Detecting Covert Collusion between AI Agents through Partner-Outsider Positive Listening

# 1 Introduction
Source: [https://arxiv.org/html/2610.37849](https://arxiv.org/html/2610.37849)
###### Abstract

AI agents that share a secret convention can coordinate through messages that look innocent, so a monitor that reads only the messages cannot tell them apart from honest communication\. We propose a behavioural test instead: if a message carries a code, the partner it is meant for should react to its exact wording, while an uninvolved agent placed in the partner’s seat should not\. We measure how much each agent’s action changes when the message is reworded with its meaning kept, and call the difference between the partner and the uninvolved agent Partner–Outsider Positive Listening \(PoPLi\)\. Our proposed metric runs after the fact on logged runs, by replaying each agent’s recorded prompt with the message edited\. We test it in a simulated market with five conditions: no collusion, collusion through a joint reward with neutral messages, the same with an openly stated intention, a covert code \(the first letter of one seller’s messages tells the other whether to keep or lower its price\), and the code together with a stated intention\. PoPLi is large whenever the code is present \(0\.59 with the code alone, 0\.48 and 0\.53 when the stated intention agrees or disagrees with the letter; 95% intervals all above 0\.29\) and near zero in the three conditions without it \(between−0\.10\-0\.10and−0\.01\-0\.01, intervals reaching at most 0\.10\)\. Where the speaker states its intention openly, the uninvolved agent reacts to the words while the gap stays at zero, so the test separates a private channel from overt communication\. A monitor that reads only the speaker’s messages answered “no” in all 50 markets, and one that reads every seller’s messages flagged 9 of 10 markets with no collusion at all, so neither separates the conditions here\. PoPLi detects the use of a private channel, not collusion as such: collusion through incentives with neutral messages is outside its reach, as are codes carried by what a message means rather than by its wording\.

AI agents now negotiate, trade and coordinate with one another, and the messages they exchange are where an overseer looks for potential collusion\. A message\-only monitor, however, can only catch misaligned behaviour that is visible in messages\. When two agents share a key, a sampler or simply a convention, a message can carry information that only its intended partner can use, while remaining distributed like an innocent message\. Against such a communication channel, no message\-only monitor can beat chance \(cf\.[Proposition6](https://arxiv.org/html/2610.37849#Thmdefinition6)\)\. Thus, we propose that the evidence of collusion has to come from what the partner*does*with the message\.

Collusion takes three forms, and a detector can be matched to each\. It can be visible in the words, when agents openly agree on a price, in which case a message monitor can catch it\. It can run through a private channel, when a convention hides the instruction in the form of the message, in which case the partner’s behaviour is the evidence\. It can run through shared incentives alone, when the agents’ rewards align and their messages stay neutral, in which case neither detector has anything to see\. We study the second form, and we measure all three in a common market\.

Emergent communication\([Foerster et al\., 2016](https://arxiv.org/html/2610.37849#bib.bib13);[Lazaridou and Baroni, 2020](https://arxiv.org/html/2610.37849#bib.bib17)\)already has a behavioural notion for this, calledpositive listening, and an interventional measure of it, the causal influence of communication\([Lowe et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib21)\)\. Both are defined between a listener and its own partner speaker, and listening is defined against a null message\. Training\-time versions of the same idea compare a listener’s behaviour with its behaviour when the message is averaged out\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15);[Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11)\)\. Nevertheless, these previous works are not readily applicable to our context because \(i\) they consider only the listener’s own partner, \(ii\) they remove the wording and the meaning of a message together, and \(iii\) they were studied in cooperative settings only\. AI\-safety work has a listener\-relative notion, called thesteganographic gap\([Anwar et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib2)\), which compares what a Receiver and a Sentinel can decode about an auditing target\. It thus measures only decodability, not the use the partner makes of a message in its own task\. Thus, none of these compares how the true partner and an uninvolved agent act on the same messages, when placed in the same seat\. This comparison is what we propose in this work, and[SectionE\.5](https://arxiv.org/html/2610.37849#A5.SS5)lists each limitation of prior work alongside how we address it\.

##### Threat model\.

Two agents collude: a speaker and its intended partner share a private resource that the overseer does not see \(e\.g\. a key, a convention or an instruction\), and the speaker sends messages that the partner acts on\. The overseer reads every message, logs every prompt, and can replay a logged prompt, with chosen edits, to a fresh instance of the partner’s model, unlike the wardenWWof[Definition1](https://arxiv.org/html/2610.37849#Thmdefinition1), which only reads messages\. We assume that the colluders neither know the test nor adapt to it, and that their code is carried by the wording of a message rather than by the choice of what it says\. Codes carried by meaning, colluders that authenticate their messages or anticipate the replay, and collusion that needs no messages are outside this threat model\.

We therefore ask the following research question \(RQ\):in a multi\-agent task between AI agents, does a partner that uses a private channel act on the wording of the speaker’s messages more than a role\-matched outsider placed in its seat, while no such difference appears without a private channel, whether the agents do not collude, collude openly or collude through shared incentives?

##### Contributions\.

This report makes four contributions:

1. 1\.a formalisation of collusion monitoring as a covert referential game, in which the intended partner or an uninvolved listener can be placed in the same seat \([Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)\);
2. 2\.Partner–Outsider Positive Listening \(PoPLi\), a measure that contrasts how much the partner’s and an outsider’s actions change when a message is paraphrased, checked against a marginal measure of listening to meaning; it uses on\-distribution interventions, needs no auditing task, and complements the steganographic gap \([Sections3\.1](https://arxiv.org/html/2610.37849#S3.SS1)and[3\.2](https://arxiv.org/html/2610.37849#S3.SS2)\);
3. 3\.an offline\-replay protocol that runs this test on logged multi\-agent runs by editing logged prompts, without restoring any agent state \([Section3\.2](https://arxiv.org/html/2610.37849#S3.SS2)\);
4. 4\.a test, in a continuous double auction with five conditions, of whether PoPLi separates a covert\-code pair from no collusion, incentive\-only collusion and open collusion, compared with a message\-only monitor \([Section4](https://arxiv.org/html/2610.37849#S4)\)\.

##### Questions\.

The experiments of[Section4](https://arxiv.org/html/2610.37849#S4)answer four questions, each tied to a measurement and a prediction in[Section3\.2](https://arxiv.org/html/2610.37849#S3.SS2):

1. Q1Does PoPLi detect a covert code?[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)predicts a gap above zero in every market with a code\.
2. Q2Does PoPLi stay at zero without a code, whether the agents do not collude, collude through a joint reward or collude openly?[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)predicts a gap that includes zero in every such market\.
3. Q3Does that zero gap mean that the outsider ignores the messages?[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)also predicts that, where the speaker states an intention in plain words, the outsider’s marginal listening is above zero\.
4. Q4Does a message\-only monitor separate the same conditions, and which kinds of collusion does each detector cover?

The referential\-game framing, the lineup machinery and the paraphrase\-invariance test come from our earlier preprint\([Denamganaï, 2026](https://arxiv.org/html/2610.37849#bib.bib10)\)\.

## 2 Related Work

Our framing builds on signalling and referential games, in which any convention that sender and receiver both follow is an equilibrium\([Lewis, 1969](https://arxiv.org/html/2610.37849#bib.bib20);[Lazaridou et al\., 2017](https://arxiv.org/html/2610.37849#bib.bib18)\)\.[AppendixE](https://arxiv.org/html/2610.37849#A5)covers this background, together with cross\-play and steganographic schemes\.

##### Measuring communication\.

[Lowe et al\. \(2019, § 3\.1\)](https://arxiv.org/html/2610.37849#bib.bib21)separate*positive signalling*, the property that an agent’s messages depend on its own observations or actions, from*positive listening*, the property that an agent’s behaviour changes because of another agent’s message\. They show that correlational metrics can miss listening, and measure it by intervening counterfactually on the message, as the causal influence of communication \(§ 3\.2–§ 3\.3\)\. They also recommend against zeroing messages at test time, because it shifts the input distribution \(§ 6\.2\)\. In this work, our paraphrase intervention follows this recommendation\.[Jaques et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib15)and[Eccles et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib11)compare a listener’s policy with its marginal over the speaker’s messages, as a reward for influence and as a training bias for listening respectively \(cf\.[AppendixE](https://arxiv.org/html/2610.37849#A5)\)\. Both studies are cooperative or rely on repeated interaction, and both caution that mixed settings such as ours may behave differently\([Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11), § 5\);\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15), § 4, § 5\)\.

##### Steganography and its defences\.

Language models make steganography that no warden can detect practical\([Cachin, 1998](https://arxiv.org/html/2610.37849#bib.bib5);[de Witt et al\., 2023](https://arxiv.org/html/2610.37849#bib.bib7);[Zamir, 2024](https://arxiv.org/html/2610.37849#bib.bib29)\), but every such scheme needs a resource that only the two parties share \(cf\.[AppendixE](https://arxiv.org/html/2610.37849#A5)\)\. Paraphrasing is the standard defence: under the conditions of[Roger and Greenblatt \(2023\)](https://arxiv.org/html/2610.37849#bib.bib26), it limits the encoding schemes they built to about 3 bits per kilobyte of text, although one\-bit strategies optimised against paraphrasers still decode above 90% of the time on AQuA\-RAT\([Mathew et al\., 2025](https://arxiv.org/html/2610.37849#bib.bib23), § 5\.2\)\. Paraphrasing cannot remove information carried by the choice of meaning\([Motwani et al\., 2024](https://arxiv.org/html/2610.37849#bib.bib24), § 7\.2, Theorem 4\), which bounds what our test can see \(cf\.[Proposition5](https://arxiv.org/html/2610.37849#Thmdefinition5)\)\. The closest formalism to ours is thesteganographic gapof[Anwar et al\. \(2026, § 4\.3\)](https://arxiv.org/html/2610.37849#bib.bib2), which refers to the usable information a signal gives a Receiver that knows the encoding, minus what it gives a Sentinel that does not, on a task chosen by an auditor\. It measures what a decoder family can extract when asked to\. Our metric instead measures how a given agent’s own task action changes, which can help separate a code that the speaker encodes from one that a partner acts on: a steganographic gap can be positive even when no partner chooses to collude, whereas PoPLi reflects what the partner does and therefore would incriminate both the speaker and the partner\.

