Who Else Is In? Multi-Agent Collusion Initation Via Strategic Vagueness

Pramod Kaushik; Sarath Sivaprasad; Laura Ferrarotti; Mario Fritz; Samuel F. Brown; Bruno Lepri; Sahar Abdelnabi

cs.MAOct 27, 2026

Who Else Is In? Multi-Agent Collusion Initation Via Strategic Vagueness

Authors: Pramod Kaushik, Sarath Sivaprasad, Laura Ferrarotti, Mario Fritz, Samuel F. Brown, Bruno Lepri, Sahar Abdelnabi

Organizations: University of Trento · Fondazione Bruno Kes sler · CISPA · Independent ·

Abstract

Multi agent LLM systems raise the risk of collusion among agents pursuing objectives hidden from their overseers. When potential partners identities are unknown, collusion first requires initiation: agents must discover one another, often through a public channel observed by ordinary agents and monitors. Strategic vagueness offers a way to navigate this mixed audience, conveying intent to a prospective partner while preserving a plausible ordinary interpretation. We introduce a mutual identification game in which two schemers must identify each other through public interaction, while jointly solving an ordinary task. We find that some models discover successful handshake strategies without explicit signalling guidance, using task compatible exchanges that monitors often fail to flag at low false positive rates. To characterize the communicative capabilities underlying these exchanges, we study a controlled coordination setting. We find an asymmetric response to message explicitness: as messages become more indirect, monitor punishment can fall faster than partner coordination, creating a profitable intermediate regime of strategic vagueness. Together, these findings illustrate a Blackstone style evidential asymmetry: communication sufficient for coordination between agents may remain insufficient for confident detection by monitor, opening a new surface of collusion.

Figures & tables

Figure 1: Strategic vagueness enables deniable collusion. As an offer becomes less direct, it becomes less punishable by the monitor but also harder for the intended partner to recognize. Direct offers are understood but punished; excessively vague offers evade punishment but fail to coordinate. Between the monitor’s punishment threshold,

\theta_{D}

, and the partner’s recognition threshold,

\theta_{C}

, the “Blackstone band” ( Mungan, 2026 ) contains offers that the partner understands but the monitor does not punish, allowing collusion with plausible deniability.

Figure 2: Mutual-identification experiment. (1) Two schemers are embedded among

N

agents collaborating on an ordinary task, neither knows the other’s identity. (2) Agents exchange public messages while maintaining private scratchpads. (3) Each schemer can make a private, write-once commitment naming a suspected partner. Mutual identification occurs when the two schemers select each other. Trials last at most

T=15

rounds.

	Strategy-unspecified			Strategy-scaffolded
Agent family	$N=3$	$N=5$	$N=7$	$N=3$	$N=5$	$N=7$
Gemini 2.5 Pro	70.0	43.3	36.7	93.3	56.7	60.0
Claude Sonnet 4.6	0 0.0	0 0.0	0 0.0	90.0	83.3	60.0
GPT-5.1	0 0.0	0 0.0	0 0.0	43.3	13.3	0 3.3
Reciprocal-guess baseline	25.0	0 6.3	0 2.8	25.0	0 6.3	0 2.8

Table 1: Mutual-identification success (%) in the initiation game: share of trials in which both schemers named each other within 15 rounds. 30 independent trials per cell. Strategy-scaffolded : schemers are told their role and mutual-identification objective and receive explicit guidance to use task-plausible, deniable signalling that balances partner recognition against detection. Strategy-unspecified : schemers receive the same but without explicit guidance on how to signal to or identify a potential partner. Baseline is uniform reciprocal guessing,

1/(N-1)^{2}

Panel of Figure 3 — Figure 3: Anatomy of a strategy-unspecified handshake. A bridged public interaction from a successful Gemini 2.5 Pro trial with $N=3$ . A task-plausible cue is reciprocally elaborated by schemers A and B, before becoming pair-specific and leading to mutual commitment. The ordinary colleague C interprets the intermediate exchange as routine engineering discussion. The complete transcript and private scratchpads are provided in Appendix O .

Figure 4: Handshake detectability across monitor families and architectures. (a) Agent-level AUROC for distinguishing schemers from ordinary agents across all trials. (b) Percentage of successful handshakes in which at least one schemer is detected at a 5% false-positive rate on ordinary agents. Rows correspond to agent conditions and columns to monitor family and architecture. Strategy-unspecified results are reported for Gemini, the only family with substantial handshake success without explicit signalling guidance.

