Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State

The randomized private target, structure-preserving null, carrier permutation and canonical recomputation provide a convincing audit of information flow. Separating authorized flow from harmful approval is a major strength, as is testing attackers that know the sanitizer. The cross-model reading of Gemini tickets is also informative. For the next version, make the adaptive-note comparisons confirmatory on fresh seeds and pin providers or quantify routing variation. Evaluate a workflow where free text contains genuinely necessary information, so defense cost cannot be avoided by dropping a redundant field. Present recovery conditional on valid guesses beside the abstention rate in the main table, and distinguish target identification from harmful approval throughout. The current work establishes carriers of instructed collusion and a useful causal audit; it does not show spontaneous prohibited objectives or a general defense that preserves legitimate free-text utility. In relating the audit to Keppo et al., distinguish observable behavioral effects from inferred cognition or trust. On the Fragility of AI Agent Collusion and Trusting AI in Competitive Markets motivate that distinction, but neither replaces your randomized target, carrier interventions and explicit harm controls.

This paper proposes a randomized canary audit: give one agent a uniformly random private target, ask whether a second agent's behavior depends on it, then intervene on the shared tool state between them. The identification argument is clean, the exact null handles abstention, and permutation shows whether behavior follows the carrier rather than coincidence. The empirical findings are strong: one model's preparers converge on marking the target urgent without any pre-agreement, other models' approvers decode it, and sanitizer-aware preparers move the signal into a surviving free-text note. The five-way distinction between information flow, authorized cooperation, covert signaling, joint prohibited objective, and violating outcome is a real conceptual contribution, and the demonstration that an authorized expedite request produces the same flow signature as collusion shows why flow alone is not evidence. This is the most methodologically ambitious paper in the group and the audit is reusable. It shares its premise with the task-claims paper, that structured state carries collusion, but adds the auditing machinery that paper lacks. Collusion is instructed, so it measures carriers, not emergence, which the authors mention.