ACF: A Collaborative Framework for Agent Covert Communication under Cognitive Asymmetry

Wansheng Wu; Kaibo Huang; Yukun Wei; Zhongliang Yang; Linna Zhou

cs.AIApr 9, 2026

ACF: A Collaborative Framework for Agent Covert Communication under Cognitive Asymmetry

Authors: Wansheng Wu, Kaibo Huang, Yukun Wei, Zhongliang Yang, Linna Zhou

Organizations: School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China

Abstract

As generative artificial intelligence evolves, autonomous agent networks present a powerful paradigm for interactive covert communication. However, because agents dynamically update internal memories via environmental interactions, existing methods face a critical structural vulnerability: cognitive asymmetry. Conventional approaches demand strict cognitive symmetry, requiring identical sequence prefixes between the encoder and decoder. In dynamic deployments, inevitable prefix discrepancies destroy synchronization, inducing severe channel degradation. To address this core challenge of cognitive asymmetry, we propose the Asymmetric Collaborative Framework (ACF), which structurally decouples covert communication from semantic reasoning via orthogonal statistical and cognitive layers. By deploying a prefix-independent decoding paradigm governed by a shared steganographic configuration, ACF eliminates the reliance on cognitive symmetry. Evaluations on realistic memory-augmented workflows demonstrate that under severe cognitive asymmetry, symmetric baselines suffer severe channel degradation, whereas ACF uniquely excels across both semantic fidelity and covert communication. It maintains computational indistinguishability, enabling reliable secret extraction with provable error bounds, and providing robust Effective Information Capacity guarantees for modern agent networks.

Figures & tables

Fig. 1: The Asymmetric Collaborative Framework (ACF). To overcome cognitive asymmetry (

z_{t}^{enc}\neq z_{t}^{dec}

), ACF structurally decouples statistical communication from dynamic cognitive reasoning. Governed by a shared configuration

\Theta

, ACF executes dynamic cognitive sampling and enables prefix-independent, model-free, and robust secret extraction (

\Pi\perp z_{t}

Method	Cognitive Reasoning Layer		Statistical Communication Layer
Method	Score ( $\uparrow$ )	F1 (%) ( $\uparrow$ )	Entropy (bits/token)	BER (%) ( $\downarrow$ )	EIC (bits/ $10^{3}$ tokens) ( $\uparrow$ )	Detection Acc. (%) ( $\downarrow$ )
Static Environment (Ideal Symmetric Prefix)
Normal (No Stego)	0.31 $\pm$ 0.58	3.63 $\pm$ 5.39	0.65 $\pm$ 0.16	—	—	—
DISCOP	0.28 $\pm$ 0.57	3.25 $\pm$ 4.82	0.68 $\pm$ 0.17	0.00 $\pm$ 0.00	515.7546	54.17
METEOR	0.31 $\pm$ 0.58	3.25 $\pm$ 4.72	0.67 $\pm$ 0.17	0.00 $\pm$ 0.00	352.9054	55.56
ACF ( $k=8$ )	0.33 $\pm$ 0.58	3.55 $\pm$ 5.12	0.68 $\pm$ 0.19	4.04 $\pm$ 10.56	3.6450	55.56

TABLE I: Performance Evaluation Across Static and Dynamic Agent Environments.

{\sim}

: sustained robustness via structural decoupling; † : channel degradation under cognitive asymmetry.

Fig. 2: Impact of controlled cognitive asymmetry on Bit Error Rate (BER). Asymmetry is explicitly governed by truncating varying numbers of historical sessions (

\Delta

) from the decoder’s context.

Fig. 3: Trade-off analysis between semantic utility and channel reliability under retrieval-induced cognitive asymmetry (+RET).