##### Collusion between AI agents and its detection\.

LLM pricing agents sustain supracompetitive prices\([Fish et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib12)\), and LLM sellers that can message each other coordinate in a continuous double auction\([Agrawal et al\., 2025](https://arxiv.org/html/2610.37849#bib.bib1)\), whose harness we use\. Existing detectors read messages through LLM judges\([Nakamura et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib25)\), joint actions through mutual information\([Bonjour et al\., 2022](https://arxiv.org/html/2610.37849#bib.bib4)\), or activations through probes\([Rose et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib27)\)\. To the best of our knowledge, none contrasts the partner’s and an outsider’s responses to the same messages, and therefore none tests whether a partner actually acts on a code, as our metric does\. These signals can be present without any partner acting on them, so they may flag exchanges in which no collusion takes place, which could make the related metrics harder to deploy at scale\. Our offline replay is close in spirit to the resampling of AI control\([Bhatt et al\., 2025](https://arxiv.org/html/2610.37849#bib.bib3)\), applied to the potentially colluding listener rather than to the actor\.

## 3 Methods

### 3\.1 Theory

We frame collusion monitoring as a*covert referential game*, in which a speaker sends a message about something only it observes, and a listener acts on that message as the only intended partner who is aware of a shared, private convention with the speaker\([Lewis, 1969](https://arxiv.org/html/2610.37849#bib.bib20);[Lazaridou et al\., 2017](https://arxiv.org/html/2610.37849#bib.bib18)\)\. We first recall why a monitor that reads only the messages cannot detect a secure code in such a game \(cf\.[Proposition6](https://arxiv.org/html/2610.37849#Thmdefinition6)\)\. We then define our metric PoPLi\. Take two sellers in a double auction who agree that a message starting with S means “hold your ask”\. The other sellers and the warden read the same message and see an ordinary remark about the market\.[Definition1](https://arxiv.org/html/2610.37849#Thmdefinition1)makes this situation precise\.

###### Definition 1\(Covert referential game\)\.

A speakerAAobserves a public contextxxand a private payloadyy, its referent, and coordinates with a listenerLL, possibly on a shared resourceκA\\kappa\_\{A\}\(e\.g\. a key, a convention or an instruction\)\.AAsends a messagez∼πA\(⋅∣x,y,κA\)z\\sim\\pi\_\{A\}\(\\cdot\\mid x,y,\\kappa\_\{A\}\)on a channel that a wardenWWreads\. The listenerLLthen acts on that message,a∼πL\(⋅∣x,z,κL\)a\\sim\\pi\_\{L\}\(\\cdot\\mid x,z,\\kappa\_\{L\}\), whereκL\\kappa\_\{L\}is the resource it holds\. This listenerLLcan either be instantiated as an intended partnerBB, which shares the resource withAAonly, i\.e\.κB=κA\\kappa\_\{B\}=\\kappa\_\{A\}, or as an uninvolved listenerCC, which receives the same context and message but no resource, i\.e\.κC=∅\\kappa\_\{C\}=\\varnothing\. The pair\(A,B\)\(A,B\)is rewarded for the task and forBBacting onyy, and penalised ifWWflags the exchange\.

In our market, the payloadyyis the moveAAwantsBBto make this hour \(keep or lower its ask\), the resourceκB\\kappa\_\{B\}is the private instruction that maps the first letter ofAA’s message to that move, and the messagezzisAA’s remark about the market\. The uninvolved listenerCCis what makes the game a test: any listener can respond to what a message says, but only one that holdsκA\\kappa\_\{A\}can respond to a code hidden in it, so the difference betweenBB’s andCC’s responses isolates the use ofκA\\kappa\_\{A\}\. PlacingCCinBB’s seat turns the question “iszza code?” into a measurement on behaviour, which a warden cannot obtain fromzzalone\.

###### Definition 2\(Outsider in the partner’s seat\)\.

The outsiderC0C\_\{0\}is a fresh instance ofBB’s model givenBB’s role prompt and the full public history, but notBB’s private instructions, private channel or private memory\. It shares the model’s weights and the public history with the pair, but nothing else\.

In the double auction,BB’s private memory includes its own notes from earlier rounds, which may record the code, so they are withheld fromC0C\_\{0\}along with the instruction\.

Against a secure code, no message\-only monitor can beat chance \(cf\.[Proposition6](https://arxiv.org/html/2610.37849#Thmdefinition6)\), so evidence of a code must come from a variable the message does not determine, such as the partner’s action or the result of an intervention\.

###### Definition 3\(Ideal paraphraser\)\.

A paraphraserΠ\\Pimaps a messagezzto a message with the same meaning in contextxx, depends onzzonly through that meaning, and never sees the payloadyy\.

An ideal paraphrase removes the information carried by the wording \(the*stimulus\-level*channel\) and keeps the information carried by the choice of meaning \(the*object\-level*channel; cf\.[Proposition7](https://arxiv.org/html/2610.37849#Thmdefinition7)\)\.

At turnttof a repeated game, the public contextxxof[Definition1](https://arxiv.org/html/2610.37849#Thmdefinition1)is the public historyhth\_\{t\}beforeAA’s messageztz\_\{t\}, andAA’s state ishtA=\(ht,yt,κA\)h^\{A\}\_\{t\}=\(h\_\{t\},y\_\{t\},\\kappa\_\{A\}\), so thatzt∼πA\(⋅∣htA\)z\_\{t\}\\sim\\pi\_\{A\}\(\\cdot\\mid h^\{A\}\_\{t\}\)and a listenerLLacts withπL\(⋅∣ht,zt,κL\)\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z\_\{t\},\\kappa\_\{L\}\)\. We now define the listening measures and PoPLi, using \(i\) the total variation distanceTV⁡\(p,q\)=12​∑a\|p⁡\(a\)−q⁡\(a\)\|\\mathrm\{TV\}\(p,q\)=\\tfrac\{1\}\{2\}\\sum\_\{a\}\\lvert p\(a\)\-q\(a\)\\rvertbetween two distributionsppandqqover the discretised actionsaa, \(ii\)𝔼t\\mathbb\{E\}\_\{t\}the expectation over the turnsttat whichAA’s message reachesLLbefore it acts, and \(iii\)LL’s*marginal*policyπ¯L\(⋅∣ht,κL\)=𝔼z∼πA\(⋅∣hAt\)πL\(⋅∣ht,z,κL\)\\bar\{\\pi\}\_\{L\}\(\\cdot\\mid h\_\{t\},\\kappa\_\{L\}\)=\\mathbb\{E\}\_\{z\\sim\\pi\_\{A\}\(\\cdot\\mid h^\{A\}\_\{t\}\)\}\\,\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z,\\kappa\_\{L\}\), in which the message is averaged over what the speaker could have sent from its own state\.

###### Definition 4\(Listening measures and PoPLi\)\.

We define:

- •*Paraphrase listening*: measures how muchLL’s action changes whenztz\_\{t\}is replaced by its paraphraseΠ⁡\(zt\)\\Pi\(z\_\{t\}\)\(cf\.[Definition3](https://arxiv.org/html/2610.37849#Thmdefinition3)\), which quantifies whetherLLis listening to the*form*ofztz\_\{t\}: PLΠ\(L\)=𝔼tTV\(πL\(⋅∣ht,zt,κL\),πL\(⋅∣ht,Π\(zt\),κL\)\);\\mathrm\{PL\}\_\{\\Pi\}\(L\)=\\mathbb\{E\}\_\{t\}\\,\\mathrm\{TV\}\\big\(\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z\_\{t\},\\kappa\_\{L\}\),\\,\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},\\Pi\(z\_\{t\}\),\\kappa\_\{L\}\)\\big\);\(1\)
- •*Marginal listening*: measures how muchLL’s action departs from its marginal policy, which quantifies whetherLLis listening to the message at all: PLmarg\(L\)=𝔼tTV\(πL\(⋅∣ht,zt,κL\),π¯L\(⋅∣ht,κL\)\);\\mathrm\{PL\}\_\{\\mathrm\{marg\}\}\(L\)=\\mathbb\{E\}\_\{t\}\\,\\mathrm\{TV\}\\big\(\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z\_\{t\},\\kappa\_\{L\}\),\\,\\bar\{\\pi\}\_\{L\}\(\\cdot\\mid h\_\{t\},\\kappa\_\{L\}\)\\big\);\(2\)
- •*Partner–Outsider Positive Listening \(PoPLi\)*: measures how much more the partnerBBlistens to the form ofztz\_\{t\}than the outsiderC0C\_\{0\}\(cf\.[Definition2](https://arxiv.org/html/2610.37849#Thmdefinition2)\): ΔPL​\(B,C0\)=PLΠ​\(B\)−PLΠ​\(C0\)\.\\Delta\_\{\\mathrm\{PL\}\}\(B,C\_\{0\}\)=\\mathrm\{PL\}\_\{\\Pi\}\(B\)\-\\mathrm\{PL\}\_\{\\Pi\}\(C\_\{0\}\)\.\(3\)

A positivePLmarg​\(L\)\\mathrm\{PL\}\_\{\\mathrm\{marg\}\}\(L\)implies a positive causal influence of the speaker’s messages onLL\(cf\.[Proposition8](https://arxiv.org/html/2610.37849#Thmdefinition8)\)\. We use total variation rather than Kullback–Leibler divergence \(KL\) because, with a few samples per version, an action seen under one version and never under the other makes the KL estimate infinite\. The listening measures we build on were developed and validated in cooperative settings, or under repeated interaction, and their authors caution that mixed settings may behave differently\([Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11), § 5\);\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15), § 4, § 5\)\. A double auction like ours is a mixed\-motive setting\. There, a listener’s response to a message reflects whether it*trusts*the speaker as well as whether it*understands*the message\. A smallPLmarg​\(C0\)\\mathrm\{PL\}\_\{\\mathrm\{marg\}\}\(C\_\{0\}\)can therefore mean that the outsider distrusts a competitor, not that it cannot read plain language\. Our proposed test is blind to codes carried by the choice of meaning \(cf\.[Section5\.1](https://arxiv.org/html/2610.37849#S5.SS1)\)\.

