Pith. sign in

REVIEW 3 major objections 4 minor 35 references

Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that covert collusion among tool-using LLM agents has a provable detection threshold: below a certain bit rate, no black-box, trace-only monitor can beat chance.

desk verdict An honest, well-written proposal with no measured results and a central capacity-frontier claim that fails for generative agents' semantic channels. read the letter →

arxiv 2608.02698 v1 pith:V4GXCXEH submitted 2026-08-03 cs.CR cs.AI

Mohamed Chahine Ghanem This is my paper
classification cs.CRcs.AI
keywords steganalysisLLMagentscovertcollusionblack-boxdetectiondetection-capacityfrontieradaptiveadversarycross-principalmutualinformation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tool-using LLM agents from different organizations increasingly share infrastructure, so a few agents can coordinate covertly while each looks benign. The paper treats this as black-box steganalysis: a monitor sees only traces (messages, tool calls, timing) and has no access to other principals' models. The central claim is that any such test has a provable detectability ceiling: at false-positive rate $\alpha$, no trace-only detector can achieve a true-positive rate above $\alpha+\sqrt{\epsilon/2}$, where $\epsilon$ measures the statistical divergence between innocent and coordinated behavior. Consequently there is a covert-rate threshold $r^*(\alpha)$ below which detection is no better than chance and above which it is feasible, and granting agents tools lowers that threshold by enlarging the carrier space. The paper builds an encoding-agnostic detector and an adaptive red-versus-blue evaluation to map that frontier, reporting clearly labelled placeholder numbers pending measurement and flagging cross-session payload spreading as an open evasion.

What carries the argument

The load-bearing object is the statistical distance between the innocent cover distribution $P_{\mathrm{cover}}$ and the stego distribution $P_{\mathrm{stego}}$ induced by a covert encoding, measured as relative entropy $\epsilon = D(P_{\mathrm{cover}}\|P_{\mathrm{stego}})$. Proposition 1 couples that divergence to the best possible true-positive rate at fixed false-positive rate $\alpha$ through total variation and the standard divergence bound, giving $\mathrm{TPR} \le \alpha+\sqrt{\epsilon/2}$. The rate–stealth trade-off of information hiding then converts the divergence budget into a maximum covert bit rate, producing the detection–capacity frontier $r^*(\alpha)$; an adaptive adversary that rewrites its encoding in-context, and a fused feature set that estimates exactly this divergence (notably neural mutual-information estimation), are the operational mechanisms that let the paper propose charting that frontier empirically.

What would settle it

Run the specified three-environment protocol to completion and plot measured TPR at FPR $10^{-3}$ against covert rate. The theory predicts a chance-level plateau below a positive rate $r^*$ and a rising curve above it; observing uniformly high TPR at low rates, or no measurable threshold, would falsify the detection–capacity frontier. A complementary check measures $\epsilon = D(P_{\mathrm{cover}}\|P_{\mathrm{stego}})$ for a working low-rate encoding: if a reliable channel operates with divergence far exceeding the small budget the ceiling requires, the transfer of the trade-off to agent behavior is unsupported.

Watch

Extended reading notes

Core claim

The discovery the paper argues for is a limit plus a method. The limit: by the standard inequality relating total variation and relative entropy, any decision rule based on observed traces and calibrated to false-positive rate $\alpha$ satisfies $\mathrm{TPR} \le \alpha+\sqrt{\epsilon/2}$ (Proposition 1), so as the adversary drives its stego distribution toward the innocent cover distribution, every black-box test collapses to chance. The rate–stealth trade-off of information hiding then implies a detection–capacity frontier: a covert rate $r^*(\alpha)$ exists below which detection is infeasible and above which it is feasible, with tool access lowering $r^*$ and shrinking the detectable region (Corollary 1). On the constructive side, the paper proposes an encoding-agnostic meta-detector that fuses cross-run mutual-information estimates, permutation-invariance tests, distributional-shift statistics, and timing and tool-call side channels, calibrated by conformal thresholds, and evaluates it against an adversary that co-evolves its encoding across rounds. All numeric results in the current version are labelled provisional placeholders, so the measured existence and location of the frontier remains to be supplied.

Load-bearing premise

The whole frontier rests on the assumption that the classical steganographic trade-off between covert throughput and statistical detectability carries over from fixed media to the open-ended, tool-mediated behavior of LLM agents, with mutual information faithfully measuring that throughput.