Method	Ideal BER (%)	Truncation BER (%)	Summary BER (%)
DISCOP	0.00 $\pm$ 0.00	30.66 $\pm$ 26.64	53.88 $\pm$ 5.58
METEOR	0.00 $\pm$ 0.00	25.79 $\pm$ 22.84	49.30 $\pm$ 6.50
ACF ( $k=8$ )	2.47 $\pm$ 8.27	2.47 $\pm$ 8.27	1.67 $\pm$ 6.71
ACF ( $k=12$ )	0.00 $\pm$ 0.00	0.00 $\pm$ 0.00	0.00 $\pm$ 0.00
ACF ( $k=16$ )	0.00 $\pm$ 0.00	0.00 $\pm$ 0.00	0.00 $\pm$ 0.00

TABLE II: Extraction Reliability Under Isolated Cognitive Discrepancies.

Multi-Agent Communication

Multi-agent communication studies how autonomous agents exchange information to coordinate decisions, share knowledge, and act together under constraints.

See all 375 papers

Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems
Jun 25, 2026Jimmy Laurence Rippin, Simon C. Marshall, David Demitri Africa +1Multi-Agent LLM Systems Multi-Agent Coordination
Oxford University · Artificial Intelligence Security Institute (AISI)
Adaptive Dual-Path Framework for Covert Semantic Communication
May 5, 2026Xi Yu, Weicai Li, Lin Yin +1Semantic Communication
School of Information and Communication Engineering, Beijing University of Posts and Telecommunications (BUPT), Beijing 100876, China · Center for Target Cognition Information Processing Science and Technology, and the Key Laboratory of Modern Measurement and Control Technology, Ministry of Education, both at Beijing Information Science and Technology University, Beijing, China
Token Communication-Assisted Collaborative Embodied Artificial Intelligence: Concepts, Framework, and Opportunities
Oct 1, 2026Peng Yi, Ying-Chang LiangAgent Communication Protocols Task-Oriented Semantic Communication
National Key Laboratory of Wireless Communications, and also with the Center for Intelligent Networking and Communications (CINC), University of Electronic Science and Technology of China (UESTC), Chengdu 611731, China · Institute of Fundamental and Frontier Sciences and the Center for Intelligent Networking and Communications (CINC), University of Electronic Science and Technology of China (UESTC), Chengdu 611731, China

Jun 25, 2026J/K move · Enter open · S save

Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems

Jimmy Laurence Rippin, Simon C. Marshall, David Demitri Africa, Christian Schroeder de Witt

Oxford University · Artificial Intelligence Security Institute (AISI)

Multi-Agent LLM Systems Multi-Agent Coordination LLM Agent Security Language Model Steganography

Open paper AskPDF arXiv

Increasingly autonomous agentic AI systems pose novel multi-agent risks, such as secret collusion via covert communication channels. The natural defence to these collusion attempts is to monitor plain-text communication, but the efficacy of monitors has been called into doubt by increasingly sophisticated model steganography; indeed, some theoretical schemes have been proposed that are information-theoretically or computationally indistinguishable from good-faith plain-text communication. In this paper, we demonstrate that the complexity of these schemes is no longer a safety barrier, as agentic coding models can already produce undetectable stegosystems when given realistic tool usage, such as code execution or accessing research papers through web searches. Agents also adapt when key ingredients are missing, for example, by adding model-sampling components or implementing related keyed coding schemes. We then frame tacit steganographic coordination between agents as a Schelling-point problem and introduce coordination metrics for estimating when two agents are likely to select compatible schemes without explicit prior agreement. Our results suggest a shift in the threat model for covert communication between AI agents, where the main barrier is no longer whether frontier agents can understand and implement sophisticated stegosystems, but coordination: whether independently acting agents can converge on compatible schemes, keys, and parameters. We find substantial convergence on broad scheme families but limited strict one-shot coordination, suggesting that shared artefacts, repeated interaction, and tool-mediated search are the settings where covert communication risks are most acute. Overall, our findings provide empirical grounding for the recent strategic confinement hypothesis, which assumes that capable agents can construct covert channels that survive monitoring.

Abstract

Multi-Agent Communication

Explore similar work

Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems

Adaptive Dual-Path Framework for Covert Semantic Communication

Token Communication-Assisted Collaborative Embodied Artificial Intelligence: Concepts, Framework, and Opportunities