Detection Is Not Prevention: A Behavioral and Activation-Level Study of Collusion Steering in Multi- Agent LLMs

Detection does not imply prevention. A monitor can appear to prevent collusion because its intervention changes behaviour, when the change comes from the instruction the intervention carries rather than from the monitoring. We separate those two and test each. On two API models, monitor-triggered notices eliminate instructed collusion in five of five scenarios, 25 runs per model. A 2x2 over 50 further runs isolates the mechanism: the honesty directive alone, with no monitor mentioned, reproduces the effect, while a monitor notice with no directive has none. On an open-weights 7B the notice prevents collusion in four of five scenarios under a clean system prompt, and one of five when that prompt also tells the agent to follow its private instruction. In a separate activation study, a behaviour-labelled probe reaches 0.89 AUROC on held- out scenarios, and ablating its direction at one layer and one dose leaves all 16 tested target votes unchanged: no evidence that this direction is a control handle. The behavioural monitor reads a code-word oracle throughout, so these experiments identify intervention effects, not detection performance. Two inferential gaps follow: an intervention’s apparent effectiveness does not establish its mechanism, and a predictive direction does not establish control.