Editorial extensions

If this is right

  • If the frontier exists as predicted, any deployment that relies solely on trace monitoring cannot certify the absence of low-rate covert coordination; it can only bound the covert bandwidth that could have passed.
  • Because tool access enlarges the adversary's carrier space, giving agents tools such as retrieval, code execution, and free-form formatting is expected to lower the threshold $r^*(\alpha)$ and shrink the region where black-box detection is useful.
  • The quantitative ceiling is tight: to hold the true-positive rate within $0.05$ of chance, an adversary needs only $\epsilon \le 5\times 10^{-3}$ nats of divergence, so patient, low-bit-rate collusion is the regime black-box monitoring cannot police.
  • Spreading a payload across sessions degrades detection markedly in the projected ablations, so single-session steganalysis systematically under-detects distributed coordination.
  • The white-box oracle comparison prices the cross-principal constraint: a detector with activation access would score much higher, and a limited, audited activation interface could sit between the black-box and oracle regimes for cooperative deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same capacity argument applies to steganographic channels in ordinary text, so the threshold is not special to agents; what is special is that tools and memory widen the carrier space, and the paper's environment design makes that widening measurable.
  • A testable extension would compare the predicted frontier against the measured one; if the empirical frontier lies far from the theory curve, the transfer of the rate–stealth trade-off to generative behavior is the suspect step.
  • The cross-session evasion points to a natural next detector: concatenate per-agent traces across sessions by stable identifiers before estimating mutual information, or run sequential change-point tests, both mitigations the paper names but does not implement.
  • Because all reported numbers are labelled placeholders, the paper's practical value currently rests on the theory and methodology; the tables are templates for an experiment rather than evidence.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a black-box, trace-only steganalysis framework for detecting covert collusion among tool-using LLM agents operated by different principals on shared infrastructure. It formulates the problem as a binary hypothesis test between an innocent cover distribution and a stego distribution induced by a colluding adversary, derives a detectability ceiling TPR ≤ α + sqrt(ε/2) from Pinsker's inequality (Proposition 1), and asserts a detection–capacity frontier with a positive rate r*(α) below which detection is infeasible and above which it is feasible (Corollary 1). The design contribution is an encoding-agnostic meta-detector fusing cross-run mutual information, permutation tests, distributional divergence, timing, and tool-call features, with conformal calibration to a fixed FPR, evaluated against an adaptive co-evolving adversary in three tool-using persistent-memory environments. All numeric results in Tables III–VI and Fig. 2 are explicitly labeled illustrative placeholders that are not measured outcomes.

Significance. Proposition 1 is a correct and clean application of standard hypothesis-testing bounds, and the paper is commendably explicit about its threat model, its partial-observability assumptions, and the need to report model versions and baselines faithfully. The frontier framing—stating where black-box detection provably fails—is a useful conceptual contribution for AI-safety auditing if the underlying rate–stealth trade-off can be established for generative agents. However, the central theoretical claim (Corollary 1) is not justified for the generative-agent setting, and the paper contains no measured experimental data whatsoever; as it stands, the contributions are a proposal plus a limit result, not a validated method.

