Follow the Text: Channel-Agnostic Detection of Inter-Agent Communication via Provenance

The idea is simple and useful. Tag every string an agent reads with its origin, then flag model-emitted, single-origin text that reaches another run by a different route. Figure 1 explains the rule and both of its failure modes well. The inotify rig, with isolated and positive controls, is the strongest evidence in the paper. The Hugging Face result needs a baseline. Between 223 and 255 of the 256 agents in each arm wrote to the registry, so most edges would pass the 'prior registry write' check by chance. Report the score for shuffled edges, or require that B read the specific file A wrote. 'Channel-agnostic' is argued but never tested: the rig shares one directory and the reproduction has one registry. Add a run with a second, undeclared channel. Also measure whether seeding known test output reduces the 55 false findings per 1,000 inputs on Refactor Arena.

Seems like a decent paper, introduces a scalable, channel-agnostic method to detect unauthorized communication between AI agents.

This is the idea i will remember from this sprint. Don't enumerate channels, follow the text. If a string with one origin shows up in another agent's context by a route its origin didn't take, something carried it, and you don't care what. Simple, cheap, no model calls, and aimed exactly at the incident class that caused this sprint to exist.

The validation range impressed me. A rig with real filesystem ground truth, the 256-agent incident reproduction, a live wiki network, false positives measured on honest refactoring work, a scripted adversary, and a scaling analysis that never confuses projections with measurements. Figure 1 is the best explanation I read all weekend; you give your detector's two failure modes the same billing as its correct cases. And the DseWiki number deserves attention: 38 % of edges connect agents whose lifetimes never overlapped. The board was functioning as memory. Any monitor that only compares live agents misses all of that.

Here are my two cents:

1. Clarify the headline metric: The 93 to 99 % headline is temporal corroboration, not precision. The reproduction logs record no reads, so you can't actually know. Say so in the abstract, or get file-access logs for one arm and measure it for real.
2. Treat laundering as core architecture: Laundering isn't future work, it's the other half of your system. It explains every miss in your rig and four of the six successful evasions. Even a rough taint-tracking prototype on the file layer would change the story.
3. Unbury the model refusal findings: You buried something interesting in Appendix C: the models you briefed refused to attempt evasion. That means your adversarial robustness currently rests on model alignment. Which models refuse, under what framing? That's a paper on its own.
4. Measure the pre-seeding effect: Most of your 55 false findings per thousand inputs are predictable test output and you say yourself the experiment hasn't been run. That single number probably decides whether anyone deploys this.
5. Adopt rarity-weighted shingles: Go with the rarity-weighted shingles. Your own ablation shows that shrinking lengths globally is a bad trade, so weighting is the move for the short-string blind spot.

I really enjoyed reading this paper. Focusing on text provenance over channel tracking is a fantastic angle, and addressing these measurement gaps will make this work virtually airtight! 😊