Cheating Pays: A Deviation Oracle Finds the Defections a One-Shot Audit Misses in LLM Cartels

This paper makes a clear, well-motivated argument: the standard one-shot cartel audit underestimates how much a deviator can earn, and the gap is mostly structural rather than behavioral. The Deviation Oracle replaces the one-round cut with a searched multi-round path, and on the 39 primary cartel states it finds a defection roughly twice as often as the one-shot audit (20 vs 10) while earning about four times the mean premium (11.6% vs 2.9%). Those numbers are well-supported by the pre-registered design, the fresh-rollout re-scoring, and the four-factor decomposition.

The mechanism story is the strongest part. The oracle's premium over the permanent best response, which the audit already runs, is only +6.4 points. Most of the oracle's total advantage is the return path: after a one-shot cut, the deviator's own LLM policy does not snap back to the cartel price but keeps part of its cut, so the audit already collects part of a longer deviation without knowing it. The fitted copier rule (Finding 4) quantifies this for Gemma: the rule matches the oracle's premium in-sample and about half of it on held-out seeds. Together these support the conclusion that the audit's weakness is not that it misses rival non-response but that it attributes to punishment what is really just slow return.

The limitations are handled with unusual care. The oracle is a lower bound (24-path search reaches 18% of the exact optimum on Q-learners). The sellers are stateless, prompted, and symmetric. The Inkling-Small rerun story and the gpt-oss punisher pass-condition failure are disclosed rather than swept away. The pre-registration has seven dated amendments, each explained.

One genuine gap: the paper covers four open-weight models, but the one model prior work found to punish (GPT-5.2, from Tran and Yu) is absent because it is proprietary. The cartel states from that model would be the most interesting test for the audit-versus-oracle comparison. The authors note this but it limits how far the conclusion extends to the models regulators care most about.

This is a useful demonstration that a one-round price cut can miss profitable ways to break out of a cartel. The fresh-run testing and comparisons are good strengths. My main concern is that most of the gains come from simply maintaining a lower price, while the cases where the search strategy adds value are relatively limited. I'd also like to see longer experiments and more models tested. A shorter summary of the main findings would make the report easier to digest.

A careful, original methodological contribution. The paper replaces the forced one-period cut of Tran and Yu with a searched, seed-paired multi-round deviation that is re-scored on fresh rollouts, so selection cannot inflate the winner. The strongest ideas are the discounting null (S = 8.03) and the exact four-factor split of X/S: the oracle's lead over the audit is below what duration alone predicts (0.39 of S), and most of the gap is the "return path", because the deviator's own policy keeps part of a one-shot cut. That changes what a one-shot audit should be read as measuring, and it is useful to anyone running these audits.

Strengths: pre-registration with dated amendments; Wilson/bootstrap intervals throughout; analytic conformance checks (grim trigger, tit-for-tat); an instructed-punisher positive control; a held-out test of a fitted copier rule; calibration against an exact DP optimum on Q-learners; and a remedy arm reported with signed consumer surplus, including a pre-registered claim that failed. Excluding ceiling states and "corrections" above the joint-profit price is good practice.

Concerns:

1. The headline verdict flip rests on 4 of 17 responsive-rival states (Wilson [10, 47]), 16 of the 17 being Gemma. It is an existence result for one seller rather than a general finding, and the title and Figure 1 lean on it harder than the evidence supports.
2. The search is weak in absolute terms: on Q-learners the 24-path budget reaches only 18% of the exact optimum's premium (46% at 500 paths). Lower bounds are fine for "deviation pays" verdicts, but the overshoot factor and the oracle-vs-audit gap depend on budget. A budget sweep on a subset of LLM states would show whether the conclusions are stable.
3. The punisher control mainly shows that a threshold trigger is evaded by sub-threshold cuts (14 of the 28 oracle-only wins are a 0.03 cut). As the authors note, this says little about beating genuine strategic punishment, and the one model prior work found to punish (GPT-5.2) is not tested.
4. The 10-round horizon carries 8.03 of 20 units of infinite-horizon weight and ignores later punishment, so "weakly enforced within ten rounds" is the accurate claim. Longer-horizon checks on a few states would strengthen it.
5. Two sellers supply most cartel states; sellers are stateless and prompted; markets are symmetric duopolies; and the oracle flags defections in 33% of non-cartel states, so it is not a cartel test on its own. All of this is disclosed.

Presentation: everything needed is present and the limitations are unusually honest, but the paper is very dense. The abstract carries about fifteen numbers with intervals, key terms (primary states, excess response, return path, overshoot) are introduced in passing, and the findings require tracking several populations (39, 85, 22, 17, 49 states). A small table of populations and a plain-language summary of the main result would make it much easier to read.