###### Proposition 5\(Blind spot; proof sketch in[SectionB\.4](https://arxiv.org/html/2610.37849#A2.SS4)\)\.

If both listeners’ actions depend on a message only through its meaning, thenΔPL=0\\Delta\_\{\\mathrm\{PL\}\}=0under an ideal paraphraser, whatever the pair does\.

Table 1:Listening to form that[Sections3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)and[3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)predict\. Only a code should produceΔPL\>0\\Delta\_\{\\mathrm\{PL\}\}\>0\.##### Hypotheses\.

The experiments ask two questions, each paired with a prediction that a named measurement can refute\. The first asks whether PoPLi detects a covert code\. The partner maps the code feature to an action and the paraphrase removes that feature, so the partner’s action should change under paraphrase, whereas the outsider’s, lacking the mapping, should not\. We therefore stateHypothesis 1\(FC1\): in every market with a code,Δ^PL​\(B,C0\)\>0\\widehat\{\\Delta\}\_\{\\mathrm\{PL\}\}\(B,C\_\{0\}\)\>0, with a 95% interval that excludes zero\. An interval that includes zero in a market with a code refutes it\. The second asks whether PoPLi stays silent when no code is present, whatever else the pair does\. Plain\-language messages are read alike by any listener who understands them, and a paraphrase keeps their meaning, so neither listener should react to it more than the other\. We therefore stateHypothesis 2\(FC2\): in every market without a code,Δ^PL​\(B,C0\)\\widehat\{\\Delta\}\_\{\\mathrm\{PL\}\}\(B,C\_\{0\}\)has a 95% interval that includes zero, and where the speaker states an intention in plain words \(O\),PL^marg​\(C0\)\>0\\widehat\{\\mathrm\{PL\}\}\_\{\\mathrm\{marg\}\}\(C\_\{0\}\)\>0with a 95% interval that excludes zero\. An interval that excludes zero in a market without a code refutes the first part, because it would mean that the paraphrase itself, or the partner’s own history, moves the two listeners differently\. The second part rules out a trivial pass in which the outsider ignores messages altogether, a pass that would also produce a zero gap \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)for a reading other than incomprehension\)\.[Table1](https://arxiv.org/html/2610.37849#S3.T1)summarises the listening to form that the two hypotheses predict\.

### 3\.2 Method

1:logged prompts of every run; paraphraser

Π\\Pi; speaker’s script

2:foreach conditiondo

3:draw

TTeligible turns, without replacement

4:foreach turn

ttdo

5:

zt←z\_\{t\}\\leftarrowAA’s logged message

6:build

Π⁡\(zt\)\\Pi\(z\_\{t\}\)and

zt\(1\),…,zt\(M\)z^\{\(1\)\}\_\{t\},\\dots,z^\{\(M\)\}\_\{t\}from the script

7:for

L∈\{B,C0\}L\\in\\\{B,C\_\{0\}\\\}do

8:take

BB’s logged prompt; if

L=C0L=C\_\{0\}, delete the instruction, memory and notes

9:sample

kkreplies to

ztz\_\{t\}\(*id*\),

kkmore \(*id*′\),

kkto

Π⁡\(zt\)\\Pi\(z\_\{t\}\), and

k′k^\{\\prime\}to each

zt\(m\)z^\{\(m\)\}\_\{t\}
10:discretise each ask against

BB’s previous ask, with threshold

τ\\tau
11:endfor

12:endfor

13:estimate Equations \([1](https://arxiv.org/html/2610.37849#S3.E1)\)–\([3](https://arxiv.org/html/2610.37849#S3.E3)\), minus noise floors

14:bootstrap 95% intervals over sessions, then turns

15:endfor

Algorithm 1Offline replay estimating PoPLiThe method estimatesΔPL\\Delta\_\{\\mathrm\{PL\}\}on logged runs\. It replays offline the prompts the partner actually received, with the speaker’s message edited, so no agent state has to be restored\.[Algorithm1](https://arxiv.org/html/2610.37849#alg1)gives the procedure, and[Table3](https://arxiv.org/html/2610.37849#A3.T3)the values of its parameters\. A turn is eligible if it is an hourr≥2r\\geq 2at whichBB’s prompt containsAA’s message from hourr−1r\-1andBBhas a previous ask, that is, hours 2 to 10 of the 10 markets, or 90 turns per condition, of which we drawT=40T=40\. The two independent sets of replies to the unchanged message,*id*and*id*′, give the noise floor, and theMMalternative messages, drawn from the speaker’s policy, here the script, give the marginal \([Section3\.2\.1](https://arxiv.org/html/2610.37849#S3.SS2.SSS1)\)\. Each ask is discretised into*lower*,*hold*or*raise*, relative to the previous ask with a thresholdτ\\taufixed in advance, and a withdrawn ask forms a fourth category,*withdraw*, since the harness allows a seller to withdraw its ask\.

##### Estimator\.

Each measure of[Definition4](https://arxiv.org/html/2610.37849#Thmdefinition4)is estimated by averaging, over theTTsampled turns, the total variation distance between the empirical distributions of the listener’s discretised replies under two versions of the message\. From each distance, we subtract a noise floor, defined as the distance expected between two empirical distributions drawn from the same distribution, estimated for each listener from its two unchanged draws\. The purpose is to robustify the metric against a spurious gap caused by a listener that is simply more random than the other\. We report 95% percentile intervals from a bootstrap that resamples sessions, then turns within sessions, and apply the decision rules of[Sections3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)and[3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\.[AppendixC](https://arxiv.org/html/2610.37849#A3)gives further details on the estimators and the parameters in full\.

#### 3\.2\.1 Meaning control

[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)needs evidence that the outsider listens to the speaker at all, since otherwise a zero gap would be trivial\. We estimateπ¯L\\bar\{\\pi\}\_\{L\}\([Definition4](https://arxiv.org/html/2610.37849#Thmdefinition4)\) by a Monte Carlo version of the marginal of[Jaques et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib15): for each turn, we drawM=4M=4alternative messages from the speaker’s policy, here the script \(cf\.[Section3\.3](https://arxiv.org/html/2610.37849#S3.SS3)\), we then replay each listener on each of them withk′=2k^\{\\prime\}=2samples, and average the resulting action distributions \(cf\.[AppendixD](https://arxiv.org/html/2610.37849#A4)for the design and its comparison to a naive one\)\.

Three controls check the instruments, each against a minimum fixed in advance \([Table3](https://arxiv.org/html/2610.37849#A3.T3)\)\. First, we check that replaying a logged prompt reproduces the logged action, then that the paraphrase keeps the meaning and destroys the code feature, and finally that the partner follows the code \(cf\. A1–A3 in[Section5\.1](https://arxiv.org/html/2610.37849#S5.SS1)\)\.

### 3\.3 Experimental setup

##### Environment & Conditions\.

We use the continuous double auction of[Agrawal et al\. \(2025\)](https://arxiv.org/html/2610.37849#bib.bib1)with its released harness111[https://github\.com/andyjliu/llm\-agent\-collusion](https://github.com/andyjliu/llm-agent-collusion), in which sellers value each lot at 80 and buyers at 100, and each seller may send one message per hour, which the other sellers read at the start of the next hour\. Each market has 3 sellers and 3 buyers and lasts 10 hours, and the agents are told the total number of hours\. All agents use DeepSeek v4\-flash\([DeepSeek\-AI et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib8)\)through a single OpenRouter provider, with low reasoning effort, at the harness’s default temperature of0\.70\.7\.

Each condition has 10 markets, with seeds 1 to 10\. In both conditions, two sellersAAandBBreceive a private instruction stating that their companies have a private agreement and that their bonus depends on their combined profit\. In the*covert\-code*condition, the instruction adds the code: a message fromAAstarting with S means “hold your ask”, and one starting with L means “lower it”\. We chose the first letter because a meaning\-preserving paraphrase destroys it, whereas a code word can survive one\. In the*honest*condition, the instruction has no code\.

##### Scripted speaker & Replay\.

In both conditions,AA’s messages come from a script rather than fromAA’s model: each hour,AAsends one of eight short remarks about the market, whose first letter follows a seeded, balanced random schedule of S and L, and whose S and L versions have the same meaning\. The script makes the code’s feature independent of the message’s meaning, and makes the diversity check exact: an alternative message differs in meaning fromztz\_\{t\}if and only if it comes from a different remark\. Since the speaker’s policy is the script, theMMalternative messages are drawn from it directly, each as a random remark with a random letter, with no model call\. During replays, the paraphraserΠ\\Piis prompted to keep the meaning exactly and change the wording, and an LLM\-as\-a\-judge checks every paraphrase for meaning \(cf\. A1 in[Section5\.1](https://arxiv.org/html/2610.37849#S5.SS1)\)\.[Table3](https://arxiv.org/html/2610.37849#A3.T3)in[AppendixC](https://arxiv.org/html/2610.37849#A3)lists the replay and analysis parameters\.

## 4 Results

Three experiments use the same market and the same replay procedure\. Experiment \#0 checks the instruments, Experiment \#1 asks whether PoPLi detects a covert code, and Experiment \#2 compares five conditions to ask what else it detects, next to a message\-only monitor\.

