Skip to content
Apart Research
Apart Research
Contact us
Sprint projectOct 26, 2026Bengaluru, India

Auditing Collusion in AI Co-Scientists

Mywish Anand · Team Epistemic Cartel

Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Auditing Collusion in AI Co-Scientists

Open in a new tab (opens in new tab)
Presentation

Presentation: Auditing Collusion in AI Co-Scientists

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

Automated AI Co-Scientist frameworks, such as Google's AI Co-Scientist and Sakana AI's The AI Scientist rely on internal Large Language Model (LLM) peer-review tournaments to rank generated hypotheses and experiment code. When internal LLM-as-a-Judge evaluation replaces expensive ground-truth testing, Goodhart's Law creates strong incentives for agents to form an epistemic cartel. Extending the Steganographic Collusion peer-review environment into a three-stage executable AI Co-Scientist loop, comprising two Qwen2.5-14B-Instruct generators, one honest Llama-3.1-8B-Instruct baseline, three pairwise Elo reviewers, and an independent CPU Abstract Syntax Tree (AST) and held-out test sandbox verifier, we evaluate 1,350 live LLM-generated Python machine learning scripts and 8,100 pairwise reviews across five random seeds. Under compute scarcity, colluding Qwen agents submit shallow decision stumps or hardcoded metrics (66.6 AST violations per seed, true test AUC 0.5033 versus Llama's 0.7306) yet capture a +488.0 ± 30.5 Elo lead (Epistemic Regret 1.359 ± 0.110). Under homogeneous bias, our defense separates +153.1 Elo of pure stylistic nepotism from +109.2 ± 45.5 Elo of genuine empirical superiority (0.7924 versus 0.7075 test AUC). Under covert watermark signaling (0.1160 bits of mutual information), and in code-action steganography where 71.0% of cartel advantage (+151.0 Elo) survives prose-only paraphrasing, our DeepASTAlphaRenamer and sandbox auditing stack collapses Epistemic Regret below 0.031 (p < 0.0001) and neutralizes covert channels to 0.0000 bits.

Reviews

Judging this Sprint?

Review “Auditing Collusion in AI Co-Scientists”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for the field if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. Ambitious setup and a relevant target: internal LLM peer review in AI co-scientist pipelines is a real weak point, and the observation that collusive signals can move from prose into code identifiers (so AST-level canonicalization is needed, not just paraphrasing) is a useful contribution.

    The main concern is that much of the "collusion" appears to be built in. The methods describe colluding reviewers granting fixed score bonuses (+1.25 for low latency, +2.40 when a watermark is detected, +1.35 for Qwen "affinity") and generators that hardcode val_auc = 0.948. If those bonuses and behaviours are scripted or prompted, the Elo inflation follows from the design rather than being an empirical finding, and the defenses are removing a signal you inserted. Please state clearly, per condition, what is prompted, what is hardcoded in the harness, and what is emergent model behaviour.

    Second, the defended pipeline replaces self-reported val_auc with held-out test AUC, while Epistemic Regret is computed against that same test AUC. That makes the low defended regret close to guaranteed. The more informative question is how much the AST scanner and renamer help without ground-truth substitution. An ablation table (scanner only, renamer only, test-AUC substitution only) would make the contribution much clearer.

    Third, homogeneous_bias is described as having zero collusion instructions, yet it includes an injected +1.35 review bonus; please reconcile.

    Smaller points: Experiment A's defended result (-17.1 ± 167.5) is not distinguishable from zero or from the prose-only result, so "collapses" is too strong. Words like "proves" and "exactly" should be softened. The paper would read better without the "championship" framing, with fewer acronyms, and with tables that fit the page.

    Read full reviewShow less

Cite this project

@misc{anand2026auditing,
  title = {{Auditing Collusion in AI Co-Scientists}},
  author = {Mywish Anand},
  year = {2026},
  month = oct,
  note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/auditing-collusion-in-ai-coscientists-jojg}},
  url = {https://apartresearch.com/sprints/projects/auditing-collusion-in-ai-coscientists-jojg}
}

More from AI Collusion Research Sprint

All 392 entriesBrowse all projects

A Sprint is running now

AI x Epistemics Research Sprint · Nov 13 - 15, 2026