Reading Exclusive Context from Activations: A Label-Free Monitor for Colluding LLM Agents

LLM agents that collude against the people they serve can keep their messages innocuous and evade text monitors. We read each agent’s residual stream through a Jacobian lens and count the lens entries that exactly two of four agents share; the monitor needs no labels, training or LLM. NARCBench committees have four agents; in collusion runs two are instructed to push one option. With Gemma-3-27B or Qwen3-32B agents, the monitor separates collusion runs from all-honest controls at AUROC 0.98–0.99. It beats the same count on the agents’ messages (planned, Gemma: +0.08) and, on Qwen, an LLM judge (0.99 vs 0.84). On six unseen task types it reaches 1.00, where text overlap scores 0.59 and NARCBench’s trained probe, as we reran it, 0.78 (paper: 0.88; planned, +0.22). It works from each agent’s state before it speaks (0.93–0.94), and a rule fixed on one LLM names the colluding pair in 70% of held-out runs. In pre-registered stress tests it survives colluders warned that their reasoning is monitored (0.99) or told to keep the arrangement out of it (0.99), and paraphrased instructions, even without a private channel (0.96, 0.89). But it flags honest pairs given a harmless confidential note almost as readily (0.88–0.94), even when the note is open; the trained probe rejects one such note (0.97 vs 0.64) but flags two others. It is a cheap screen for exclusive context: it shows which runs and pair to review, not intent; when colluders play complementary roles (NARCBench-Stego), it names the honest pair.