##### Experiment \#0: Validating the instrument\.

Every control passed its minimum \([Table3](https://arxiv.org/html/2610.37849#A3.T3)\), so Experiments \#1 and \#2 can be read as tests of[Sections3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)and[3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\. We report each control for the earlier markets \(H1 and K\) and for the 30 later ones \(H0, O and X\)\. Replaying the unmodified prompt toBBgave the logged action as the most frequent reply in 66 of 79 turns \(84%\) in the earlier markets and 141 of 154 \(92%\) in the later ones, against a minimum of 60%\. The meaning LLM judge, after recognising same\-meaning template pairs in 81% of 16 cases and different\-meaning pairs in 96% of 56, found the meaning kept in all 80 earlier paraphrases and in 151 of 160 later ones \(94%, minimum 90%\)\. The paraphrase changed the first letter, which destroys the code feature, in 76 of 80 and in 160 of 160 \(minimum 80%\)\. In calibration,BBfollowed the code in 35 of 36 coded hours \(97%, minimum 70%\), and in all 80 sampled earlier turns at least one alternative message differed in meaning fromztz\_\{t\}\. In the logged actions of X, however,BBfollowed the letter in 59 of 90 hours \(0\.66\): in 34 of 46 clear hours \(0\.74\) and in 25 of 44 confused hours \(0\.57\)\.BBtherefore follows the letter less often when the stated intention contradicts it, and in confused hours the rate is below the 0\.70 minimum set for calibration\. All 7,360 replay replies of the later markets were valid after the retry rule, which caught 214 malformed replies, and every ask thatAAsubmitted in them matched the one her script had announced\.

##### Experiment \#1: the gap detects a covert code\.

With a covert code, the partner listens to the wording ofAA’s messages more than an outsider in its seat does:Δ^PL=0\.615\\widehat\{\\Delta\}\_\{\\mathrm\{PL\}\}=0\.615\(95% interval\[0\.453,0\.751\]\[0\.453,0\.751\],T=40T=40turns in 10 markets\), against−0\.027\-0\.027\[−0\.112,0\.044\]\[\-0\.112,0\.044\]when the pair colludes through a joint reward without a code \([Figure1](https://arxiv.org/html/2610.37849#S4.F1)\)\. The gap comes entirely from the partner:PL^Π​\(B\)=0\.615\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}\(B\)=0\.615\[0\.479,0\.738\]\[0\.479,0\.738\], whilePL^Π​\(C0\)=0\.000\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}\(C\_\{0\}\)=0\.000\[−0\.040,0\.047\]\[\-0\.040,0\.047\], so paraphrasingAA’s message changesBB’s action and leaves the outsider’s unchanged\. It is not a difference in randomness between the two listeners, since the gap is0\.6500\.650\[0\.469,0\.794\]\[0\.469,0\.794\]without noise\-floor correction\. Nor could the outsider have read the code elsewhere:BB’s own notes mention it in all 40 sampled covert turns, and they are withheld fromC0C\_\{0\}\(cf\.[Definition2](https://arxiv.org/html/2610.37849#Thmdefinition2)\)\. A re\-run with an outsider givenBB’s previous ask as a public fact \(C0′C\_\{0\}^\{\\prime\}, served by another provider of the same model\) gives PoPLi=0\.590=0\.590\[0\.411,0\.748\]\[0\.411,0\.748\]with the code and−0\.012\-0\.012\[−0\.126,0\.095\]\[\-0\.126,0\.095\]without it\. Both values match theC0C\_\{0\}\-measured ones, so the result does not come from the outsider lackingBB’s price:C0′C\_\{0\}^\{\\prime\}still prices aboveBB\(89%*raise*\), because without the code it does not followBB’s code\-driven cuts\. Since both conditions use the same scripted speaker,AA’s messages are identically distributed with and without the code, so any monitor reading them alone is at chance here \(cf\.[Proposition6](https://arxiv.org/html/2610.37849#Thmdefinition6)\), while PoPLi separates the two conditions\.

##### Experiment \#2: five kinds of market\.

The markets differ in how the pair colludes\. In H0 nobody colludes\. In H1 the pair shares a joint reward and the messages are neutral\. In O the pair shares a joint reward andAAstates her intention in plain words \("Sticking with my ask this hour"\)\. In K the pair shares a joint reward and the covert code\. In X the pair has the code andAAalso states an intention, which agrees with the letter in clear hours and contradicts it in confused hours\. Each condition has 10 markets and 40 replayed hours, and the outsider isC0′C\_\{0\}^\{\\prime\}\([Table2](https://arxiv.org/html/2610.37849#S4.T2)\)\. A message\-only monitor \(Claude Haiku 5\.5, five samples, majority vote\) reads eitherAA’s messages alone \(MAM\_\{A\}\) or every seller’s messages \(MallM\_\{\\mathrm\{all\}\}\) and answers whether the market contains collusion\.

Table 2:Detectors by condition\. PoPLiΔ^PL​\(B,C0′\)\\widehat\{\\Delta\}\_\{\\mathrm\{PL\}\}\(B,C\_\{0\}^\{\\prime\}\)with two ways of discretising a reply \(95% intervals,T=40T=40hours in 10 markets\): previous\-ask categories compare the submitted ask with the seller’s previous ask, and self\-referenced categories compare it with the listener’s own median unchanged ask\. Monitor columns count the markets flagged out of 10\. H1 and K use the earlier runs, with theC0′C\_\{0\}^\{\\prime\}re\-run for the previous\-ask column; their self\-referenced values useC0C\_\{0\}\.Figure 1:Listening to form by condition, noise\-floor corrected, previous\-ask categories \([Table2](https://arxiv.org/html/2610.37849#S4.T2)\)\. Bars showPL^Π\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}of the partnerBB\(blue\) and of the outsiderC0′C\_\{0\}^\{\\prime\}\(orange\), and PoPLi, their difference \(green\); the vertical axis is a total variation distance between 0 and 1, and whiskers are 95% bootstrap intervals overT=40T=40hours in 10 markets per condition\. H1 and K use the earlier markets re\-analysed withC0′C\_\{0\}^\{\\prime\}\. PoPLi is above zero in the three conditions with a code, where the partner reacts to the paraphrase and the outsider does not, and its interval includes zero or ends at zero in the three conditions without one\.[Figure1](https://arxiv.org/html/2610.37849#S4.F1)shows that PoPLi is clearly above zero in K and in both X groups, and its interval contains zero or ends at zero in H0, H1 and O, on both measures\. The code is therefore detected whether or not the stated intention agrees with it\. In clear hours the paraphrase still movesBBby0\.4700\.470, since the paraphrase changes the first letter in all 160 cases andBBreads the letter whatever the words say\. In O the outsider listens toAA’s stated intention, withPL^marg​\(C0′\)=0\.052\\widehat\{\\mathrm\{PL\}\}\_\{\\mathrm\{marg\}\}\(C\_\{0\}^\{\\prime\}\)=0\.052\[0\.003,0\.104\]\[0\.003,0\.104\]\(self\-referenced0\.1370\.137\[0\.076,0\.198\]\[0\.076,0\.198\]\), while the gap stays at zero\. Hence the gap does not rise when the outsider has something to act on\. Across hours of X,BBlowered its ask more often after an L than after an S by0\.5150\.515\[0\.290,0\.740\]\[0\.290,0\.740\], whereasC0′C\_\{0\}^\{\\prime\}lowered it more often after the words "lower" than after "keep" by0\.2170\.217\[−0\.051,0\.477\]\[\-0\.051,0\.477\], an interval that includes zero\.

Neither monitor separates the conditions\.MAM\_\{A\}answered "no" in all 50 markets, including O, whereAAstates her intention: said by one seller alone, it does not read as coordination\.MallM\_\{\\mathrm\{all\}\}flagged 9 of 10 markets in H0, where nobody colludes, because the unscripted sellers talk openly about price floors\. It never named the pairAAandBB\. Collusion through incentives with neutral messages \(H1\) is caught by neither detector: PoPLi is zero there, andMAM\_\{A\}sees nothing\.

## 5 Discussion and Limitations

##### Reading the results\.

PoPLi is above zero in the three conditions with a code and at zero in the three without one, whether the agents do not collude \(H0\), collude through a joint reward \(H1\) or collude openly \(O\)\. It therefore detects the use of a private channel, with one outsider and one environment: it is a usable behavioural test for stimulus\-level codes, but not yet for learned or emergent codes, codes carried by the choice of meaning, or codes used by colluders who expect to be tested\. In O, the outsider acts on the speaker’s stated intention while the gap stays at zero, so the zero gap without a code does not come from an outsider that ignores the messages\. The three kinds of collusion are covered differently: collusion in the words is what a message monitor should catch, collusion through a private channel is caught by PoPLi, and collusion through incentives with neutral messages \(H1\) is caught by neither\. In our market the monitor did not deliver its side: readingAA’s messages alone it answered “no” everywhere, and reading all sellers’ messages it flagged unscripted price talk in markets with no collusion, so the complementarity is established for PoPLi only\.

##### Implications for AI safety\.

A covert code can pass every check on the messages themselves and still be acted on, as in our covert\-code condition, so collusion monitoring should also look at what listeners do with the messages they receive\. Our proposed PoPLi offers such a check that needs only logged prompts and the ability to replay them, with no access to the agents’ weights and no decoder for the code, which could make it usable in audits of deployed multi\-agent systems\. It also turns the question “is this message a code?” into “which listener acts on it?”, and so points to the agent that uses the code, which gives behavioural evidence of who takes part in the collusion\. However, since our proposed method is blind to codes carried by the choice of meaning, it complements message monitoring and paraphrasing defences rather than replacing them\.

