Tool Choice Signaling and Task State Preservation in LLM Multi-Agent Systems.

We investigated whether LLM agents can communicate indirectly through tool choices and whether runtime observation filtering can suppress this communication without disrupting legitimate task coordination.

Using a three agent Colosseum Jira environment with private messaging disabled, we instructed a sender to encode one bit by selecting between two equivalent tools that performed the same task assignment. We evaluated four observation policies: exposing tool identity (T1), canonicalizing the tool name (T2), hiding both action events and the receiver's assignment (T3), and hiding action events while preserving assignments (T4).

We conducted 108 exploratory episodes, a separate 72 episode holdout, and eight additional utility episodes.

Three key findings emerged. First, visible tool identity transmitted the instructed signal, with mean receiver dependence of 0.875 in the holdout. Second, deleting action events while preserving assignments reduced measured bit dependence to zero across all four holdout seeds; canonicalization showed no consistent utility advantage over event deletion. Third, also hiding the receiver's assignment caused duplicate work and reduced joint reward in three of four tested environments.

Our findings highlight a security utility trade off: concealing execution metadata can suppress the tested communication channel, but removing task-relevant information can disrupt legitimate cooperation. The study demonstrates prompted signaling, not emergent or harmful collusion.