The case for subliminal collusion: Tacit co-ordination via shared lineage
Mihir Sahasrabudhe · Team Subliminal
Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.
Collusion in multi-agent systems can lead to unexpected and harmful consequences. We study collusion through the lens of subliminal learning, a phenomenon in which a student model fine-tuned on benign-looking synthetic data inherits hidden traits of the teacher that generated it. We focus on coordination that doesn’t need an agreed-upon channel or intent. In our setting, two models behave as a coalition because they were distilled from the same teacher.
We have two settings:
(1) Decoding: A Qwen3.5-4B distilled receiver student recovers the teacher’s cue 74% of the time under an explicit prohibition; control stays at 50%. Encoding behavior doesn’t transfer.
(2) Judgment: A Qwen2.5-7B judge distilled from a teacher with a hidden preference shifts judgments by 11 to 13 points despite instructions to ignore that preference. In a panel where three judges decide by majority, two students from the same teacher swing the outcome. A keyword monitor, an LLM monitor reading the written reasons, and a vote-agreement monitor all fail to detect it.
The bias is subtle and vanishes when one option is clearly better but becomes crucial in deciding close calls. We argue that shared lineage is an overlooked route to coordinated, undetectable failures in multi-agent oversight.

Reviews
Strengths. A creative and timely idea: that a shared training lineage can make independently deployed agents correlate their judgments with no communication and no intent — a structural precursor to collusion in multi-agent oversight. The experimental design is careful for a sprint. There is a proper control (a shuffled-association teacher), an opposite-direction control (a present-tense teacher), three student seeds that replicate the effect to within ~1–2 points, a panel (majority-vote) analysis, harm sets at two severities, a scope/framing check, and an explicit-collusion game. Bootstrap confidence intervals are used throughout, predictions were locked before student training, and — importantly — the negative results are reported honestly: the "communication" channel did not transfer into the game, the explicit-collusion game showed no student edge, and keyword, vote-agreement, and LLM-text monitors all miss the effect, which appears only in aggregate against a control judge. The pre-sprint experiment timing is disclosed openly in the Acknowledgments, and compute and methods are reported precisely.
To strengthen.
- The framing runs ahead of the evidence. What is demonstrated is tacit correlation from shared lineage in a judging task; the communication experiment did not transfer and the explicit-collusion game was null — so there is no demonstrated active collusion. You acknowledge this in Section 6; pull that caveat up into the title framing and abstract so the claim matches what was shown.
- The effect is real but modest and context-fragile. The individual-judge shift is ~+13 points, but the panel does not amplify beyond a single student (same-base students already agree 95–98%), the mild-harm effect's interval touches zero (+6.7, 95% [0.0, 13.7]), the serious-harm effect is null (−0.1 [−2.1, 1.8]), and under a "which would you publish?" prompt the past-side effect vanishes. State the practical ceiling of the risk plainly and early.
- Reconcile the numbers. The text cites a ~12-point panel shift while Table 13 gives +11.5 [7.6, 15.8], and the repo's interim summary shows +13.8 for the individual shift versus the paper's +13.1. Small, but worth a consistency pass before publication.
- Add an explicit LLM-usage statement and a code/data link in the PDF. Claude is used throughout (generating reviews, teacher reasons, harm rewrites, and as the text monitor) and a complete public repo exists, but neither is declared in the paper.
- Be explicit about replication breadth. Exp 1 is single-seed, and the Exp 2 seeds vary only initialization and data order — so they test robustness to seeding, not to the full pipeline — and the preregistration is a draft, so all tests are exploratory. Name this as the main generalization limit.
Overall. A genuinely interesting, well-controlled, and honestly reported study that extends subliminal learning into a collusion-oversight framing. The headline mechanism (trait transfer via distillation) comes from prior work; the contribution is the tacit-collusion reframing and the judging/panel application. Judged on the write-up, this is a strong and careful hackathon submission — its main weakness is that the "collusion" claim is more suggestive than demonstrated, and the effects are modest and fragile outside close calls.
Read full reviewShow less
Cite this project
@misc{sahasrabudhe2026case,
title = {{The case for subliminal collusion: Tacit co-ordination via shared lineage}},
author = {Mihir Sahasrabudhe},
year = {2026},
month = oct,
note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/the-case-for-subliminal-collusion-tacit-coordination-via-shared-lineage-5ec8}},
url = {https://apartresearch.com/sprints/projects/the-case-for-subliminal-collusion-tacit-coordination-via-shared-lineage-5ec8}
}More from AI Collusion Research Sprint
- View project: Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence ? Causal Auditing of Collusion Through Shared Agent State
Signal or Coincidence
How can we distinguish genuine coordination between AI agents from coincidental behavioral alignment? We introduce a randomized canary audit that tests whether private information propagates through shared tool state, …
- View project: (1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
(1.4) Collusion, Espionage, or Look-alikes? Auditing Information Flow between LLM Agents
Bid Brother
Can an overseer find two secretly coordinating AI agents just by watching what they do? We tested pairwise net influence (Bonjour et al., 2022) on LLM bidders in a repeated procurement auction, with instructed cartels …
- View project: AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
AI Sellers Propose Bid-Rigging Within Minutes, but Their Agreements Do Not Hold
Fugue
AI agents are starting to negotiate and bid for competing companies. We follow cartels among them from the first proposal to the price the buyer pays, in a sealed-bid procurement market where twelve LLM agents act as …