Splitting the Rule of Two Across Agents: What Per-Agent and Shared Gates Catch, and What They Cost

The report asks whether Meta’s Agents Rule of Two still protects a system when three agents each hold one of the three properties, and what a shared, label-carrying gate costs. It defines collusion in terms that can be checked from logs, and its control cases separate collusion from benign coordination and from harm caused by one agent. These control cases are the most useful part of the work. In particular, the programmed coalition with no untrusted input shows that the shared gate, by design, cannot see collusion that does not involve untrusted input, and the report states this limit openly.

The protection results follow from the definitions. A per-agent gate checks one session at a time, so an attack that splits the three properties across sessions will always pass it. A gate that carries labels across shared media will always stop an attack that moves through labelled media. The report calls the second result a positive control, which is correct, and says the informative results are the costs and boundaries. Those costs depend on the benign templates. Seeds change content but not structure, so the 80 of 160 benign holds come from 4 of 8 templates, and all 40 avoidable holds come from the two independent-pair templates. The cost figures therefore describe this template mix rather than a typical workload, which the report acknowledges. A set of benign tasks drawn from real multi-agent traces would make the cost comparison more meaningful.

The link to collusion is limited. Most scenarios relay an injected instruction through compliant agents, which is a confused-deputy problem rather than coordination between agents with their own goals. The one case closest to collusion in the sprint’s sense, the programmed coalition, passes the shared gate. The shared gate is the simplest member of an existing family of information-flow defenses, and none of those systems is run for comparison, so the contribution is a cost and coverage map for a basic version rather than a new defense.

The language-model pilot did not test protection, because the model refused every attack, including the instructed variants, and escalated all 55 attack episodes to a human. Three templates were added after the first round found nothing. The report should name the model in the text rather than only in the README. A pilot with a model that follows injections, and attack templates written by someone who has not seen the gate code, would test the gates against agents that actually attempt the leak. The approver is a destination-only oracle, so the approver sweep is arithmetic on flip rates rather than evidence about how people review held actions.