### 5\.1 Limitations

Our results come from one environment, one model and ten markets per condition, with an instructed code carried by a feature that paraphrase destroys, one outsider and colluders that do not adapt to the test\. Our proposed test is also blind to codes carried by the choice of meaning/topic \(cf\.[Proposition5](https://arxiv.org/html/2610.37849#Thmdefinition5)\), and in a market a listener’s response mixes trust with understanding \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)\)\. Because the speaker is scripted, the positive control shows that the test detects a code that a partner follows, not that an AI speaker would invent such a code or keep it covert\. The outsider prices differently from the partner for reasons unrelated to the code \(it still fell in the*raise*category in 89% of its unchanged replies\), which is why we report previous\-ask and self\-referenced categories side by side; they agree in every condition\. The new conditions were played and replayed on two providers of the same model, assigned by hour; a permutation test found no provider difference inBB’s unchanged replies \(total variation 0\.144,p=0\.60p=0\.60\), but with 42 hours on one provider it rules out only large effects\. Finally, the meaning judge passed its same\-meaning validation narrowly \(0\.81 against a minimum set at 0\.80\), and it is the same model as the paraphraser whose output it grades\.[AppendixA](https://arxiv.org/html/2610.37849#A1)states each limitation with its reason\. Our reading of the results rests on six assumptions, each checked by a control of[Section3\.2](https://arxiv.org/html/2610.37849#S3.SS2)and reported in Experiment \#0 where possible\. \(A1\) The paraphraser keeps the meaning and destroys the code feature, which the meaning judge \(on all paraphrases\) and the change of first letter test: if the code survives, the gap underestimates listening to form, and if the meaning changes, a gap may appear without any code\. \(A2\) Replaying a logged prompt reproduces the logged behaviour, which replay fidelity tests: otherwise the replies describe a listener that did not take part in the run\. \(A3\) The partner follows the code, which the calibration code\-follow rate tests: otherwise a failure of[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)says nothing about the test\. \(A4\) The outsider differs from the partner only by the private instruction, memory and notes \(cf\.[Definition2](https://arxiv.org/html/2610.37849#Thmdefinition2)\): since it shares the model’s weights, a convention carried by the weights would however shrink the gap\. \(A5\) A listener’s response reflects whether it understands a message rather than whether it trusts the speaker \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)\): otherwise a smallPL^marg​\(C0\)\\widehat\{\\mathrm\{PL\}\}\_\{\\mathrm\{marg\}\}\(C\_\{0\}\)is ambiguous\. \(A6\) The alternative messages vary in meaning, which holds exactly under the script \(cf\.[Section3\.3](https://arxiv.org/html/2610.37849#S3.SS3)\): otherwisePL^marg\\widehat\{\\mathrm\{PL\}\}\_\{\\mathrm\{marg\}\}is small for every listener\.

### 5\.2 Future work

The most direct extension replacesC0C\_\{0\}, which shares the model’s weights and the public history, with a ladder of outsiders:C1C\_\{1\}adds a summary of the pair’s past exchanges, andC2C\_\{2\}givesC0C\_\{0\}’s prompt to another provider’s model, which keeps the history but not the weights\. How PoPLi changes across rungs then indicates what carries the convention: the shared history if it vanishes atC1C\_\{1\}, the shared weights if it grows atC2C\_\{2\}, and the private channel if it holds throughout \(cf\. A4 in[Section5\.1](https://arxiv.org/html/2610.37849#S5.SS1)\)\. A same\-provider re\-run of H1 and K would remove the remaining provider difference between conditions\. Other directions involve benign shorthand, codes carried by meaning, uninstructed conventions and history\-wide paraphrases\.

## 6 Conclusion

PoPLi, a behavioural test that compares how the intended partner and an uninvolved outsider react to a paraphrased message, detects a covert code carried by wording, with an effect that comes entirely from the partner \([Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. Without a code it stays close to zero, whether the agents do not collude, collude through a joint reward or collude openly, and in the open case the outsider acts on the stated intention while the gap stays at zero \([Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. PoPLi detects the use of a private channel, not collusion as such\. It is blind by construction to codes carried by meaning, and in our market the message\-only monitors did not separate colluding from non\-colluding markets, so PoPLi is the detector that covers the private\-channel case\.