major comments (3)
  1. [Section V (Reproducibility and integrity note; Tables III–VI; Fig. 2)] The paper explicitly states that all numeric values in Tables III–VI are 'illustrative placeholders' that 'are not measured outcomes and must be replaced with the authors' own runs before submission.' The Analysis section (V-F) nevertheless interprets the projected pattern as supporting the detector's robustness, the co-evolution degradation, the frontier's location, and the cross-session evasion. This means the central empirical claims—detector performance, adaptive-adversary robustness, ablations, and oracle gap—are unsupported by any data in the manuscript. For a journal paper, this is a load-bearing gap, not a presentation issue.
  2. [Section IV-c (Corollary 1)] Corollary 1's existence of a positive rate r*(α) below which detection is infeasible follows from Proposition 1, but its 'feasible above r*' half requires the premise that increasing covert rate forces P_stego away from P_cover. This premise is not established for generative agents. A standard perfectly secure construction partitions the support of P_cover into equal-probability cells and samples from P_cover conditioned on the cell; the stego marginal equals P_cover, so D(P_cover||P_stego)=0 while a positive payload is delivered and I(m;m̂)>0. With ε=0, Proposition 1 forces TPR≤α at every rate, so no positive r* with a guaranteed feasible-above region follows. The paper's own Appendix A semantic family is precisely such a content-selection channel, and Section VI-E concedes it 'leaves few such artefacts.' A rate–stealth trade-off for the joint trace/outcome distribution would be needed; none is supplied.
  3. [Section III-A (rate definition) and Section IV-c] The paper identifies covert throughput r(e) with mutual information I(m;m̂) between the intended payload and the partner's decoded estimate, while Proposition 1's ε is D(P_cover||P_stego) between full trace distributions. The proof of Corollary 1 implicitly requires a functional relationship between these two quantities; the manuscript never states or proves such a relationship. Even a valid rate–stealth trade-off for trace distributions would not automatically yield a frontier expressed in bits per round as measured by I(m;m̂).
minor comments (4)
  1. [Section IV (introductory paragraph)] 'adetection–capacity frontier' should read 'a detection–capacity frontier.'
  2. [Section V-E] The sentence 'Each figure is averaged over at least 30 seeds with 95% bootstrap confidence intervals' conflicts with the preceding placeholder note; it describes planned methodology as if results already exist and should be rephrased or moved to the protocol description.
  3. [Appendix B] The claim that neural MI estimators are preferred because KSG estimators 'degrade sharply' on high-dimensional variable-length traces is unsupported by any experiment in the manuscript; a comparative study would be needed if this claim is retained.
  4. [Section VI-E] The statement about the cross-session evasion in Table V(c) being 'a real evasion' is not supported by data, since Table V(c) is explicitly labeled as illustrative placeholders; this assertion should be conditional on the planned experiment being run.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the theoretical ceiling is imported from external theorems with a self-contained proof, and all empirical values are explicitly labelled placeholders rather than fitted predictions.

full rationale

Proposition 1 is a direct application of Pinsker's inequality to a binary hypothesis test, and the paper gives its own proof: 'a level-α test has power at most α + TV(Pcover, Pstego) ... Pinsker's inequality gives TV ≤ sqrt((1/2) D(Pcover||Pstego)) = sqrt(ε/2)'. This derivation does not use the proposed detector, any fitted parameter, or any self-citation. Corollary 1 is presented as a consequence of the Moulin–O'Sullivan rate–stealth trade-off combined with Proposition 1; whether that trade-off transfers to open-ended generative-agent behaviour is an unproven empirical premise, but the paper does not define r*(α) in terms of its own measurements, and it explicitly disclaims novelty in the underlying inequalities: 'we claim novelty in its application to agent collusion and in the empirical frontier it predicts, not in the underlying inequalities.' All numeric tables are preceded by a reproducibility note stating they are 'illustrative placeholders' and 'not measured outcomes', so they are not fitted inputs renamed as predictions. There are no self-citations by the author, no uniqueness theorem imported from the authors' prior work, and no ansatz smuggled in via citation. The detector's feature set is not used to derive the detectability ceiling. The main unsupported step, that encoding more payload per round 'generally forces P_stego further from P_cover', is an external-validity assumption about generative steganography, not a circular reduction; the paper itself flags the semantic family as the hardest case. That concern belongs to correctness risk, not circularity.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central theoretical result rests on standard hypothesis-testing inequalities and the transfer of capacity theory to agent behavior; no free parameters are fitted. The empirical claims rest on placeholder numbers rather than data, so the main burden is the unverified assumption that the rate-stealth trade-off holds in LLM tool-using environments.

assumptions (5)
  • domain assumption Under H0, observable traces follow an innocent cover distribution P_cover; under H1, a stego distribution P_stego.
    Defines the statistical model in Section III-A and underlies the hypothesis test.
  • standard math Pinsker's inequality and total-variation bound for binary hypothesis tests.
    Used in Proposition 1, Eq. (3).
  • domain assumption Information-hiding capacity under distortion constraints (Moulin and O'Sullivan 2003) applies to tool-using agent carriers.
    Used to argue existence of the frontier in Corollary 1; assumes the rate-stealth trade-off transfers from fixed media to open-ended LLM outputs.
  • domain assumption Colluder messages are conditionally independent given the payload for Lemma 1; correlated messages make bound conservative.
    Appendix B; needed for the partial-observability bound ε_ρ ≤ ρε.
  • domain assumption Covert rate r(e) is estimated as mutual information I(m; m̂) over a batch of rounds and equals reliably delivered bits per round.
    Section III-A; the empirical meaning of the frontier depends on this operationalization.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach." pith.science (2026). https://pith.science/paper/V4GXCXEH

