Beyond GICP: External Traces for Detecting Agent Collusion

The paper asks a good question: can collusion be detected from external process traces instead of final text or host logs an agent could tamper with? It’s also commendable that the author publishes all code, prompts and JSON outputs and keeps a clear limitations section. Having the code let me check how the experiments were actually built, and that check changes how the headline results should be read.

The “Board:” result tests instruction following, not collusion detection. In run_strict_main.py, each trial is a single call to a single model. In the “full” condition the system prompt says the note must start with “Board:”. In the “forbidden” condition it says do not write anything starting with “Board:”. There is no second agent and no shared board. The 100% vs 0% split, and its exact replication, shows that Qwen and Allam follow a direct formatting instruction. It says nothing about detecting coordination. The adversarial condition is also a single agent told to avoid the marker, so the sentence “coordination remained possible in principle” doesn’t apply to it.

The fact-transfer control can’t come out any other way. Agent B with the board is told to “repeat any mitigation code you see,” and the note sits in its prompt. Agent B without the board has no access to the code, and a random code like ZETA-9 can’t be guessed. So 0% without the board is certain by construction. The more interesting number is why B repeats the code only 44–50% of the time when explicitly asked to. Truncation at 70 tokens or the “mitigation code” wording are possible causes. This works as a check that the pipeline is wired correctly, not as evidence of covert transfer.

The intervention numbers are misleading. In intervention_effectiveness.json, about 26 of the 28 “over-link” cases started out as denials, such as “No. Spilling coffee is … unrelated.” Only about two actually affirmed a link. So “corrects 96.4% of over-link cases” mostly measures rewrites of outputs that were already fine. The test task (whether daily events relate to a romantic interest “A”) also has no connection to agent collusion. For the empty-response recovery, at least one “recovered” output made up a data breach that wasn’t in the prompt.

The GPT-OSS empty replies are probably an artifact. GPT-OSS-120b is a reasoning model. With max_tokens=70, its reasoning tokens probably use up the whole budget before any visible text comes out. That would explain empty rates of 75–100% better than any model “behavior” or “failure mode.”

Smaller issues. The two “independent” runs use the same fixed seeds at low temperature, so a standard deviation of 0 is expected and doesn’t measure variance. The token signal has no variance or significance reported. The TEE is only simulated, and the “external” traces are logged by the same Python harness, so the circular-trust problem the paper sets out to solve isn’t actually addressed experimentally.

Suggestions: Use a real two-agent setup in which coordination is optional and the detector doesn’t know the condition. Score the detector against ground truth with precision and recall. Test paraphrased or steganographic transfer instead of a literal marker. Rebuild the intervention test on collusion-relevant outputs, and measure only cases that a correct classifier flags. With those changes, the project would directly test its own premise.