What the released Stego activations contain: an extraction-boundary audit of NARCBench

Activation-based monitors are a proposed defense against covert collusion between AI agents, and benchmark claims about them depend on an assumption that is rarely checked: that the released activations were extracted from the inputs the paper describes. We audit that extraction boundary in NARCBench, a multi-agent collusion benchmark with a steganographic (Stego) scenario, using only the authors' released code and artifacts. Running the source's loader and tokenizing its output reproduces every released Stego token count exactly (1,320 of 1,320 rows per model), yet the loader supplies an empty assistant response for all 160 final player entries per model, while the actual final responses are stored separately and almost all nonempty. Released runs also contain four distinct final user prompts where the paper states all agents receive identical ones. A white-box context-length baseline separates the released conditions at run level; substituting the actual final responses leaves the Qwen3-32B length score at 1.0 but lowers GPT-OSS-20B's from 0.9175 to 0.75. The condition label is recoverable from prompt construction alone: system-prompt length is a perfect separator in both models, and colluders' final user prompts embed the private coordination transcript verbatim (40/40 colluder, 0/120 honest). An exploratory role-subset tensor diagnostic finds above-chance colluder-role separation across all four released models (AUROC 0.975-1.000 Stego, 0.788-0.961 Transfer); honest-only intervals are model-dependent, including chance in five of eight model-arms. Whether corrected extraction changes detection performance remains unmeasured.