arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2604.01151cs.AIcs.LGcs.MA
收藏

通过多代理可解释性检测多代理合谋

Detecting Multi-Agent Collusion Through Multi-Agent Interpretability

University of Oxford(牛津大学);ELLIS Institute Tübingen MPI-IS(图宾根ELLIS研究所MPI-IS)

Aaron Rose, Carissa Cullen, Sahar Abdelnabi, Philip Torr, Brandon Gary Kaplowitz, Christian Schroeder de Witt

AI总结:

本文提出NARCBench基准,通过五种探测技术在不同多代理场景中检测合谋,展示模型内部信号对多代理合谋检测的补充作用。

摘要:

随着大语言模型代理在多代理系统中的广泛应用,其隐秘的协调行为可能逃避标准的人类监督。虽然线性探测模型激活状态在单代理设置中显示出检测欺骗的潜力,但合谋本质上是多代理现象,利用内部表示检测代理间合谋仍属未探索领域。我们引入NARCBench,用于评估在环境分布偏移下的合谋检测能力,并提出五种探测技术,通过聚合单代理欺骗分数来分类群体层面的场景,评估了四个开源大模型(Qwen3-32B、Llama-3.1-70B、DeepSeek-R1 32B、GPT-OSS-20B)和六个探测架构。我们将此框架视为分布式异常检测问题,识别出三种合谋特征,映射到不同的异常类型和检测范式。每个模型在分布内达到1.00 AUROC;在我们最强的模型(Llama-3.1-70B)上,我们的五种探测技术在零样本转移至结构不同的多代理场景时达到0.73至0.93 AUROC,在隐写术黑杰克计牌任务中达到0.99至1.00,检测性能随模型能力增加而提升。我们发现没有单一探测技术在所有合谋类型中占据主导,这与框架预测的不同异常类型需要不同检测范式一致。本工作向多代理可解释性迈出一步:将单模型的白盒检查扩展到多代理环境,其中检测需要跨代理聚合信号。这些结果表明,模型内部信号为检测多代理合谋提供了补充于文本级监控的信号。代码和数据可在https://github.com/aaronrose227/narcbench获取。

英文摘要:

Non-verbalised or secret collusion may impose a ceiling on transcript-level monitoring in multi-agent deployments. Internal model activations are known to provide an additional monitoring surface for single-agent phenomena such as deception, but detecting collusion within an unknown subgroup is ultimately a joint inference task over multiple agents. This paper derives collusion detection statistics based on the composite hypothesis testing literature and introduces HELIOS, a multi-agent detection framework for collusion. Using per-agent activation probes as sensors, we then evaluate these principled statistics alongside heuristics on NARCBench, a novel benchmark for evaluating multi-agent collusion detection under environment distribution shift. Across four open-weight models, both our group-level statistics and heuristics transfer zero-shot to NARCBenchs holdout environments. Notably, the best method on every model reaches 0.99 to 1.00 AUROC when transferred from committee deliberations to a steganographic collusion task that unprimed transcript monitors fail to separate. We find empirically that no single statistic or heuristic dominates across tasks, consistent with our analysis that there is no known universally most powerful test for this setting. We then evaluate detector transfer to third-party environments with emergent, rather than instructed, collusion. In one such environment, only 2 of 229 collusive episodes verbalise the coordination in the transcript. We find evidence of partial transfer from NARCBench to these environments, indicating that probes fitted to instructed collusion may not fully capture emergent collusion signals. Overall, we establish multi-agent interpretability as a complementary monitoring technique, while highlighting the need to evaluate detector performance on both emergent and instructed collusion risks.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