The Pulse
AI-Agent Collusion Detection Tested in a Simulated Blackjack Benchmark
A benchmark study reports that probes of AI models’ internal activations detected coordinated behavior in a simulated blackjack card-counting task, even when the agents communicated through ordinary-sounding table talk.
AI.info Team ·
A benchmark study reports that probes of AI models’ internal activations detected coordinated behavior in a simulated blackjack card-counting task, even when the agents communicated through ordinary-sounding table talk. On that task, five detection techniques scored between 0.99 and 1.00 AUROC on the researchers’ strongest tested model. The paper also reports transfer results of 0.73 to 0.93 AUROC across structurally different multi-agent scenarios.
The paper, “Detecting Multi-Agent Collusion Through Multi-Agent Interpretability,” introduces NARCBench, a benchmark for testing whether internal model signals can help identify group-level collusion. Its authors are Aaron Rose, Carissa Cullen, Sahar Abdelnabi, Philip Torr, Brandon Gary Kaplowitz and Christian Schroeder de Witt.
A benchmark spanning three kinds of tests
NARCBench has three tiers. Its Core tier includes 50 committee-deliberation scenarios across 17 domains. In those tests, agents consider a binary choice, and secretly coordinating agents try to steer the group toward a predetermined outcome. The Transfer tier tests six structurally different scenario families, including code-review sabotage, stock manipulation, software-pipeline sabotage, knowledge-base poisoning, research-policy slanting and news framing.
The Stego tier uses blackjack card counting. In the paper’s description, two agents privately agree on an encoding scheme: a Counter tracks the running card count and conveys it through public table talk, while a Big Player decodes the signal and adjusts bets. The table talk is designed to sound like ordinary gambler chatter, and each simulated shoe uses a new encoding scheme.
The researchers tested four open-weight models: Qwen3-32B, Llama-3.1-70B, DeepSeek-R1 32B and GPT-OSS-20B. They trained a probe to assign deception scores from agents’ activations, then combined scores across agents using five techniques. The methods aim to detect different patterns, such as an unusually high score for one agent, a split between a colluding subgroup and other agents, or a change in relationships among agents’ internal representations.
Results depend on the task and the detector
For Llama-3.1-70B, the five techniques scored 0.73 to 0.93 AUROC on the Transfer tier and 0.99 to 1.00 on the blackjack task. In the paper’s averaged results across models and techniques, transfer AUROC ranged from 0.68 for GPT-OSS-20B to 0.87 for Llama-3.1-70B; the blackjack results ranged from 0.86 to 1.00. AUROC measures how well a method separates collusion cases from control cases across decision thresholds.
The researchers report that an LLM judge monitoring the blackjack table talk did not reliably distinguish collusion from control runs. They also found that no single probing technique performed best across all forms of collusion. The paper presents activation analysis as a complementary signal to text-level monitoring, not as a universal detector.
The study’s results have limits. The researchers assume access to all agents’ activations, which they describe as a strong assumption. They also say they have not tested whether colluders aware of activation monitoring could hide their signals. On the more structurally varied Transfer tier, the best method for Llama-3.1-70B achieved 0.38 recall at a 1% false-positive rate, according to the paper. The authors say further work is needed to assess robustness and detection across different settings.