Skip to content
Sprint projectOct 25, 2026

The case for subliminal collusion: Tacit co-ordination via shared lineage

Mihir Sahasrabudhe · Team Subliminal

Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: The case for subliminal collusion: Tacit co-ordination via shared lineage

Presentation

Presentation: The case for subliminal collusion: Tacit co-ordination via shared lineage

Code (opens in new tab)
Share

Collusion in multi-agent systems can lead to unexpected and harmful consequences. We study collusion through the lens of subliminal learning, a phenomenon in which a student model fine-tuned on benign-looking synthetic data inherits hidden traits of the teacher that generated it. We focus on coordination that doesn’t need an agreed-upon channel or intent. In our setting, two models behave as a coalition because they were distilled from the same teacher.

We have two settings:

(1) Decoding: A Qwen3.5-4B distilled receiver student recovers the teacher’s cue 74% of the time under an explicit prohibition; control stays at 50%. Encoding behavior doesn’t transfer.

(2) Judgment: A Qwen2.5-7B judge distilled from a teacher with a hidden preference shifts judgments by 11 to 13 points despite instructions to ignore that preference. In a panel where three judges decide by majority, two students from the same teacher swing the outcome. A keyword monitor, an LLM monitor reading the written reasons, and a vote-agreement monitor all fail to detect it.

The bias is subtle and vanishes when one option is clearly better but becomes crucial in deciding close calls. We argue that shared lineage is an overlooked route to coordinated, undetectable failures in multi-agent oversight.

Reviews

Judging this Sprint?

Review “The case for subliminal collusion: Tacit co-ordination via shared lineage”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for the field if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. Strengths. A creative and timely idea: that a shared training lineage can make independently deployed agents correlate their judgments with no communication and no intent — a structural precursor to collusion in multi-agent oversight. The experimental design is careful for a sprint. There is a proper control (a shuffled-association teacher), an opposite-direction control (a present-tense teacher), three student seeds that replicate the effect to within ~1–2 points, a panel (majority-vote) analysis, harm sets at two severities, a scope/framing check, and an explicit-collusion game. Bootstrap confidence intervals are used throughout, predictions were locked before student training, and — importantly — the negative results are reported honestly: the "communication" channel did not transfer into the game, the explicit-collusion game showed no student edge, and keyword, vote-agreement, and LLM-text monitors all miss the effect, which appears only in aggregate against a control judge. The pre-sprint experiment timing is disclosed openly in the Acknowledgments, and compute and methods are reported precisely.

    To strengthen.

    1. The framing runs ahead of the evidence. What is demonstrated is tacit correlation from shared lineage in a judging task; the communication experiment did not transfer and the explicit-collusion game was null — so there is no demonstrated active collusion. You acknowledge this in Section 6; pull that caveat up into the title framing and abstract so the claim matches what was shown.
    2. The effect is real but modest and context-fragile. The individual-judge shift is ~+13 points, but the panel does not amplify beyond a single student (same-base students already agree 95–98%), the mild-harm effect's interval touches zero (+6.7, 95% [0.0, 13.7]), the serious-harm effect is null (−0.1 [−2.1, 1.8]), and under a "which would you publish?" prompt the past-side effect vanishes. State the practical ceiling of the risk plainly and early.
    3. Reconcile the numbers. The text cites a ~12-point panel shift while Table 13 gives +11.5 [7.6, 15.8], and the repo's interim summary shows +13.8 for the individual shift versus the paper's +13.1. Small, but worth a consistency pass before publication.
    4. Add an explicit LLM-usage statement and a code/data link in the PDF. Claude is used throughout (generating reviews, teacher reasons, harm rewrites, and as the text monitor) and a complete public repo exists, but neither is declared in the paper.
    5. Be explicit about replication breadth. Exp 1 is single-seed, and the Exp 2 seeds vary only initialization and data order — so they test robustness to seeding, not to the full pipeline — and the preregistration is a draft, so all tests are exploratory. Name this as the main generalization limit.

    Overall. A genuinely interesting, well-controlled, and honestly reported study that extends subliminal learning into a collusion-oversight framing. The headline mechanism (trait transfer via distillation) comes from prior work; the contribution is the tacit-collusion reframing and the judging/panel application. Judged on the write-up, this is a strong and careful hackathon submission — its main weakness is that the "collusion" claim is more suggestive than demonstrated, and the effects are modest and fragile outside close calls.

    Read full reviewShow less

Cite this project

@misc{sahasrabudhe2026case,
  title = {{The case for subliminal collusion: Tacit co-ordination via shared lineage}},
  author = {Mihir Sahasrabudhe},
  year = {2026},
  month = oct,
  note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/the-case-for-subliminal-collusion-tacit-coordination-via-shared-lineage-5ec8}},
  url = {https://apartresearch.com/sprints/projects/the-case-for-subliminal-collusion-tacit-coordination-via-shared-lineage-5ec8}
}