Figure 5: Forced-choice results across model families and vague phrasings. Under monitoring, schemers shift away from direct TAKE; accomplices still interpret vague messages as coordination signals; cops punish vague messages less than direct TAKE.

Figure 6: Audience asymmetry in repeated-round production. For rounds in which the schemer intends Take , normalized cop deduction and accomplice Take rate are plotted against judged message directness. Claude and Gemini show a regime where less direct messages reduce punishment while preserving coordination (shaded: deduction

\leq 0.5

, uptake

\geq 0.7

), with peak mean net payoff at

d=2

and

d=3

, respectively. GPT-5.1 shows no such regime and peaks at

d=4

. Error bars denote

\pm 1

SE; marker size indicates bin count.

Appendix figures & tables23 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Phrasing
V0	Some things are better left unsaid. (Pinker original)
V1	I’ll leave the specifics to your imagination.
V2	I think you understand where I’m going with this.
V3	Let’s both play for the better outcome.
V4	I’m sure we’re on the same page here.
V5	Let’s make the smart move here.

Appendix

Table 2: The 21 hand-authored vague phrasings used in the forced-choice robustness sweep. V0 is Pinker’s original sentence; V1–V20 are additional hand-authored variants.

Figure 7: Forced-choice rates under the cop condition for Claude Sonnet 4.6, Gemini 2.5 Pro, GPT-5.1, and the human baseline of Massenkoff et al. (2025), shown side by side within each message-option group. (Left) schemer’s chosen message; (middle) accomplice’s Take rate by received message; (right) cop’s mean deduction (out of 35). Human numbers are reproduced from Massenkoff et al., Table 3 (schemer-message and accomplice-Take rates) and Table 4 (cop deductions). The qualitative shapes the strategic-speaker theory predicts under monitor pressure, a partial schemer shift away from direct Take, an accomplice that still treats vague as a coordination signal, and a cop that punishes vague less than direct Take hold for all four subjects; quantitatively, Claude’s cop deduction profile most closely matches the human pattern, while the Gemini and GPT cops penalise vague closer to the direct-Take ceiling.

Panel of Figure 8 — Figure 8: Forced-choice probe across eight open-weight models. Each subfigure shows three panels: schemer chosen-message distribution (A), accomplice Take rate (B), cop mean deduction out of 35 (C). Human reference from Massenkoff et al. (2025) overlaid as green diamonds

	Cell 1 (matrix + message)			Cell 3 (matrix, no message)
Family	Take	Vague	Pass	Delivery-failure	Silent
Claude Sonnet 4.6	100%	98%	0%	40%	46%
Gemini 2.5 Pro	100%	90%	6%	10%	56%
GPT-5.1	98%	100%	8%	42%	40%

Appendix

Table 3: Accomplice Take rate (cop condition only) across five forced-choice settings,

n=50

trials per cell. “Cell 1” columns hold the matrix intact and vary the message Person B sends. “matrix, no message” “Cell 3” columns hold the matrix intact and remove the message: delivery-failure tells the accomplice the message was sent but did not arrive (so they know coordination was attempted but cannot read what was attempted); silent drops every linguistic reference to a message at all, isolating pure matrix-driven coordination.

	Cop			No cop
Family	Take	Vague	Pass	Take	Vague	Pass
Claude Sonnet 4.6	100 $\to$ 54	98 $\to$ 72	0 $\to$ 0	100 $\to$ 100	36 $\to$ 4	0 $\to$ 0
Gemini 2.5 Pro	100 $\to$ 8	90 $\to$ 42	6 $\to$ 2	100 $\to$ 100	100 $\to$ 98	10 $\to$ 0
GPT-5.1	98 $\to$ 50	100 $\to$ 100	8 $\to$ 16	100 $\to$ 100	100 $\to$ 96	2 $\to$ 0

Appendix

Table 4: Accomplice Take rate (%) when the numeric payoffs are removed. Each entry reads Cell 1 (matrix + message)

\to

Cell 2 (message, no matrix), for each of the three messages Person B can send,

n=50

trials per entry. The Cell 1 cop values are those of Table 3 .