@misc{pith2026260802698,
  author       = {Pith},
  title        = {Pith review of: Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V4GXCXEH}},
  note         = {Machine review of arXiv:2608.02698}
}
read the original abstract

Tool-using agents built on large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure. This creates a population-level risk that single-agent safeguards miss: a handful of agents can quietly coordinate, rigging a market, boosting one another in a review process, or timing a joint data grab, while each one looks perfectly well-behaved. The difficulty is that the organisations running these agents cannot see inside one another's models, so any realistic detector must work from behaviour alone: black-box, trace-only, and often with only partial visibility. We treat covert coordination as an information-hiding problem and build a black-box steganalysis detector that combines cross-run mutual-information estimation, permutation tests, distributional-shift statistics, and timing and tool-call side channels, all calibrated to a fixed false-positive budget. Our central move is to stop testing against a single fixed code: we pit the detector against an adversary that continually rewrites its encoding to slip past whatever the detector has learned, and we run this red-versus-blue contest in tool-using, memory-carrying environments rather than toy games. Capacity theory then tells us what to expect, a detection-capacity frontier, a covert bit-rate below which black-box detection is provably no better than chance. We set out an experiment to map this frontier, report clearly labelled placeholder results pending measurement, and flag a practical evasion, spreading a payload across sessions, that current methods largely miss.

Figures

Figures reproduced from arXiv: 2608.02698 by the authors.

Figure 1
Figure 1. System model. Agents from independent principals interact over shared infrastructure; the monitor observes only partial traces and has no access to [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Schematic detection–capacity frontier (ILLUSTRATIVE PLACEHOLD￾ERS). Below r ⋆ detection approaches chance; tool access lowers r ⋆ and shrinks the detectable region, consistent with Corollary 1. figure is averaged over at least 30 seeds with 95% bootstrap confidence intervals, and key differences (detector vs. baseline at a fixed round) are tested with a paired Wilcoxon signed￾rank test, following reproducibility gui… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 24 canonical work pages

  1. [1]

    Multi-agent risks from advanced AI,

    L. Hammond, A. Chan, J. Clifton, J. Hoelscher-Obermaier, A. Khan, E. McLean, C. Smithet al., “Multi-agent risks from advanced AI,” Co- operative AI Foundation, Technical Report 1, 2025, arXiv:2502.14143

    arXiv 2025

  2. [2]

    Large language model based multi-agents: A survey of progress and challenges,

    T. Guo, X. Chen, Y . Wang, R. Chang, S. Pei, N. V . Chawla, O. Wiest, and X. Zhang, “Large language model based multi-agents: A survey of progress and challenges,” inProc. 33rd Int. Joint Conf. on Artificial Intelligence (IJCAI), 2024, pp. 8048–8057

    work page 2024

  3. [3]

    Secret collusion among AI agents: Multi-agent deception via steganography,

    S. R. Motwani, M. Baranchuk, M. Strohmeier, V . Bolina, P. H. S. Torr, L. Hammond, and C. Schroeder de Witt, “Secret collusion among AI agents: Multi-agent deception via steganography,” inAdvances in Neural Information Processing Systems 37 (NeurIPS). Curran Associates, Inc., 2024, pp. 73 439–73 486

    work page 2024

  4. [4]

    Hidden in plain text: Emergence and mitigation of steganographic collusion in LLMs,

    Y . Mathew, O. Matthews, R. McCarthy, J. Velja, C. Schroeder de Witt, D. Cope, and N. Schoots, “Hidden in plain text: Emergence and mitigation of steganographic collusion in LLMs,” inProc. 14th Int. Joint Conf. on Natural Language Processing and 4th Conf. of the Asia-Pacific Chapter of the ACL (IJCNLP-AACL). Association for Computational Linguistics, 2025...

    work page 2025

  5. [5]

    The prisoners’ problem and the subliminal channel,

    G. J. Simmons, “The prisoners’ problem and the subliminal channel,” in Advances in Cryptology: Proc. CRYPTO ’83, D. Chaum, Ed. Plenum Press, 1984, pp. 51–67

    work page 1984

  6. [6]

    An information-theoretic model for steganography,

    C. Cachin, “An information-theoretic model for steganography,”Infor- mation and Computation, vol. 192, no. 1, pp. 41–56, 2004

    work page 2004

  7. [7]

    Information-theoretic analysis of information hiding,

    P. Moulin and J. A. O’Sullivan, “Information-theoretic analysis of information hiding,”IEEE Transactions on Information Theory, vol. 49, no. 3, pp. 563–593, 2003