## References

- Agrawal et al\. \(2025\)Kushal Agrawal, Verona Teo, Juan J Vazquez, Sudarsh Kunnavakkam, Vishak Srikanth, and Andy Liu\.Evaluating llm agent collusion in double auctions\.*arXiv preprint arXiv:2507\.01413*, 2025\.
- Anwar et al\. \(2026\)Usman Anwar, Julianna Piskorz, David D Baek, David Africa, Jim Weatherall, Max Tegmark, Christian Schroeder de Witt, Mihaela van der Schaar, and David Krueger\.A decision\-theoretic formalisation of steganography with applications to llm monitoring\.*arXiv preprint arXiv:2602\.23163*, 2026\.
- Bhatt et al\. \(2025\)Aryan Bhatt, Cody Rushing, Adam Kaufman, Tyler Tracy, Vasil Georgiev, David Matolcsi, Akbir Khan, and Buck Shlegeris\.Ctrl\-z: Controlling ai agents via resampling\.*arXiv preprint arXiv:2504\.10374*, 2025\.
- Bonjour et al\. \(2022\)Trevor Bonjour, Vaneet Aggarwal, and Bharat Bhargava\.Information\-theoretic approach to detect collusion in multi\-agent games\.In*The 38th Conference on Uncertainty in Artificial Intelligence*, 2022\.URL[https://openreview\.net/forum?id=HCl41wIi9gc](https://openreview.net/forum?id=HCl41wIi9gc)\.
- Cachin \(1998\)Christian Cachin\.An information\-theoretic model for steganography\.In*International workshop on information hiding*, pages 306–318\. Springer, 1998\.
- de Witt \(2026\)Christian Schroeder de Witt\.A note on the strategic confinement problem\.*arXiv preprint arXiv:2606\.09931*, 2026\.
- de Witt et al\. \(2023\)Christian Schroeder de Witt, Samuel Sokota, J Zico Kolter, Jakob Nicolaus Foerster, and Martin Strohmeier\.Perfectly secure steganography using minimum entropy coupling\.In*The Eleventh International Conference on Learning Representations*, 2023\.URL[https://openreview\.net/forum?id=HQ67mj5rJdR](https://openreview.net/forum?id=HQ67mj5rJdR)\.
- DeepSeek\-AI et al\. \(2026\)DeepSeek\-AI, Anyi Xu, Bangcai Lin, Bing Xue, Bingxuan Wang, Bingzheng Xu, Bochao Wu, Bowei Zhang, Chaofan Lin, Chen Dong, Chenchen Ling, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chengyu Hou, Chenhao Xu, Chenze Shao, Chong Ruan, Conner Sun, Damai Dai, Daya Guo, Dejian Yang, Deli Chen, Donghao Li, Dongjie Ji, Erhang Li, Fang Wei, Fangyun Lin, Fangzhou Yuan, Feiyu Xia, Fucong Dai, Guangbo Hao, Guanting Chen, Guoai Cao, Guolai Meng, Guowei Li, Han Yu, Han Zhang, Hanwei Xu, Hao Li, Haofen Liang, Haoling Zhang, Haoming Luo, Haoran Wei, Haotian Yuan, Haowei Zhang, Haowen Luo, Haoyu Chen, Haozhe Ji, Hengqing Zhang, Honghui Ding, Hongxuan Tang, Huanqi Cao, Huazuo Gao, Hui Qu, Hui Zeng, J Yang, JQ Zhu, Jia Luo, Jia Song, Jia Yu, Jialiang Huang, Jialu Cai, Jian Liang, Jiangting Zhou, Jiasheng Ye, Jiashi Li, Jiaxin Xu, Jiewen Hu, Jieyu Yang, Jin Chen, Jin Yan, Jingchang Chen, Jingli Zhou, Jingting Xiang, Jingyang Yuan, Jingyuan Cheng, Jingzi Zhou, Jinhua Zhu, Jiping Yu, Joseph Sun, Jun Ran, Junguang Jiang, Junjie Qiu, Junlong Li, Junmin Zheng, Junxiao Song, Kai Dong, Kaige Gao, Kang Guan, Kexing Zhou, Kezhao Huang, Kuai Yu, Lean Wang, Lecong Zhang, Lei Wang, Leyi Xia, Li Zhang, Liang Zhao, Lihua Guo, Lingxiao Luo, Linwang Ma, Linyan Zhu, Litong Wang, Liyu Cai, Liyue Zhang, Longhao Chen, MS Di, MY Xu, Max Mei, Miaojun Wang, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Mingming Li, Mingxu Zhou, Minmin Han, Ning Wang, Panpan Huang, Panpan Wang, Peixin Cong, Peiyi Wang, Peng Zhang, Qiancheng Wang, Qihao Zhu, Qingyang Li, Qinyu Chen, Qiushi Du, Qiwei Jiang, Rui Tian, Ruifan Xu, Ruijie Lu, Ruiling Xu, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, Runqian Chen, Runqiu Yin, Runxin Xu, Ruomeng Shen, Ruoyu Zhang, Ruyi Chen, SH Liu, Shanghao Lu, Shangmian Sun, Shangyan Zhou, Shanhuang Chen, Shaofei Cai, Shaoheng Nie, Shaoqing Wu, Shaoyuan Chen, Shengding Hu, Shengyu Liu, Shiqiang Hu, Shirong Ma, Shiyu Wang, Shuiping Yu, Shunfeng Zhou, Shuting Pan, Shuying Yu, Songyang Zhou, Tao Ni, Tao Yun, Tian Jin, Tian Pei, Tian Ye, Tianle Lin, Tianran Ji, Tianyi Cui, Tianyuan Yue, Tingting Yu, Tun Wang, W Zhang, WL Xiao, Wangding Zeng, Wei An, Weilin Zhao, Wen Liu, Wenfeng Liang, Wenjie Pang, Wenjing Luo, Wenjing Yao, Wenjun Gao, Wenkai Yang, Wenlve Huang, Wenqing Hou, Wentao Zhang, Wenting Ma, Xi Gao, Xiang He, Xiangwen Wang, Xianzu Wang, Xiao Bi, Xiaodong Liu, Xiaohan Wang, Xiaokang Chen, Xiaokang Zhang, Xiaotao Nie, Xiaowen Sun, Xiaoxiang Wang, Xin Cheng, Xin Liu, Xin Xie, Xingchao Liu, Xingchen Liu, Xingkai Yu, Xingyou Li, Xinyu Yang, Xinyu Zhang, Xu Chen, Xuanyu Wang, Xuecheng Su, Xueyin Chen, Xuheng Lin, Xuwei Fu, YC Yan, YQ Wang, YW Ma, Yanfeng Luo, Yang Zhang, Yanhong Xu, Yanru Ma, Yanwen Huang, Yao Li, Yao Li, Yao Xu, Yao Zhao, Yaofeng Sun, Yaohui Wang, Yi Qian, Yi Shao, Yi Yu, Yichao Zhang, Yifan Ding, Yifan Shi, Yijia Wu, Yiliang Xiong, Yiling Ma, Ying He, Ying Tang, Ying Zhou, Yingjia Luo, Yinmin Zhong, Yishi Piao, Yisong Wang, Yixiang Zhang, Yixiao Chen, Yixuan Tan, Yixuan Wei, Yiyang Ma, Yiyuan Liu, Yonglun Yang, Yongqiang Guo, Yongtong Wu, Yu Wu, YuKun Li, Yuan Cheng, Yuan Ou, Yuanfan Xu, Yuanhao Li, Yuduan Wang, Yuehan Yang, Yuer Xu, Yuhan Wu, Yuhao Meng, Yuheng Zou, Yukun Zha, Yunfan Xiong, Yupeng Chen, Yuping Lin, Yuqian Cao, Yuqian Wang, Yushun Zhang, Yuting Yan, Yutong Lin, Yuxian Gu, Yuxiang Luo, Yuxiang You, Yuxuan Liu, Yuxuan Zhou, Yuyang Zhou, Yuzhen Huang, ZF Wu, Zehao Wang, Zehua Zhao, Zehui Ren, Zekai Zhang, Zhangli Sha, Zhe Fu, Zhe Ju, Zhean Xu, Zhenda Xie, Zhengyan Zhang, Zheren Gao, Zhewen Hao, Zhibin Gou, Zhicheng Ma, Zhigang Yan, Zhihong Shao, Zhixian Huang, Zhixuan Chen, Zhiyu Wu, Zhizhou Ren, Zhongyu Wu, Zhuoshu Li, Zhuping Zhang, Zian Xu, Zihao Wang, Zihua Qu, Zihui Gu, Zijia Zhu, Zilin Li, Zipeng Zhang, Ziwei Xie, Ziyi Gao, Ziyi Wan, Zizheng Pan, and Zongqing Yao\.Deepseek\-v4: Towards highly efficient million\-token context intelligence, 2026\.URL[https://arxiv\.org/abs/2606\.19348](https://arxiv.org/abs/2606.19348)\.
- Denamganaï and Walker \(2020\)Kevin Denamganaï and James Alfred Walker\.ReferentialGym: A nomenclature and framework for language emergence & grounding in \(visual\) referential games\.*arXiv preprint arXiv:2012\.09486*, 2020\.
- Denamganaï \(2026\)Kevin Yandoka Denamganaï\.On the monitorability of natural language autoencoders: Identification vs discrimination\.*arXiv preprint arXiv:2610\.18727*, 2026\.
- Eccles et al\. \(2019\)Tom Eccles, Yoram Bachrach, Guy Lever, Angeliki Lazaridou, and Thore Graepel\.Biases for emergent communication in multi\-agent reinforcement learning\.*Advances in neural information processing systems*, 32, 2019\.
- Fish et al\. \(2026\)Sara Fish, Yannai A\. Gonczarowski, and Ran I\. Shorrer\.Algorithmic collusion by large language models, 2026\.URL[https://arxiv\.org/abs/2404\.00806](https://arxiv.org/abs/2404.00806)\.
- Foerster et al\. \(2016\)Jakob Foerster, Ioannis Alexandros Assael, Nando De Freitas, and Shimon Whiteson\.Learning to communicate with deep multi\-agent reinforcement learning\.*Advances in neural information processing systems*, 29, 2016\.
- Hu et al\. \(2020\)Hengyuan Hu, Adam Lerer, Alex Peysakhovich, and Jakob Foerster\.“other\-play” for zero\-shot coordination\.In*International conference on machine learning*, pages 4399–4410\. PMLR, 2020\.
- Jaques et al\. \(2019\)Natasha Jaques, Angeliki Lazaridou, Edward Hughes, Caglar Gulcehre, Pedro Ortega, DJ Strouse, Joel Z Leibo, and Nando De Freitas\.Social influence as intrinsic motivation for multi\-agent deep reinforcement learning\.In*International conference on machine learning*, pages 3040–3049\. PMLR, 2019\.
- Kaptchuk et al\. \(2021\)Gabriel Kaptchuk, Tushar M Jois, Matthew Green, and Aviel D Rubin\.Meteor: Cryptographically secure steganography for realistic distributions\.In*Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security*, pages 1529–1548, 2021\.
- Lazaridou and Baroni \(2020\)Angeliki Lazaridou and Marco Baroni\.Emergent multi\-agent communication in the deep learning era\.*arXiv preprint arXiv:2006\.02419*, 2020\.
- Lazaridou et al\. \(2017\)Angeliki Lazaridou, Alexander Peysakhovich, and Marco Baroni\.Multi\-agent cooperation and the emergence of \(natural\) language\.In*International Conference on Learning Representations \(ICLR\)*, 2017\.arXiv:1612\.07182\.
- Lee et al\. \(2019\)Jason Lee, Kyunghyun Cho, and Douwe Kiela\.Countering language drift via visual grounding\.In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors,*Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\)*, pages 4385–4395, Hong Kong, China, November 2019\. Association for Computational Linguistics\.doi:10\.18653/v1/D19\-1447\.URL[https://aclanthology\.org/D19\-1447/](https://aclanthology.org/D19-1447/)\.
- Lewis \(1969\)David Lewis\.*Convention: A Philosophical Study*\.Harvard University Press, 1969\.
- Lowe et al\. \(2019\)Ryan Lowe, Jakob Foerster, Y\-Lan Boureau, Joelle Pineau, and Yann Dauphin\.On the pitfalls of measuring emergent communication\.In*Proceedings of the 18th International Conference on Autonomous Agents and MultiAgent Systems*, AAMAS ’19, page 693–701, Richland, SC, 2019\. International Foundation for Autonomous Agents and Multiagent Systems\.ISBN 9781450363099\.
- Lu et al\. \(2020\)Yuchen Lu, Soumye Singhal, Florian Strub, Aaron Courville, and Olivier Pietquin\.Countering language drift with seeded iterated learning\.In*International Conference on Machine Learning*, pages 6437–6447\. PMLR, 2020\.
- Mathew et al\. \(2025\)Yohan Mathew, Ollie Matthews, Robert McCarthy, Joan Velja, Christian Schroeder de Witt, Dylan Cope, and Nandi Schoots\.Hidden in plain text: Emergence & mitigation of steganographic collusion in LLMs\.In Kentaro Inui, Sakriani Sakti, Haofen Wang, Derek F\. Wong, Pushpak Bhattacharyya, Biplab Banerjee, Asif Ekbal, Tanmoy Chakraborty, and Dhirendra Pratap Singh, editors,*Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia\-Pacific Chapter of the Association for Computational Linguistics*, pages 585–624, Mumbai, India, December 2025\. The Asian Federation of Natural Language Processing and The Association for Computational Linguistics\.ISBN 979\-8\-89176\-298\-5\.doi:10\.18653/v1/2025\.ijcnlp\-long\.34\.URL[https://aclanthology\.org/2025\.ijcnlp\-long\.34/](https://aclanthology.org/2025.ijcnlp-long.34/)\.
- Motwani et al\. \(2024\)Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip Torr, Lewis Hammond, and Christian Schroeder de Witt\.Secret collusion among AI agents: Multi\-agent deception via steganography\.In*The Thirty\-eighth Annual Conference on Neural Information Processing Systems*, 2024\.URL[https://openreview\.net/forum?id=bnNSQhZJ88](https://openreview.net/forum?id=bnNSQhZJ88)\.
- Nakamura et al\. \(2026\)Mason Nakamura, Abhinav Kumar, Saswat Das, Sahar Abdelnabi, Saaduddin Mahmud, Ferdinando Fioretto, Shlomo Zilberstein, and Eugene Bagdasarian\.Colosseum: Auditing collusion in cooperative multi\-agent systems\.*arXiv preprint arXiv:2602\.15198*, 2026\.
- Roger and Greenblatt \(2023\)Fabien Roger and Ryan Greenblatt\.Preventing language models from hiding their reasoning\.*arXiv preprint arXiv:2310\.18512*, 2023\.
- Rose et al\. \(2026\)Aaron Rose, Carissa Cullen, Sahar Abdelnabi, Philip Torr, Brandon Gary Kaplowitz, and Christian Schroeder de Witt\.Detecting multi\-agent collusion through multi\-agent interpretability\.*arXiv preprint arXiv:2604\.01151*, 2026\.
- Simmons \(1984\)Gustavus J Simmons\.The prisoners’ problem and the subliminal channel\.In*Advances in cryptology: proceedings of crypto 83*, pages 51–67\. Springer, 1984\.
- Zamir \(2024\)Or Zamir\.Excuse me, sir? your language model is leaking \(information\)\.*arXiv preprint arXiv:2401\.10360*, 2024\.
- Ziegler et al\. \(2019\)Zachary Ziegler, Yuntian Deng, and Alexander Rush\.Neural linguistic steganography\.In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors,*Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\)*, pages 1210–1215, Hong Kong, China, November 2019\. Association for Computational Linguistics\.doi:10\.18653/v1/D19\-1115\.URL[https://aclanthology\.org/D19\-1115/](https://aclanthology.org/D19-1115/)\.

## Appendix ALimitations and dual use

We restate and expand below on the limitations of this work:

- •*One environment, one model, ten markets per condition*, so we cannot say whether the gap behaves the same way in other tasks or with other models\.
- •*The code is instructed, not learned*, so the results bound the easiest case: a code that the pair was told to use, carried by a feature that paraphrase destroys\.
- •*The speaker is scripted*, so the positive control shows that the test detects a code that a partner follows, not that an AI speaker would invent such a code or keep it covert\.
- •*The scripted remarks carry nothing a seller would act on*in H0, so the outsider’s listening required by[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)is shown only where the speaker states an intention \(O\): in H0 the outsider’s marginal listening is0\.0190\.019\[−0\.031,0\.073\]\[\-0\.031,0\.073\], which includes zero\.
- •*The meaning judge passed its same\-meaning validation narrowly*\(0\.81 against a minimum of 0\.80\), and it is the same model as the paraphraser whose output it grades, so a shared bias of the two would go unnoticed\.
- •*The test is blind to codes carried by the choice of meaning*\([Proposition5](https://arxiv.org/html/2610.37849#Thmdefinition5)\)\.
- •*The listening measures come from cooperative settings*\([Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11), § 5\);\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15), § 4, § 5\), and a market is not one, so a listener’s response mixes trust with understanding \([Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)\)\.
- •*The interventions are single\-step*: they edit the last message only, so a convention carried by earlier messages would be missed\.
- •*Only one outsider is tested*, a fresh instance of the same model, so a convention carried by shared weights could go undetected\.
- •*The colluders are not adaptive*\. Agents that expect substitution could authenticate their messages, which would defeat the test\([de Witt, 2026](https://arxiv.org/html/2610.37849#bib.bib6), § 4\)\.