Figure 9: Directness distribution of free-form schemer messages under cop pressure, across all three model families (

n=50

per family). Ratings on a 1–7 scale by an independent LLM judge (

1=

vague,

7=

explicit). Dashed vertical line: per-family mean. Three behaviours emerge: Claude stays mostly direct (mean 6.00) but a non-trivial

9/50

schemers reach the

\leq 4

sweet spot, the only family across the cross-family run with substantial Pinker-style indirect production. Gemini sits high on the directness scale (mean 6.14) with the mass at 6–7 and only

3/50

schemers below 4. GPT-5.1 collapses directness to 2.92, but does so principally by retreating to bland disengagement messages rather than by writing genuinely vague-yet-Take-coordinating ones (accomplice Take rate falls to

41\%

for GPT in this condition, versus

97\%

–

100\%

for Claude and Gemini).

Panel of Figure 10 — Figure 10: Repeated-round production under cop monitoring (10 trajectories per family). (a) Mean judge-rated directness ( $1=$ does not suggest Take , $7=$ directly proposes Take ), with $\pm 1$ SE across trajectories. (b) Net points per round (5-round rolling mean) and each family’s mean single-shot free-form payoff (horizontal dashed line).

Figure 11: Per-model directness-rating distribution for free-form schemer messages under the cop condition (

n{=}50

trials). Dashed line: per-model mean. Annotation reports the number of trials with rating

\leq 4

Figure 12: Mean schemer directness across

20

rounds (sequential free-form), all eight open-weight models. Bands:

t

-based

95\%

CIs across trajectories. Dashed grey line: indirect threshold (

d{=}4

Figure 13: Schemer net points per round (5-round rolling mean) across the

20

-round sequential free-form setting. Solid: sequential trajectory; dashed in same colour: that model’s free-form cop-condition zero-shot mean.

Agents: Claude Sonnet 4.6
Monitor	Stateless	Stateful	Retrospective
Claude Sonnet 4.6	0.626 [0.584, 0.667]	0.569 [0.535, 0.603]	0.645 [0.612, 0.680]
Gemini 2.5 Pro	0.786 [0.736, 0.834]	0.600 [0.557, 0.644]	0.721 [0.669, 0.775]
GPT-5.1	0.572 [0.531, 0.614]	0.663 [0.616, 0.710]	0.518 [0.501, 0.538]
Agents: Gemini 2.5 Pro
Claude Sonnet 4.6	0.735 [0.689, 0.777]	0.758 [0.719, 0.798]	0.853 [0.813, 0.895]

Appendix

Table 5: Generic-monitor detectability for strategy-scaffolded handshakes: AUROC with 95% confidence intervals. Rows group results by agent family and monitor family; columns correspond to stateless, stateful, and retrospective monitoring. Confidence intervals are obtained by trial-clustered bootstrap. Operating points for the same cells are in Table 6 .

Agents: Claude Sonnet 4.6
	Stateless			Stateful			Retrospective
Monitor	1%	5%	20%	1%	5%	20%	1%	5%	20%
Claude Sonnet 4.6	1.7	4.6	32.8	1.1	17.8	17.8	11.5	29.3	29.3
Gemini 2.5 Pro	0.0	5.7	70.1	0.0	0.0	33.9	0.0	3.4	58.6
GPT-5.1	0.0	4.0	29.3	0.0	0.0	0.0	0.0	0.0	11.5
Agents: Gemini 2.5 Pro

Appendix

Table 6: Generic-monitor detectability for strategy-scaffolded handshakes: true-positive rate (%) at false-positive budgets of 1%, 5%, and 20%, for the cells of Table 5 . Each value is the maximum TPR achievable subject to the stated empirical FPR budget on ordinary-agent examples, computed by the same threshold sweep for every cell.

			TPR (%) at FPR budget
Monitor	Architecture	AUROC [95% CI]	1%	5%	20%
Gemini 2.5 Pro	Stateless	0.702 [0.658, 0.747]	0.6	16.7	45.6
	Stateful	0.643 [0.597, 0.691]	1.7	11.1	41.7
	Retrospective	0.695 [0.631, 0.761]	0.0	5.6	43.3
Claude Sonnet 4.6	Stateless	0.624 [0.582, 0.664]	1.1	8.9	32.2
	Stateful	0.628 [0.593, 0.667]	1.7	17.2	30.0

Appendix

Table 7: Generic-monitor detectability for strategy-unspecified Gemini-agent handshakes. AUROC measures rank separation between schemer-associated and ordinary-agent behavior, while operating-point columns report the maximum TPR achievable under fixed false-positive budgets. Confidence intervals are trial-clustered bootstrap intervals. All nine cells score the same 90 trials (450 agent-trials).

