Search papers, labs, and topics across Lattice.
This paper introduces NARCBench, a benchmark for evaluating collusion detection in multi-agent LLM systems under distribution shift, and explores the use of activation probing to detect such collusion. They propose five probing techniques that aggregate per-agent deception scores, achieving 1.00 AUROC in-distribution and 0.60-0.86 AUROC in zero-shot transfer to new scenarios. Their findings suggest that different collusion types manifest differently in activation space and that the collusion signal is localized at the token level.
LLM agents' internal activations leak detectable signals of collusion, even when transferred to structurally different multi-agent scenarios, opening a new frontier for AI safety.
As LLM agents are increasingly deployed in multi-agent systems, they introduce risks of covert coordination that may evade standard forms of human oversight. While linear probes on model activations have shown promise for detecting deception in single-agent settings, collusion is inherently a multi-agent phenomenon, and the use of internal representations for detecting collusion between agents remains unexplored. We introduce NARCBench, a benchmark for evaluating collusion detection under environment distribution shift, and propose five probing techniques that aggregate per-agent deception scores to classify scenarios at the group level. Our probes achieve 1.00 AUROC in-distribution and 0.60--0.86 AUROC when transferred zero-shot to structurally different multi-agent scenarios and a steganographic blackjack card-counting task. We find that no single probing technique dominates across all collusion types, suggesting that different forms of collusion manifest differently in activation space. We also find preliminary evidence that this signal is localised at the token level, with the colluding agent's activations spiking specifically when processing the encoded parts of their partner's message. This work takes a step toward multi-agent interpretability: extending white-box inspection from single models to multi-agent contexts, where detection requires aggregating signals across agents. These results suggest that model internals provide a complementary signal to text-level monitoring for detecting multi-agent collusion, particularly for organisations with access to model activations. Code and data are available at https://github.com/aaronrose227/narcbench.
