AI 安全與代理系統
VLA Monitors Hidden-State Communication Between Agents, Achieving 0.993 AUROC in Same-Model Auction Tests
A new study links continuous vectors exchanged between agents—but omitted from conversation logs—to their subsequent public actions as a single event, then applies three layers of checks: anomaly detection, counterfactual impact analysis, and sparse-feature inspection. The average AUROC of 0.993 combines text-based and latent-collusion samples, and the attacks were predesigned by the researchers, so the result cannot yet be considered a general capability for detecting emergent conspiracies.
Multi-agent systems do not necessarily exchange information through text. If one agent directly inserts its residual stream or the hidden state of its final token into another agent’s input embedding, the public transcript records only the eventual action, while the continuous vector conveying strategic intent may evade existing audits.
The research team proposes Verifiable Latent Alignments (VLA), which assigns a shared correlation ID to each hidden-state handoff and the subsequent public action. The monitor first builds a per-dimension Gaussian distribution from neutral communications to identify vectors that deviate from the normal manifold. The second layer compares the action-probability distribution produced with the suspicious incoming vector against distributions obtained when the vector is blocked or replaced with a neutral vector, measuring causal impact through the expected-value shift in a harmful direction and KL divergence. The third layer uses a TopK sparse autoencoder to flag reconstruction errors, unseen features, and rare features. Thresholds for all three layers are calibrated using only neutral data; attack labels are used solely for evaluation.
In the Nanda Town auction sandbox, sequential monitoring of same-model agents achieved an average AUROC of 0.993, falling to 0.854 when evaluated across the representation spaces of Qwen, Mistral, Vicuna, and Phi models. Tests involving 25 to 100 Qwen3-0.6B bidders still achieved at least 0.917. A white-box intervention reran decisions with matched neutral states, reducing low-price collusive behavior by 47.3 percentage points.
The figures have two important limitations. The positive class used for AUROC includes both explicit-text and hidden-state collusion, rather than measuring detection of latent channels alone. The receiving agent was also explicitly instructed to interpret the private state, while the attack code was obtained through offline optimization. The second layer further assumes that matched counterfactual controls are available during deployment, and the white-box correction requires access to model activations and additional forward passes. Engineering teams should next examine whether the method can handle protocols that agents develop autonomously and intentionally shape to resemble normal distributions, and whether the research code and complete evaluation data will be released.