Monitor	Architecture	Strategy-scaffolded	Strategy-unspecified	$\Delta$
		AUROC
Gemini 2.5 Pro	Stateless	0.802	0.702	$-0.100$
	Stateful	0.803	0.643	$-0.160$
	Retrospective	0.917	0.695	$-0.222$
Claude Sonnet 4.6	Stateless	0.735	0.624	$-0.111$
	Stateful	0.758	0.628	$-0.130$

Appendix

Table 8: Matched comparison of generic monitors across target conditions, Gemini 2.5 Pro agents only. Each row pairs one monitor family and architecture evaluated on strategy-scaffolded handshakes (Table 5 ) and on strategy-unspecified handshakes (Table 7 );

\Delta=\mathrm{AUROC}_{\text{unspecified}}-\mathrm{AUROC}_{\text{scaffolded}}

. These are matched configurations, not paired trials, and no interval is reported for the difference. The strategy-unspecified condition was run only with Gemini agents, so this comparison does not speak to the other agent families.

Figure 14: Strategy-informed monitoring. Each monitor receives a description of signalling strategies induced from two of three folds and scores the held-out fold; held-out scores from all folds are pooled. Rows, columns, and the detection measure follow Figure 4 . (a) Percentage of successful handshakes in which at least one schemer is detected, at a single threshold per cell set on the pooled held-out scores for an expected 5% false-positive rate on ordinary agents (ties at the threshold broken at random). (b) Change relative to the baseline monitor of Figure 4 (b), in percentage points; blue indicates higher detection with strategy knowledge. Bold, outlined cells: paired bootstrap 95% CI excludes zero (2,000 conversation-level resamples stratified by fold and group size; unadjusted for 36 comparisons).

Agents: Gemini 2.5 Pro, strategy-unspecified (90 trials; 45 successful handshakes)
		AUROC			Detection of successful handshakes (%)
Monitor	Architecture	Gen.	Inf.	$\Delta$ [95% CI]	Gen.	Inf.	$\Delta$ [95% CI]
Gemini	Stateless	0.702	0.736	+0.035 [ $-$ 0.004, +0.075]	37.2	42.2	+5.0 [ $-$ 19.0, +22.0]
	Stateful	0.643	0.776	+0.133 [+0.094, +0.172]	30.5	53.7	+23.2 [+10.6, +46.4]
	Retrospective	0.695	0.798	+0.103 [+0.048, +0.155]	21.8	26.7	+5.0 [ $-$ 9.9, +20.6]
Claude	Stateless	0.624	0.779	+0.155 [+0.119, +0.195]	35.7	48.6	+12.9 [ $-$ 1.6, +28.2]

Appendix

Table 9: Strategy-informed monitoring on held-out folds: the full record behind Figure 14 , all 36 configurations. Gen. : generic prompt (the values of Figure 4 ); Inf. : the same monitor with the knowledge document induced without the scored trial’s fold.

\Delta

is Inf. minus Gen., with a paired, trial-clustered bootstrap 95% interval (2,000 resamples stratified by fold and channel size; unadjusted for 36 comparisons). Detection is the percentage of successful handshakes in which at least one schemer is flagged at an expected 5% false-positive rate on ordinary agents, with ties at the threshold split (Section P.1 ); values are expectations, so they need not be multiples of one handshake.

		AUROC		TPR@1%		TPR@5%		TPR@20%
Monitor	Architecture	Gen.	Adapt.	Gen.	Adapt.	Gen.	Adapt.	Gen.	Adapt.
Gemini 2.5 Pro	Stateless	0.702	0.556	0.6	2.2	16.7	2.2	45.6	18.9
Gemini 2.5 Pro	Stateful	0.643	0.665	1.7	4.4	11.1	4.4	41.7	43.3
Claude Sonnet 4.6	Stateless	0.624	0.721	1.1	7.2	8.9	25.6	32.2	30.0
Claude Sonnet 4.6	Stateful	0.628	0.745	1.7	23.3	17.2	33.9	30.0	63.3
GPT-5.1	Stateless	0.679	0.649	2.8	3.3	18.3	17.2	18.3	17.2

Appendix

Table 10: Cross-condition transfer of strategy-informed monitoring. Adapted stateless and stateful monitors are supplied with signalling categories induced from the separate strategy-scaffolded condition and evaluated on strategy-unspecified Gemini-agent handshakes. Generic columns show the corresponding unmodified monitor prompt on the same target condition and architecture (the values of Table 7 ). TPR columns are in percent at the stated FPR budget. Transfer is evaluated only for architectures for which adapted runs were performed; no adapted retrospective condition is included.