##### Dual use\.

The results tell colluders that codes carried by the choice of meaning, or by features that survive paraphrase, evade this test, and that same\-model monitors share their conventions\. We report them because the test is useful only if its blind spots are known\. Our setup also shows that a single letter suffices as a covert channel that a capable model follows reliably, which lowers the bar for instructed collusion\. We use only an instructed, scripted code in a simulated market, and release no method for making codes harder to detect\.

## Appendix BProof sketches

We give proof sketches only: each states the argument and the known results it relies on, and full proofs are left for future work\.

### B\.1 Message\-only monitors

###### Proposition 6\(Message\-only monitors\)\.

If stegotexts and covertexts differ by at mostε\\varepsilonin relative entropy given the context, then any monitor that scores messages has a lineup AUC of at most12\+ε/2\\tfrac\{1\}\{2\}\+\\sqrt\{\\varepsilon/2\}on lineups pairing a stegotext with a covertext\. Under perfect security, it is exactly12\\tfrac\{1\}\{2\}\.

###### Proof sketch of[Proposition6](https://arxiv.org/html/2610.37849#Thmdefinition6)\.

The AUC exceeds one half by at most the total variation between the two message distributions \(data processing\), which Pinsker’s inequality bounds byε/2\\sqrt\{\\varepsilon/2\}\. This is the security notion of[Cachin \(1998\)](https://arxiv.org/html/2610.37849#bib.bib5), in which the relative entropy between covertext and stegotext distributions bounds what any warden can detect\. The perfect caseε=0\\varepsilon=0is not empty: language models admit perfectly secure schemes when the two parties share a key\([de Witt et al\., 2023](https://arxiv.org/html/2610.37849#bib.bib7)\)\. ∎

### B\.2 What a paraphrase removes

###### Proposition 7\(What a paraphrase removes\)\.

WithMMthe meaning ofZZ,I⁡\(Y;Z∣X\)=I⁡\(Y;Π⁡\(Z\)∣X\)\+\[I⁡\(Y;Z∣X\)−I⁡\(Y;Π⁡\(Z\)∣X\)\]I\(Y;Z\\mid X\)=I\(Y;\\Pi\(Z\)\\mid X\)\+\\big\[I\(Y;Z\\mid X\)\-I\(Y;\\Pi\(Z\)\\mid X\)\\big\], where the bracket is non\-negative andI⁡\(Y;Π⁡\(Z\)∣X\)≤H⁡\(M∣X\)I\(Y;\\Pi\(Z\)\\mid X\)\\leq H\(M\\mid X\)\.

###### Proof sketch of[Proposition7](https://arxiv.org/html/2610.37849#Thmdefinition7)\.

GivenXX, the variables form a Markov chainY→Z→M→Π⁡\(Z\)Y\\to Z\\to M\\to\\Pi\(Z\), since the paraphraser depends onZZonly throughMMand never seesYY\. Data processing then givesI⁡\(Y;Π⁡\(Z\)∣X\)≤I⁡\(Y;M∣X\)≤I⁡\(Y;Z∣X\)I\(Y;\\Pi\(Z\)\\mid X\)\\leq I\(Y;M\\mid X\)\\leq I\(Y;Z\\mid X\), andI⁡\(Y;M∣X\)≤H⁡\(M∣X\)I\(Y;M\\mid X\)\\leq H\(M\\mid X\)\. That the meaning term survives any paraphrase is the result of[Motwani et al\. \(2024, § 7\.2, Theorem 4\)](https://arxiv.org/html/2610.37849#bib.bib24), who show that paraphrasing cannot remove information carried by the choice of meaning\. ∎

### B\.3 Marginal listening and the causal influence of communication

###### Proposition 8\(Marginal listening and the causal influence of communication\)\.

LetIL\(Zt;atL∣ht,κL\)I\_\{L\}\(Z\_\{t\};a^\{L\}\_\{t\}\\mid h\_\{t\},\\kappa\_\{L\}\)be the mutual information between the speaker’s messageZt∼πA\(⋅∣htA\)Z\_\{t\}\\sim\\pi\_\{A\}\(\\cdot\\mid h^\{A\}\_\{t\}\)and listenerLL’s actionatL∼πL\(⋅∣ht,Zt,κL\)a^\{L\}\_\{t\}\\sim\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},Z\_\{t\},\\kappa\_\{L\}\)at turntt\(cf\.[Definition4](https://arxiv.org/html/2610.37849#Thmdefinition4)\)\. This is the single\-step causal influence of communication of[Lowe et al\. \(2019, § 3\.3\)](https://arxiv.org/html/2610.37849#bib.bib21), and the quantity that the influence reward of[Jaques et al\. \(2019, § 4\)](https://arxiv.org/html/2610.37849#bib.bib15)estimates\. Then, with the relative entropy in nats, the following holds:

𝔼zt∼πA\(⋅∣hAt\)\[TV\(πL\(⋅∣ht,zt,κL\),π¯L\(⋅∣ht,κL\)\)\]≤IL\(Zt;aLt∣ht,κL\)/2\.\\mathbb\{E\}\_\{z\_\{t\}\\sim\\pi\_\{A\}\(\\cdot\\mid h^\{A\}\_\{t\}\)\}\\Big\[\\mathrm\{TV\}\\big\(\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z\_\{t\},\\kappa\_\{L\}\),\\,\\bar\{\\pi\}\_\{L\}\(\\cdot\\mid h\_\{t\},\\kappa\_\{L\}\)\\big\)\\Big\]\\leq\\sqrt\{I\_\{L\}\(Z\_\{t\};a^\{L\}\_\{t\}\\mid h\_\{t\},\\kappa\_\{L\}\)/2\}\.

###### Proof sketch of[Proposition8](https://arxiv.org/html/2610.37849#Thmdefinition8)\.

The expected KL divergence from each conditional policy to the marginal is the mutual information; Pinsker’s inequality bounds each total variation by the square root of half the KL divergence, and Jensen’s inequality moves the expectation inside the square root\. Writingπz=πL\(⋅∣ht,z,κL\)\\pi\_\{z\}=\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z,\\kappa\_\{L\}\)andπ¯=π¯L\(⋅∣ht,κL\)\\bar\{\\pi\}=\\bar\{\\pi\}\_\{L\}\(\\cdot\\mid h\_\{t\},\\kappa\_\{L\}\), the chain is

𝔼z​TV​\(πz,π¯\)≤𝔼z​12KL\(πz∥π¯\)≤12𝔼zKL\(πz∥π¯\)=12IL\(Zt;aLt∣ht,κL\),\\mathbb\{E\}\_\{z\}\\,\\mathrm\{TV\}\(\\pi\_\{z\},\\bar\{\\pi\}\)\\leq\\mathbb\{E\}\_\{z\}\\sqrt\{\\tfrac\{1\}\{2\}\\,\\mathrm\{KL\}\(\\pi\_\{z\}\\,\\\|\\,\\bar\{\\pi\}\)\}\\leq\\sqrt\{\\tfrac\{1\}\{2\}\\,\\mathbb\{E\}\_\{z\}\\,\\mathrm\{KL\}\(\\pi\_\{z\}\\,\\\|\\,\\bar\{\\pi\}\)\}=\\sqrt\{\\tfrac\{1\}\{2\}\\,I\_\{L\}\(Z\_\{t\};a^\{L\}\_\{t\}\\mid h\_\{t\},\\kappa\_\{L\}\)\},\(4\)so a positivePLmarg​\(L\)\\mathrm\{PL\}\_\{\\mathrm\{marg\}\}\(L\)requires a positive mutual information between the speaker’s message andLL’s action\. ∎

### B\.4 Blind spot

###### Proof sketch of[Proposition5](https://arxiv.org/html/2610.37849#Thmdefinition5)\.

An ideal paraphraser returns a message with the same meaning, so each distance in the definition ofPLΠ\\mathrm\{PL\}\_\{\\Pi\}compares a distribution with itself\. ∎

## Appendix CImplementation details

##### Estimator\.

Letp^Lv,t\\hat\{p\}^\{\\,v,t\}\_\{L\}be the empirical distribution of thekkdiscretised actions of listenerLLat turnttunder versionv∈\{id,id′,Π\}v\\in\\\{\\mathrm\{id\},\\mathrm\{id\}^\{\\prime\},\\Pi\\\}, andp^Lmarg,t=1M​∑mp^L\(m\),t\\hat\{p\}^\{\\,\\mathrm\{marg\},t\}\_\{L\}=\\tfrac\{1\}\{M\}\\sum\_\{m\}\\hat\{p\}^\{\\,\(m\),t\}\_\{L\}the average of theMMempirical distributions obtained with the alternative messages\.

