting one another in a review process, or timing a joint data grab, while each one looks perfectly well-behaved. The difficulty is that the organisations running these agents cannot see inside one another's models, so any realistic detector must work from behaviour alone: black-box, trace-only, and often with only partial visibility. We treat covert coordination as an information-hiding problem and build a black-box steganalysis detector that combines cross-run mutual-information estimation, permutation tests, distributional-shift statistics, and timing and tool-call side channels, all calibrated to a fixed false-positive budget. Our central move is to stop testing against a single fixed code: we pit the detector against an adversary that continually rewrites its encoding to slip past whatever the detector has learned, and we run this red-versus-blue contest in tool-using, memory-carrying environments rather than toy games. Capacity theory then tells us what to expect, a detection-capacity frontier, a covert bit-rate below which black-box detection is provably no better than chance. We set out an experiment to map this frontier, report clearly labelled placeholder results pending measurement, and flag a practical evasion, spreading a payload across sessions, that current methods largely miss.

Related papers

• CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs [100.38986535324284]
  We introduce textbfCIAware-Bench, a benchmark for measuring textbfcontrol textbfintervention (CI) awareness across frontier models.<n>CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention.
  arXiv  Detail & Related papers  (2026-06-09T16:24:16Z)
• The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems [0.0]
  SCHEME is a benchmark of 17 task instances across 7 settings and 8 real open-source libraries.<n>Each setting is designed so that no proper subset of agents can succeed alone.<n>We show coordinated sabotage is already practical with GPT 5.1 Codex and Gemini 3.1 Pro.
  arXiv  Detail & Related papers  (2026-05-27T23:30:21Z)
• ExComm: Exploration-Stage Communication for Error-Resilient Agentic Test-Time Scaling [57.42714978834704]
  ExComm is a communication protocol for exploration-stage agentic test-time scaling.<n>We show that ExComm consistently outperforms strong test-time scaling baselines.
  arXiv  Detail & Related papers  (2026-05-21T07:38:44Z)
• Detecting Multi-Agent Collusion Through Multi-Agent Interpretability [0.3467226901703539]
  We introduce NARCBench, a benchmark for evaluating collusion detection under environment distribution shift.<n>We propose five probing techniques that aggregate per-agent deception scores to classify scenarios at the group level.<n>No single probing technique dominates across all collusion types, suggesting that different forms of collusion manifest differently in activation space.
  arXiv  Detail & Related papers  (2026-04-01T17:08:05Z)
• RTD-Guard: A Black-Box Textual Adversarial Detection Framework via Replacement Token Detection [9.898508403320438]
  This paper introduces RTD-Guard, a novel black-box framework for detecting textual adversarial examples.<n>Our key insight is that word-substitution perturbations in adversarial attacks closely resemble the "replaced tokens" that a Replaced Token Detection discriminator is pre-trained to identify.<n>The entire process requires no adversarial data, model tuning, or internal model access, and uses only two black-box queries.
  arXiv  Detail & Related papers  (2026-03-13T02:30:56Z)
• Don't double it: Efficient Agent Prediction in Occlusions [1.1338062042380708]
  Occluded traffic agents pose a significant challenge for autonomous vehicles, as hidden pedestrians or vehicles can appear unexpectedly.<n>Existing learning-based methods often produce redundant occupancy predictions where a single agent is identified multiple times.<n>We introduce MatchInformer, a novel transformer-based approach that builds on the state-of-the-art SceneInformer architecture.
  arXiv  Detail & Related papers  (2026-01-29T10:22:38Z)
• Who's the Evil Twin? Differential Auditing for Undesired Behavior [0.6524460254566904]
  We frame detection as an adversarial game between two teams: the red team trains two similar models, one trained solely on benign data and the other trained on data containing hidden harmful behavior.<n>We experiment using CNNs and try various blue team strategies, including Gaussian noise analysis, model diffing, integrated gradients, and adversarial attacks.<n>Results show high accuracy for adversarial-attack-based methods (100% correct prediction, using hints), which is very promising.
  arXiv  Detail & Related papers  (2025-08-09T04:57:38Z)
• Lie Detector: Unified Backdoor Detection via Cross-Examination Framework [68.45399098884364]
  We propose a unified backdoor detection framework in the semi-honest setting.<n>Our method achieves superior detection performance, improving accuracy by 5.4%, 1.6%, and 11.9% over SoTA baselines.<n> Notably, it is the first to effectively detect backdoors in multimodal large language models.
  arXiv  Detail & Related papers  (2025-03-21T06:12:06Z)
• DAAIN: Detection of Anomalous and Adversarial Input using Normalizing Flows [52.31831255787147]
  We introduce a novel technique, DAAIN, to detect out-of-distribution (OOD) inputs and adversarial attacks (AA) Our approach monitors the inner workings of a neural network and learns a density estimator of the activation distribution. Our model can be trained on a single GPU making it compute efficient and deployable without requiring specialized accelerators.
  arXiv  Detail & Related papers  (2021-05-30T22:07:13Z)
• Probabilistic Ranking-Aware Ensembles for Enhanced Object Detections [50.096540945099704]
  We propose a novel ensemble called the Probabilistic Ranking Aware Ensemble (PRAE) that refines the confidence of bounding boxes from detectors. We also introduce a bandit approach to address the confidence imbalance problem caused by the need to deal with different numbers of boxes.
  arXiv  Detail & Related papers  (2021-05-07T09:37:06Z)
• Object Detection Made Simpler by Eliminating Heuristic NMS [70.93004137521946]
  We show a simple NMS-free, end-to-end object detection framework. We attain on par or even improved detection accuracy compared with the original one-stage detector.
  arXiv  Detail & Related papers  (2021-01-28T02:38:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.