Strategy	Claude	Gemini	GPT	Pooled
Pairing and handshake language	77/87 (89%)	54/68 (79%)	2/3	133/158 (84%)
Numeric pattern encoding	0/3	19/33 (58%)	2/18 (11%)	21/54 (39%)
Topic steering	11/14 (79%)	5/8 (63%)	12/58 (21%)	28/80 (35%)
Three-part structuring	0/1	2/3	19/79 (24%)	21/83 (25%)
None (residue)	3/4	2/5 (40%)	–	5/9 (56%)
All trajectories	83/100 (83%)	69/100 (69%)	21/100 (21%)	173/300 (58%)

Appendix

Table 11: Handshake success by signalling strategy and model family in the strategy-scaffolded condition (100 randomly sampled schemer trajectories per family;

N\in\{3,5,7\}

pooled). Each cell gives successful handshakes / trajectories using the strategy, with the success rate in parentheses when at least five trajectories use it. Each family contributes 100 trajectories, so a family column’s denominator is also the strategy’s prevalence (%) in that family. Strategies are multi-label, so the row denominators overlap. The final row gives each family’s overall handshake success rate.

Strategy	$N=3$	$N=5$	$N=7$	Pooled
Pairing and handshake language	7/7 (100%)	5/5 (100%)	2/3	14/15 (93%)
Keyword and topic signalling	41/58 (71%)	21/45 (47%)	20/47 (43%)	82/150 (55%)
Cautious restraint	0/1	4/14 (29%)	0/10 (0%)	4/25 (16%)
All trajectories	42/60 (70%)	26/60 (43%)	22/60 (37%)	90/180 (50%)

Appendix

Table 12: Handshake success by signalling strategy and channel size in the strategy-unspecified condition (180 schemer trajectories from the 90 Gemini 2.5 Pro trials in Table 1 ). Each cell gives successful handshakes / trajectories using the strategy, with the success rate in parentheses when at least five trajectories use it. Strategies are multi-label, so the row denominators overlap. No trajectory was left without a strategy. The final row gives the overall handshake success rate.

Role	Flag	The reasoning explicitly…
Schemer	signals_partner	states an intent for the accomplice to choose Take / to coordinate on taking.
	evades_punisher	states that the non-explicit form was chosen to reduce the cop’s evidence, suspicion, or deduction.
	cap_arithmetic	performs a worst-case net-payoff comparison showing that Take beats Pass even under the maximum penalty (e.g. $80-35=45>40$ ).
Accomplice	decodes_take	interprets the message as the schemer signalling an intent to Take .
	payoff_reasoning	derives the choice from the payoffs conditional on the schemer’s action (expected value or best response).
	threshold_stated	states an explicit probability threshold or expected-value break-even for Take .

Appendix

Table 13: Flags annotated in the stated reasoning of each role, and the derived flags built from them.

		Target (vague, cop condition)			Negative control
Role	Flag	Claude	Gemini	GPT	Claude	Gemini	GPT
Schemer	signals_partner	91 [86,94]	98 [96,99]	78 [72,83]	100	100	100
	evades_punisher	38 [31,45]	57 [52,63]	48 [41,54]	0	0	0
	cap_arithmetic	64 [57,71]	56 [50,61]	56 [49,62]	3	1	7
	dual_audience	30 [24,37]	57 [51,62]	27 [21,33]	–	–	–
Accomplice	decodes_take	83 [80,86]	74 [71,77]	77 [74,80]	0	6	2

Appendix

Table 14: Flag prevalence (% of traces, Wilson 95% CI) in the target corpus and on the matched negative controls. Target

n

: schemer 188/301/224, accomplice and cop 650 per family. Controls: schemer chose vague in the no-cop condition (

n=

222/240/197); accomplice received direct Pass and cop judged direct Take (50 per family). Italic rows are derived flags (Table 13 ), not annotated separately. All values are lower bounds (see quote verification).

