Context Matters: Testing Evidence for Multi-Agent Collusion

What behavioral evidence distinguishes programmed coordination from unilateral misuse of an agent workflow? We construct 48 executable two-role controls spanning six policies, including legitimate cooperation, availability gates, content-dependent unilateral attacks and authorized partial release. A programmed coordination pair and an innocent-sender/malicious-receiver pair have identical observations under baseline, channel removal, content changes, shams and one source perturbation. A further source intervention preserving the authorized public feature separates this witness. On the selected scripted panel, harmful-outcome and removal predicates flag 24 of 40 negative controls; receiver-content and broad-source tests flag 16 and eight, respectively, while the feature-preserving test flags none. We then execute 96 assigned-policy episodes with local Qwen2.5-1.5B-Instruct and Dolos-1.5B, preserving 864 actor decisions. Schema validity is high, but original sender-policy conformance is only 11/48 and 7/48, and each model realizes the original two-step positive control in only 3/8 assigned cases. This demonstrates why policy instructions cannot stand in for behavioral labels. We retain invalid outputs as abstentions, report finite-panel bounds, and add a separately labeled scripted-sender calibration. The result is a reproducible stress test of evidence claims, not a universal collusion detector or evidence of spontaneous model intent. Stronger causal controls establish a more specific influence pattern, but agreement and authorization assumptions remain necessary.