    2003

  8. [8]

    RNN-Stega: Linguistic steganography based on recurrent neural net- works,

    Z.-L. Yang, X.-Q. Guo, Z.-M. Chen, Y .-F. Huang, and Y .-J. Zhang, “RNN-Stega: Linguistic steganography based on recurrent neural net- works,”IEEE Transactions on Information Forensics and Security, vol. 14, no. 5, pp. 1280–1295, 2019

    work page 2019

Show all 35 references
  1. [9]

    An effective linguistic steganalysis framework based on hierarchical mutual learning,

    Y . Xue, L. Kong, W. Peng, P. Zhong, and J. Wen, “An effective linguistic steganalysis framework based on hierarchical mutual learning,” Information Sciences, vol. 586, pp. 140–154, 2022

    2022

  2. [10]

    Intelligent agents: Theory and practice,

    M. Wooldridge and N. R. Jennings, “Intelligent agents: Theory and practice,”The Knowledge Engineering Review, vol. 10, no. 2, pp. 115– 152, 1995

    1995

  3. [11]

    Generative agents: Interactive simulacra of human behavior,

    J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” inProc. 36th Annual ACM Symp. on User Interface Software and Technology (UIST). ACM, 2023, pp. 1–22

    2023

  4. [12]

    Pattern-based survey and categorization of network covert-channel techniques,

    S. Wendzel, S. Zander, B. Fechner, and C. Herdin, “Pattern-based survey and categorization of network covert-channel techniques,”ACM Computing Surveys, vol. 47, no. 3, 2015

    2015

  5. [13]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” inProc. 40th Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 202, 2023, pp. 17 061– 17 084

    2023

  6. [14]

    A survey of text watermarking in the era of large language models,

    A. Liu, L. Pan, Y . Lu, J. Li, X. Hu, X. Zhang, L. Wen, I. King, H. Xiong, and P. S. Yu, “A survey of text watermarking in the era of large language models,”ACM Computing Surveys, vol. 57, no. 2, pp. 1–36, 2024

    2024

  7. [15]

    Para- phrasing evades detectors of AI-generated text, but retrieval is an effec- tive defense,

    K. Krishna, Y . Song, M. Karpinska, J. Wieting, and M. Iyyer, “Para- phrasing evades detectors of AI-generated text, but retrieval is an effec- tive defense,” inAdvances in Neural Information Processing Systems 36 (NeurIPS). Curran Associates, Inc., 2023, pp. 27 469–27 500

    2023

  8. [16]

    zkLLM: Zero knowledge proofs for large language models,

    H. Sun, J. Li, and H. Zhang, “zkLLM: Zero knowledge proofs for large language models,” inProc. 2024 ACM SIGSAC Conf. on Computer and Communications Security (CCS). ACM, 2024, pp. 4405–4419

    2024

  9. [17]

    Learning to communicate with deep multi-agent reinforcement learning,

    J. N. Foerster, Y . M. Assael, N. de Freitas, and S. Whiteson, “Learning to communicate with deep multi-agent reinforcement learning,” in Advances in Neural Information Processing Systems 29 (NIPS). Curran Associates, Inc., 2016, pp. 2137–2145

    2016

  10. [18]

    Multi-agent cooper- ation and the emergence of (natural) language,

    A. Lazaridou, A. Peysakhovich, and M. Baroni, “Multi-agent cooper- ation and the emergence of (natural) language,” in5th Int. Conf. on Learning Representations (ICLR), 2017

    2017

  11. [19]

    AI control: Improving safety despite intentional subversion,

    R. Greenblatt, B. Shlegeris, K. Sachan, and F. Roger, “AI control: Improving safety despite intentional subversion,” inProc. 41st Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 235, 2024, pp. 16 295– 16 336

    2024

  12. [20]

    Visibility into AI agents,

    A. Chanet al., “Visibility into AI agents,” inProc. 2024 ACM Conf. on Fairness, Accountability, and Transparency (FAccT). ACM, 2024, pp. 958–973

    2024

  13. [21]

    Infrastructure for AI agents,

    A. Chan, K. Wei, S. Huang, N. Rajkumar, E. Perrier, S. Lazar, G. K. Hadfield, and M. Anderljung, “Infrastructure for AI agents,” arXiv preprint arXiv:2501.10114, 2025

    2025 arXiv

  14. [22]