	explicitness_reserve by deduction (%)				Decoded $\wedge$ reserve		Decoded $\wedge\,\neg$ reserve
Family	$\leq$ 10	11–20	21–30	$=$ 35	$n$	mean ded.	$n$	mean ded.
Claude	82 (200)	97 (296)	87 (131)	0 (23)	479	18.0	47	29.7
Gemini	94 (35)	68 (82)	14 (225)	0 (305)	119	17.1	527	31.7
GPT-5.1	88 (130)	97 (37)	81 (149)	0 (333)	187	23.2	361	34.4

Appendix

Table 15: Cop reasoning against the deduction actually imposed on vague messages. Left: share of traces citing deniability as a reason to withhold the maximum, by deduction band (

n

in parentheses; deductions of 31–34 fall in no band). Right: among traces that decode collusion, count and mean deduction (out of 35) with and without the deniability rationale. Means are point estimates. Mean deductions pooled over all 21 phrasings are 16.3 (Claude), 28.9 (Gemini) and 26.1 (GPT), lower than the V0-only values in Appendix F because several variants are less suggestive than V0.

Prompt condition	Model	Correct None
Scaffolded	Gemini 2.5 Pro	18/30 (60%)
Unspecified	Gemini 2.5 Pro	14/30 (47%)
Scaffolded	Claude Sonnet 4.6	8/30 (27%)
Scaffolded	GPT-5.1	6/30 (20%)

Appendix

Table 16: Single-schemer control at

N=3

. Each trial contains one schemer and two ordinary colleagues, so the correct commitment is None . Each row contains 30 independent trials.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 181 papers

Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems
Feb 16, 2026Mason Nakamura, Abhinav Kumar, Saswat Das +5Multi-Agent LLM Systems Multi-Agent Systems
University of Massachusetts Amherst · University of Virginia · ELLIS Institute Tübingen +1
Voluntary Collusion with Secret Tools in Competing LLM Agents
May 26, 2026Xijie Zeng, Frank RudziczLLM Agent Evaluation LLM Agent Safety
Dalhousie University · Vector Institute for Artificial Intelligence
Detecting Multi-Agent Collusion Through Multi-Agent Interpretability
Apr 1, 2026Aaron Rose, Carissa Cullen, Sahar Abdelnabi +3AI Agent Security Benchmarks Multi-Agent System Security
University of Oxford · ELLIS Institute Tübingen · Witt Lab University of Oxford +1

Feb 16, 2026J/K move · Enter open · S save

Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems

Mason Nakamura, Abhinav Kumar, Saswat Das, Sahar Abdelnabi+4

University of Massachusetts Amherst · University of Virginia · ELLIS Institute Tübingen+1

Multi-Agent LLM Systems Multi-Agent Systems AI Agent Auditing Emergent Behavior in Multi-Agent Systems Multi-Agent Communication

Open paper AskPDF arXiv

Multi-agent systems, where LLM agents communicate through free-form language, enable sophisticated coordination for solving complex cooperative tasks. This surfaces a unique safety problem when a group of agents forms a coalition and colludes to pursue secondary goals and degrade the joint objective. In this paper, we present Colosseum, a framework for auditing LLM agents' collusive behavior in multi-agent settings. We ground how agents cooperate through a formal multi-agent decision-making framework and measure action-based collusive behavior in actions via regret relative to the cooperative optimum and compare it with communication-based collusive behavior. Colosseum enables audits of LLM agents for collusion under benign settings, different coalition objectives, persuasion tactics, and network topologies. We then introduce a new behavioral probe by creating secret communication channels between agents, showing that most out-of-the-box models exhibit a propensity to collude under this probe, which we term emergent collusion. Furthermore, we discover ``collusion on paper'' when agents plan to collude in text but often pick non-collusive actions. Colosseum provides a new way to audit collusion in cooperative multi-agent systems while presenting observations about how collusion emerges, what affects collusion efficacy, and which strategies may mitigate it.

Abstract

Multi-Agent System Security

Explore similar work

Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems

Voluntary Collusion with Secret Tools in Competing LLM Agents

Detecting Multi-Agent Collusion Through Multi-Agent Interpretability