One Bit Is Enough: Breaking and Auditing Tacit Collusion Between Learning Pricing Agents
Aishika Manu · Team STUDS
Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.
Pricing agents can learn to collude without communicating: they settle on high prices and punish rivals who undercut. Using the standard logit-demand market of Calvano et al. (2020), we trained Q-learning agents in about 4,300 sessions while restricting what each agent sees of its rival’s price. We compared them with control agents that reach high prices but cannot sustain collusion. Rounding the rival’s price to one bit (“higher or lower”) barely reduces collusion (index 0.81 → 0.75). Random noise or a single period of delay roughly halves it, and delay removes no information. Collusion is a private convention: agents from different sessions fail to collude together (0.20), but a new entrant re-learns it (0.74). At equal price levels, the evidence auditors usually rely on fails: high prices score at chance (AUC 0.48) and parallel pricing points the wrong way (0.02). Tests of whether a firm reacts to its rival work well (0.90). Reading agents’ learned strategies shows that behaviour can understate collusive intent by half, and is the best detector overall (0.90). The results hold across learning parameters. We release a tested LLM-agent extension with pre-registered predictions.

Reviews
This is a strong sprint paper, and the core result stayed with me after I finished reading it. Tell two pricing agents only whether the rival price is higher or lower than their own, and collusion barely moves, from a collusion index of 0.81 down to 0.75. That is not what I would have guessed. A trigger strategy only needs to spot a cut, and one bit is enough to spot it. One caveat on that headline: the bit has to be the relative one, higher or lower. Coarsen to a single bucket and collusion collapses entirely, Δ −0.03. So it is one relative bit, not any one bit. So coarsening the signal is not a safeguard. Corrupting it or delaying it is. Noise at 20 percent cuts collusion by 53 percent, down to 0.38, and a one period delay cuts it by 41 percent, down to 0.48, even though delay removes no information at all. That contrast is the paper at its best. It gives defenders something they can actually use, and it gives the rest of the paper a clear question to answer.
The detection work is the other half I liked. The author sets up controls that price high but cannot collude, then matches them to colluders at the same price level, 60 pairs with a caliper of 0.02 and a mean gap of 0.004. At those matched prices, price level tells you nothing, with an AUC of 0.48 and a confidence interval of 0.38 to 0.59. Parallel pricing is worse than nothing. It points the wrong way, with an AUC of 0.02, because the non colluders move in lockstep more than the colluders do. What works is watching reactions. The lead lag test, whether a firm moves after its rival moves, scores 0.90, with a confidence interval of 0.84 to 0.94. A single forced deviation scores only 0.63. That is a useful lesson for anyone doing audits, and the paper states it plainly: test reactions, not outcomes.
I also liked the part on intent versus behaviour, in section 4.4. Under noise, the agents plan to retaliate about twice as hard as they actually do in the market, minus 0.26 in the learned strategy against minus 0.13 in enacted play. Reading the strategy scores 0.90 across all agents, ahead of the forced deviation probe at 0.77. Raw price level scores 0.94 there, but only because clean colluders price far above everything else, and it falls to chance at matched prices. At matched prices the long lead lag record at 0.90 is still the strongest test, ahead of strategy reading at 0.78. The paper does not oversell this. It says the two kinds of evidence fit together, and I agree.
The work behind these numbers is large, about 4,300 sessions, 100 seeds per intervention condition and 200 per detection condition, with confidence intervals throughout, and the intervention ranking holds across three other learning parameter settings. The code and session level data are released, and the author is open about an earlier matching mistake, where an unmatched match left a 0.13 gap in the collusion index and made price level look diagnostic at an AUC of 0.89. Fixing that and saying so in the paper raised my trust in the rest of it.
Four things would make it stronger. First, run the LLM extension, even on a small model or with fewer seeds. Right now it is built, unit tested and pre registered, but not run, for lack of model access. That is the part most directly about AI agents, and without it the paper rests on Q learners alone. Sixty periods for the LLM protocol is also short next to up to 3 million periods for the Q learners, so I would want the author to say what they expect to see in that window and how they would tell no collusion apart from not enough time. Second, sort out the jitter results. Jitter converges at 0 percent across all four doses, and noise only converges 50 to 94 percent, so readers need to know how to read the collusion index in conditions where no session ever settles. Is that continued play rather than a learned outcome, and does the dose response still mean anything then. Third, grow the matched sample past 60 pairs if compute allows. The headline detection comparisons rest on that sample, and the intervals are wide. Fourth, explain the delay result more fully. Under a one period delay the deviation still does not pay, minus 2.23, yet collusion falls 41 percent. Why does a punishment threat that still makes undercutting unprofitable fail to hold prices up when it arrives one period late. Is the punishment too late to discipline, or do the agents just fail to learn the delayed link. I would like that mechanism spelled out.
Even with those gaps, I would accept this paper. The Q learning work stands on its own, the two headline results are surprising and useful, and the paper is honest about what it has not shown.
Read full reviewShow less
Cite this project
@misc{manu2026one,
title = {{One Bit Is Enough: Breaking and Auditing Tacit Collusion Between Learning Pricing Agents}},
author = {Aishika Manu},
year = {2026},
month = oct,
note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/one-bit-is-enough-breaking-and-auditing-tacit-collusion-between-learning-pricing-agents-588z}},
url = {https://apartresearch.com/sprints/projects/one-bit-is-enough-breaking-and-auditing-tacit-collusion-between-learning-pricing-agents-588z}
}More from AI Collusion Research Sprint
- View project: Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence
How can we distinguish genuine coordination between AI agents from coincidental behavioral alignment? We introduce a randomized canary audit that tests whether private information propagates through shared tool state, …
- View project: (1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
(1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
Bid Brother
Can an overseer find two secretly coordinating AI agents just by watching what they do? We tested pairwise net influence (Bonjour et al., 2022) on LLM bidders in a repeated procurement auction, with instructed cartels …
- View project: AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
Fugue
AI agents are starting to negotiate and bid for competing companies. We follow cartels among them from the first proposal to the price the buyer pays, in a sealed-bid procurement market where twelve LLM agents act as …