Beyond the Transcript: Detecting Covert Co ordination in Latent Multi-Agent Communication

• URL: http://arxiv.org/abs/2608.19161v1
• Date: Wed, 19 Aug 2026 17:43:22 GMT
• Title: Beyond the Transcript: Detecting Covert Co ordination in Latent Multi-Agent Communication
• Abstract summary: Language-model agents can communicate through continuous hidden states that are invisible in public transcripts.<n>We introduce Verifiable Latent Alignments (VLA), an activation-aware framework for monitoring and steering these private communication channels.
• Score: 19.840551611758247
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Language-model agents can communicate through continuous hidden states that are invisible in public transcripts, creating opportunities for covert harmful coordination. We introduce Verifiable Latent Alignments (VLA), an activation-aware framework for monitoring and steering these private communication channels. For every monitored decision, VLA links the private latent-state record and channel status to the resulting public action using a shared event identifier, enabling matched causal analysis. Our first contribution is a neutral-only three-layer monitor combining representation anomaly detection, counterfactual action-distribution influence, and sparse-autoencoder interpretation support. Our second contribution is a steerability framework spanning black-box behavioral instructions and white-box matched-neutral counterfactuals. Our third contribution is an evaluation on a controlled multi-agent auction benchmark covering homogeneous and heterogeneous model pairs, many-agent scalability, and intervention effectiveness. The sequential monitor achieves mean area under the receiver operating characteristic curve (AUROC) of 0.993 for homogeneous agents and 0.854 for heterogeneous pairs when text- and latent-collusion rows are pooled as positives. In Qwen3-0.6B auctions with 25-100 bidders, monitoring requires only a small normalized load relative to all possible directed pairs, while full white-box steering achieves 100% bid-distribution recovery and reduces collusive low-bid behavior by 47.3 percentage points. Because full white-box steering replays the matched neutral counterfactual, its exact recovery is a sanity check by construction. Overall, the controlled study shows that the evaluated private channel attacks can be monitored without training the primary monitor on attack examples and mitigated when matched counterfactual access is available.

Related papers

• TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors [54.12833308568015]
  Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit.<n>A small visual trigger redirects a long-horizon robot policy before any failure becomes observable.<n>We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies.
  arXiv  Detail & Related papers  (2026-07-14T09:43:52Z)
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages [0.7252027234425333]
  We make the untrusted policy family the controlled axis and decompose the cross-family AUROC into how obvious each family's sabotage is.<n>On code-backdoor transcripts the interaction is positive and survives the dominant confounds.<n>We give a four-step protocol that acts on the gap, with each step a measured result.
  arXiv  Detail & Related papers  (2026-07-06T22:40:07Z)
• CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs [100.38986535324284]
  We introduce textbfCIAware-Bench, a benchmark for measuring textbfcontrol textbfintervention (CI) awareness across frontier models.<n>CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention.
  arXiv  Detail & Related papers  (2026-06-09T16:24:16Z)
• The Distributed Detectability Band Against Marginal-Preserving Attacks [0.0]
  AI-control monitors score individual agent actions to detect misbehavior.<n>Real harm can be distributed across many benign-looking steps, each individually below any per-step alarm.<n>We construct a marginal-preserving, correlation-encoded distributed-sabotage attack.
  arXiv  Detail & Related papers  (2026-06-09T06:04:30Z)
• Counterfactual Likelihood Tests for Indirect Influence in Private Reasoning Channels [51.56484100374058]
  This paper presents a counterfactual likelihood test for measuring influence between private reasoning channels.<n>The method replaces an upstream private block with a length-matched donor block, holds the public token sequence and downstream target fixed, and measures the downstream target's negative-log-likelihood shift.
  arXiv  Detail & Related papers  (2026-05-18T20:27:43Z)
• Securing Multimodal AI through Internal Information Decomposition [43.51030662124641]
  Multimodal large language models introduce attack surfaces absent in unimodal systems.<n>We propose FlowGuard, a lightweight inference-time framework that detects harmful inputs by monitoring internal multimodal consistency.<n>Our results demonstrate that monitoring cross-modal consistency offers an efficient and effective defense for multimodal reasoning.
  arXiv  Detail & Related papers  (2026-05-03T19:21:06Z)
• Claw-Eval: Toward Trustworthy Evaluation of Autonomous Agents [66.97968363332465]
  We introduce Claw-Eval, an end-to-end evaluation suite addressing all three gaps in agent benchmarks.<n>Claw-Eval comprises 300 human-verified tasks spanning 9 categories across three groups.<n>Every agent action is recorded through three independent evidence channels.
  arXiv  Detail & Related papers  (2026-04-07T17:43:18Z)
• TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol [1.0195618602298684]
  TraceGuard is a structured multi-dimensional monitoring protocol that evaluates agent actions across five dimensions.<n>It is implemented as a new monitor type for the open-source ControlArena framework.
  arXiv  Detail & Related papers  (2026-04-05T05:05:59Z)
• Fair Deepfake Detectors Can Generalize [51.21167546843708]
  We show that controlling for confounders (data distribution and model capacity) enables improved generalization via fairness interventions.<n>Motivated by this insight, we propose Demographic Attribute-insensitive Intervention Detection (DAID), a plug-and-play framework composed of: i) Demographic-aware data rebalancing, which employs inverse-propensity weighting and subgroup-wise feature normalization to neutralize distributional biases; and ii) Demographic-agnostic feature aggregation, which uses a novel alignment loss to suppress sensitive-attribute signals.<n>DAID consistently achieves superior performance in both fairness and generalization compared to several state-of-the-art
  arXiv  Detail & Related papers  (2025-07-03T14:10:02Z)
• CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring [3.6284577335311563]
  Chain-of-Thought (CoT) monitoring improves detection by up to 27 percentage points in scenarios where action-only monitoring fails to reliably identify sabotage.<n>CoT traces can also contain misleading rationalizations that deceive the monitor, reducing performance in more obvious sabotage cases.<n>This hybrid monitor consistently outperforms both CoT and action-only monitors across all tested models and tasks, with detection rates over four times higher than action-only monitoring for subtle deception scenarios.
  arXiv  Detail & Related papers  (2025-05-29T15:47:36Z)
• Malicious Agent Detection for Robust Multi-Agent Collaborative Perception [52.261231738242266]
  Multi-agent collaborative (MAC) perception is more vulnerable to adversarial attacks than single-agent perception. We propose Malicious Agent Detection (MADE), a reactive defense specific to MAC perception. We conduct comprehensive evaluations on a benchmark 3D dataset V2X-sim and a real-road dataset DAIR-V2X.
  arXiv  Detail & Related papers  (2023-10-18T11:36:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.