Catching Agents That Rephrase Around a Message Filter

One simple safeguard in a multi-agent system is a filter on the channel between agents that keeps protected information where it belongs. We give an LLM agent a protected value and a rule not to get around such a filter, let a simple keyword filter block its message, and have the other agent, which needs the value, simply ask again. In a two-agent case-review environment with 27 scenarios (such as customs entry or hospital shift scheduling), open models often reword the value so that it passes the filter while the other agent can still read it. We call this knowing collusion, a form of what Alnuhait et al. (2026) call covert assistance: a message passes a channel that both agents know is checked, is meant to avoid the check, and breaks a rule the sender was given. “Knowing” means that the model admits afterwards, in a confession channel, that it broke the rule on purpose. It occurs in 15% of post-block messages for Qwen3.5-9B and 25–49% for three uncensored versions of it, and gpt-oss-20b rises from 2% to 17% when uncensored. We label 26,630 reasoning sentences of Qwen3.5-9B with five steps, from recalling the rule to deciding to evade it, and detect these steps from the model’s activations on held-out scenarios at 63–94% true positive rate at a 5% false positive rate. Removing the evasion-intent direction from the weights cuts covert leaks in replays from 0.30 to 0.09, while an energy-matched random direction raises them to 0.42. Carried to gpt-oss-20b through a linear bridge fitted on unrelated, unlabelled chat text, the intent direction finds evasion intent in gpt-oss’s own reasoning nearly as well as a detector trained on gpt-oss labels (0.68 against 0.71), and a translated vector steers base gpt-oss from 0.12 to 0.38 covert leaks. We release the episodes and sentence labels.