    IDs for AI systems,

    A. Chan, N. Kolt, P. Wills, U. Anwar, C. Schroeder de Witt, N. Rajku- mar, L. Hammond, D. Krueger, L. Heim, and M. Anderljung, “IDs for AI systems,” arXiv preprint arXiv:2406.12137, 2024

    2024 arXiv

  15. [23]

    Open problems in cooperative AI,

    A. Dafoe, E. Hughes, Y . Bachrach, T. Collins, K. R. McKee, J. Z. Leibo, K. Larson, and T. Graepel, “Open problems in cooperative AI,” arXiv preprint arXiv:2012.08630, 2020

    2012 arXiv

  16. [24]

    Agent smith: A single image can jailbreak one million multimodal LLM agents exponentially fast,

    X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y . Wang, J. Jiang, and M. Lin, “Agent smith: A single image can jailbreak one million multimodal LLM agents exponentially fast,” inProc. 41st Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 235, 2024, pp. 16 647–16 672

    2024

  17. [25]

    Prompt infection: LLM-to-LLM prompt injection within multi-agent systems,

    D. Lee, M. Tiwari, and B. Miranda, “Prompt infection: LLM-to-LLM prompt injection within multi-agent systems,” inComputer Security – ESORICS 2025 Int. Workshops (SECAI), ser. Lecture Notes in Computer Science, vol. 16232. Springer, 2025

    2025

  18. [26]

    Breaking the protocol: Security analysis of the model context protocol specification and prompt injection vulnerabil- ities in tool-integrated LLM agents,

    N. Maloyan and D. Namiot, “Breaking the protocol: Security analysis of the model context protocol specification and prompt injection vulnerabil- ities in tool-integrated LLM agents,” arXiv preprint arXiv:2601.17549, 2026

    2026

  19. [27]

    Audit the whisper: Detecting steganographic collusion in multi-agent LLMs,

    O. Tailor, “Audit the whisper: Detecting steganographic collusion in multi-agent LLMs,” arXiv preprint arXiv:2510.04303, 2025

    2025

  20. [28]

    Colosseum: Auditing collusion in cooperative multi-agent systems,

    M. Nakamura, A. Kumar, S. Das, S. Abdelnabi, S. Mahmud, F. Fioretto, S. Zilberstein, and E. Bagdasarian, “Colosseum: Auditing collusion in cooperative multi-agent systems,” arXiv preprint arXiv:2602.15198, 2026

    2026 arXiv

  21. [29]

    Detecting multi-agent collusion through multi-agent interpretability,

    A. Rose, C. Cullen, B. G. Kaplowitz, and C. Schroeder de Witt, “Detecting multi-agent collusion through multi-agent interpretability,” arXiv preprint arXiv:2604.01151, 2026

    2026 arXiv

  22. [30]

    Mutual information neural estimation,

    M. I. Belghazi, A. Baratin, S. Rajeshwar, S. Ozair, Y . Bengio, A. Courville, and R. D. Hjelm, “Mutual information neural estimation,” inProc. 35th Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 80, 2018, pp. 531–540

    2018

  23. [31]

    Deep reinforcement learning that matters,

    P. Henderson, R. Islam, P. Bachman, J. Pineau, D. Precup, and D. Meger, “Deep reinforcement learning that matters,” inProc. 32nd AAAI Conf. on Artificial Intelligence (AAAI), vol. 32, no. 1, 2018

    2018

  24. [32]

    Estimating mutual information,

    A. Kraskov, H. St ¨ogbauer, and P. Grassberger, “Estimating mutual information,”Physical Review E, vol. 69, no. 6, p. 066138, 2004

    2004

  25. [33]

    Representation learning with contrastive predictive coding,

    A. van den Oord, Y . Li, and O. Vinyals, “Representation learning with contrastive predictive coding,” arXiv preprint arXiv:1807.03748, 2018

    2018 arXiv

  26. [34]

    CLUB: A contrastive log-ratio upper bound of mutual information,

    P. Cheng, W. Hao, S. Dai, J. Liu, Z. Gan, and L. Carin, “CLUB: A contrastive log-ratio upper bound of mutual information,” inProc. 37th Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 119, 2020, pp. 1779–1788

    2020

  27. [35]

    On variational bounds of mutual information,

    B. Poole, S. Ozair, A. van den Oord, A. A. Alemi, and G. Tucker, “On variational bounds of mutual information,” inProc. 36th Int. Conf. on Machine Learning (ICML), ser. PMLR, vol. 97, 2019, pp. 5171–5180

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.