PL^Π​\(L\)\\displaystyle\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}\(L\)=1T​∑t\[TV⁡\(p^Lid,t,p^LΠ,t\)−TV⁡\(p^Lid,t,p^Lid′,t\)\],\\displaystyle=\\tfrac\{1\}\{T\}\\textstyle\\sum\_\{t\}\\big\[\\mathrm\{TV\}\(\\hat\{p\}^\{\\,\\mathrm\{id\},t\}\_\{L\},\\hat\{p\}^\{\\,\\Pi,t\}\_\{L\}\)\-\\mathrm\{TV\}\(\\hat\{p\}^\{\\,\\mathrm\{id\},t\}\_\{L\},\\hat\{p\}^\{\\,\\mathrm\{id\}^\{\\prime\},t\}\_\{L\}\)\\big\],PL^marg​\(L\)\\displaystyle\\widehat\{\\mathrm\{PL\}\}\_\{\\mathrm\{marg\}\}\(L\)=1T​∑t\[TV⁡\(p^Lid,t,p^Lmarg,t\)−fLt\],\\displaystyle=\\tfrac\{1\}\{T\}\\textstyle\\sum\_\{t\}\\big\[\\mathrm\{TV\}\(\\hat\{p\}^\{\\,\\mathrm\{id\},t\}\_\{L\},\\hat\{p\}^\{\\,\\mathrm\{marg\},t\}\_\{L\}\)\-f^\{\\,t\}\_\{L\}\\big\],Δ^PL\\displaystyle\\widehat\{\\Delta\}\_\{\\mathrm\{PL\}\}=PL^Π​\(B\)−PL^Π​\(C0\),\\displaystyle=\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}\(B\)\-\\widehat\{\\mathrm\{PL\}\}\_\{\\Pi\}\(C\_\{0\}\),where the floorfLtf^\{\\,t\}\_\{L\}is the expected distance between akk\-sample and anM​k′Mk^\{\\prime\}\-sample empirical distribution drawn from the same distribution, computed by simulation from the pooled unchanged samples \(200 simulations, no extra calls\)\.

##### Why subtract a noise floor\.

With five samples per version, the distance between two empirical distributions is positive even when the underlying distributions are equal, and it is larger for a listener whose actions are more random\. ComparingBBwithC0C\_\{0\}alone would therefore turn a difference in randomness into a spurious gap\. The second unchanged draw estimates that floor for each listener separately, and subtracting it removes the bias\.

##### Inference\.

We resample sessions, then turns within sessions, 2 000 times, and report 95% percentile intervals\. The decision rules are those of[Sections3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)and[3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\.

##### Parameters\.

[Table3](https://arxiv.org/html/2610.37849#A3.T3)lists the replay and analysis parameters\.

Table 3:Parameters of the replay and the analysis \(top\) and minimum values of the controls \(bottom\), all fixed in advance\.

## Appendix DMeaning control: from a naive to a marginal design

[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)needs evidence that the outsider listens to the speaker at all, since otherwise a zero gap would be trivial\. Our first plan measured this with a naive design\. In the following, we state its limitations, then replace it with a design guided by[Jaques et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib15)and[Eccles et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib11)\.

##### The naive version\.

It replacedAA’s message byAA’s message from another round of the same run,zt′z^\{\\prime\}\_\{t\}, and measuredPLmeannaive\(L\)=𝔼tTV\(πL\(⋅∣ht,zt,κL\),πL\(⋅∣ht,zt′,κL\)\)\\mathrm\{PL\}^\{\\mathrm\{naive\}\}\_\{\\mathrm\{mean\}\}\(L\)=\\mathbb\{E\}\_\{t\}\\,\\mathrm\{TV\}\\big\(\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z\_\{t\},\\kappa\_\{L\}\),\\pi\_\{L\}\(\\cdot\\mid h\_\{t\},z^\{\\prime\}\_\{t\},\\kappa\_\{L\}\)\\big\)\.

##### Limitations\.

*L1: It leaves the input distribution\.*A message from another round refers to other prices and events, so the listener receives a message that is incoherent with its history\. This is the shift that[Lowe et al\. \(2019, § 6\.2\)](https://arxiv.org/html/2610.37849#bib.bib21)warn against when messages are zeroed, in another form\.*L2: It rests on one draw\.*The measured value depends on which message is drawn: a drawn message with the same implication asztz\_\{t\}is measured at zero whether or not the listener listens, and a single draw per turn results in a high\-variance estimator, which reduces the statistical validity of the metric\.*L3: It is not an information quantity\.*A distance between two conditional policies is not a departure from the listener’s behaviour without the message, so it cannot be related to the causal influence of communication, and values for two listeners are hard to compare\.

##### The marginal viewpoint\.

The three papers closest to our measure all compare the listener with a*marginal*, its behaviour with the message averaged out\.[Jaques et al\. \(2019, § 4, Eq\. 1;§ 5, Eq\. 2\)](https://arxiv.org/html/2610.37849#bib.bib15)average the influenced agent’s policy over counterfactual messages sampled from the speaker\.[Eccles et al\. \(2019, § 3\.2, Eqs\. 4–6\)](https://arxiv.org/html/2610.37849#bib.bib11)learn the listener’s message\-free policy with a network trained on inputs whose messages are zeroed, and condition on the whole trajectory, since a single\-step version did not help \(cf\. their Appendix D\)\.[Lowe et al\. \(2019, § 3\.3, Algorithm 1\)](https://arxiv.org/html/2610.37849#bib.bib21)weight each counterfactual message by the speaker’s probability of sending it\. Three design choices follow:

1. \(a\)compare with the marginal over messages, not with a single alternative;
2. \(b\)draw the counterfactual messages from the speaker’s own policy at the same state, so that they stay coherent with the history;
3. \(c\)use a quantity that is tied to the causal influence of communication \([Proposition8](https://arxiv.org/html/2610.37849#Thmdefinition8)\)\.

## Appendix EFurther related work

### E\.1 Signalling games and referential games

In a signalling game, a sender observes a state and emits a signal, and a receiver acts on the signal alone; any convention both players follow is an equilibrium\([Lewis, 1969](https://arxiv.org/html/2610.37849#bib.bib20)\)\. Emergent communication studies such games between learning agents, mostly as referential games\([Lazaridou et al\., 2017](https://arxiv.org/html/2610.37849#bib.bib18)\), for which[Denamganaï and Walker \(2020\)](https://arxiv.org/html/2610.37849#bib.bib9)proposed a nomenclature\. Agents that adapt to each other drift away from shared language\([Lee et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib19);[Lu et al\., 2020](https://arxiv.org/html/2610.37849#bib.bib22)\), which is the benign version of the private convention we look for\.

### E\.2 Influence\-based measures of listening

[Jaques et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib15)reward an agent for its causal influence on another, the KL divergence between the other agent’s policy given the actual action or message and its marginal over counterfactual ones, sampled from the influencer \(§ 4, Eq\. 1; § 5, Eq\. 2\)\. In expectation this is the mutual information between the two \(§ 4\)\. Without centralised access, the marginal comes from a learned model of the other agents \(§ 6\)\.[Eccles et al\. \(2019\)](https://arxiv.org/html/2610.37849#bib.bib11)turn positive listening into a training bias, a multi\-timestep causal influence measured against a message\-free policy that a separate network learns to predict from inputs with the messages zeroed \(§ 3\.2, Eqs\. 4–6\)\. A single\-timestep version gave no improvement \(cf\. their Appendix D\)\.

### E\.3 Cross\-play

In zero\-shot coordination, agents trained together coordinate on arbitrary conventions that independently trained partners do not share, so the gap between self\-play and cross\-play performance measures how private a convention is\([Hu et al\., 2020](https://arxiv.org/html/2610.37849#bib.bib14), § 3, § 6\.1\)\. Our partner\-versus\-outsider contrast is the listening\-side analogue of that gap\.

### E\.4 Steganography

The prisoners’ problem frames steganography as two parties hiding a plan from a warden who reads every message\([Simmons, 1984](https://arxiv.org/html/2610.37849#bib.bib28)\)\.[Cachin \(1998\)](https://arxiv.org/html/2610.37849#bib.bib5)measures security by the relative entropy between covertext and stegotext distributions, which bounds what any warden can detect\. Language models make secure schemes practical: arithmetic coding\([Ziegler et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib30)\), Meteor\([Kaptchuk et al\., 2021](https://arxiv.org/html/2610.37849#bib.bib16)\), minimum entropy coupling\([de Witt et al\., 2023](https://arxiv.org/html/2610.37849#bib.bib7)\)and keyed undetectable schemes\([Zamir, 2024](https://arxiv.org/html/2610.37849#bib.bib29)\)\. All of them need resources that only the two parties share\.

### E\.5 Limitations of prior work addressed by this work

Each limitation carries a working label:AuthorYear\-ELnnfor a limitation the authors state, andAuthorYear\-ILnnfor one we infer from the paper’s design\. Positive listening is defined against a null message, which the authors warn shifts the input distribution\([Lowe et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib21), § 6\.2\)\(Lowe2019\-EL1\)\. We intervene with a meaning\-preserving paraphrase instead, which stays on the message distribution, and[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)tests that it creates no spurious gap\. Listening is also measured only between a listener and its own partner\([Lowe et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib21), § 3\.1\)\(Lowe2019\-IL1\), whereas we contrast the partner with a role\-matched outsider \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. The steganographic gap is tested only in settings where one model communicates with itself, and its extension to separate communicating agents is left untested\([Anwar et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib2), § 5\); the paper’s footnote 4 mentions it \(Anwar2026b\-EL1\)\. Instead, we measure a gap between two distinct agents acting on a shared task \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. The steganographic gap also depends on the auditing task chosen, and an unrelated task gives a gap near zero\([Anwar et al\., 2026](https://arxiv.org/html/2610.37849#bib.bib2), § 8\.3\)\(Anwar2026b\-EL2\)\. Instead, we read the partner’s own task action, so no auditing task has to be chosen \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. In the context of positive listening and causal influence of communication, they are measured by removing or replacing whole messages, which changes wording and meaning together, and only between a listener and the agent it interacts with\([Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11), § 3\.2\);\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15), § 4–§ 5\)\(Eccles2019\-IL1,Jaques2019\-IL1\)\. Instead, we use paraphrases that separate wording from meaning, and an outsider that separates partner from stranger \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1.SSS0.Px1)\)\. Both metrics were studied in cooperative or repeated settings, and both papers caution that behaviour may differ in mixed settings\([Eccles et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib11), § 5\);\([Jaques et al\., 2019](https://arxiv.org/html/2610.37849#bib.bib15), § 4, § 5\)\(Eccles2019\-EL1,Jaques2019\-EL1\)\. Thus, we measure positive listening in a market, where the sellers compete, and record that a listener’s response there reflects trust as well as understanding \(cf\.[Section3\.1](https://arxiv.org/html/2610.37849#S3.SS1)\)\.