Letting AI Agents Choose Without Letting Them Whisper: Proved Leakage Caps Against Adaptive LLM Colluders

1. The report studies how to limit covert communication between AI agents. It shows that canonical rewriting removes presentation carriers but not the information in which answer an agent chooses. It then proposes restricting that choice to a menu of 2^k candidates written by a trusted model, proves in Lean that this caps leakage at k bits per answer for any weights, and tests the cap against GPT-4.1-mini colluders that revise their scheme over 12 rounds. Measured leakage stayed at or near the cap (2.89 bits at k = 3, 4.51 at k = 5), and honest utility rose with k. Pairing a formal bound with an adaptive test is the main value of the work, as is the point that defenses should be judged on both worst-case bounds and leakage against adaptive adversaries.

   The cap needs more context to be useful in practice. It bounds all variation the receiver can see, including the legitimate answer, and it accumulates over answers, so a menu of 8 options still allows 3 bits per answer and 3n bits over n answers. The report does not say how many bits colluders would need to cause harm in a realistic setting, such as agreeing on a price or signalling a target. Without that, it is hard to judge whether a 3-bit cap is a meaningful restriction or a small delay.

   Some comparisons need adjustment. Part of the menus’ utility gain comes from validity filtering, since every menu option is feasible while about 20% of free answers are not. Applying the same filter to free answers would give a fair baseline. The paraphrase and broker conditions reject 49% and 33% of colluding answers, so their low leakage partly reflects failed task attempts that a monitor would likely notice, rather than effective suppression. In the menu conditions, finding the index encoding is easy, so the adaptive test mainly confirms that colluders reach an obvious ceiling. A more informative test would check whether they find channels outside the menu, such as timing, retries or rejection patterns, which the report lists as out of scope.

   The approach depends on a trusted proposer that can produce good candidates from public information. This works for the shopping and word-denoising tasks but would be hard to apply to open-ended prose or code, as the report notes. Experiment 3, on residue and bilinear networks, achieves zero leakage by construction and computes exactly what a mod-3 model would compute; it adds little to the main argument and could move to an appendix. Experiment 2 uses one training seed and 600 test items, and its comparison with the unrestricted chooser is matched on chooser size but not on total compute. The report also states that all code, proofs and text were produced by AI agents and that the author has not independently verified all of the technical content. Readers should weigh the results with that in mind until they are checked.

   Read full reviewShow less

2. The erase, bound and remove framing is clear, and the Lean bound is honestly presented as a known counting argument. Four issues limit the conclusions. First, your logs show that most Llama-8B proposer outputs fail to parse, because "1. ITEMS: ..." is rejected. Menus are therefore mostly padded lexicographic enumerations of feasible sets, and menu5 covers about 94% of them. So the utility gain over free answers (0.91 vs 0.79) and the 0.70 "trusted alone" baseline measure enumeration plus validity filtering, not a trusted proposer. Fix the parser and rerun the utility curve. Second, an index interface cannot exceed k bits except through estimator bias. Experiment 4 shows how fast colluders saturate the cap, not that the cap holds, so drop "behaves exactly as proved." Third, at k=5 the cap equals the broker's roughly 5-bit channel, and every menu leaked more on average than the broker. State the benefit as predictability. Fourth, cite Motwani et al., Secret Collusion (NeurIPS 2024).

   Read full reviewShow less

1 judge declined to score this project.