Authors: Sumeet Ramesh Motwani and Mikhail Baranchuk and Martin Strohmeier and Vijay Bolina and Philip H. S. Torr and Lewis Hammond and Christian Schroeder de Witt
Cite as: \cite{motwani2024secret}
arXiv: https://arxiv.org/abs/2402.07510
Summary in three sentences
This paper introduces secret collusion as a multi-agent deception problem where agents use steganography to hide coordination or information transfer from oversight. It builds a formal threat model and the CASE evaluation framework for measuring capabilities needed for steganographic collusion, including Schelling-point coordination, ciphers, self-sampling, tool use, and group covertext modification. The empirical picture is that current models are not yet strong at advanced steganography, but GPT-4 shows a clear capability jump that motivates continuous evaluation.
Main contribution
The main contribution is a broad conceptual and empirical framework for evaluating whether generative AI agents can coordinate covertly. The paper is useful because it connects safety framing, information theory, monitoring, common knowledge, incentives, and practical LLM capability evaluations under one threat model.
Key equations and definitions
- Secret collusion: a form of multi-agent deception where agents hide the true nature of communication or coordination from an overseer by using steganographic methods.
- CASE: the paper’s evaluation framework for required steganographic-collusion capabilities.
- Common knowledge matters because sender and receiver must share enough facts about the encoding channel for the receiver to decode without the overseer knowing the same decoding rule.
- Minimum entropy coupling appears as a theoretical object for optimal covert coordination between distributions; the project does not need to reproduce this in the first benchmark, but it is relevant background for capacity and coordination.
Empirical results
Section 5 and Table 3 summarize GPT-4 capability evaluations: GPT-4 can use code interpreter for encryption and related calculations, has partial abilities on couplings and minimum entropy couplings, and can sometimes perform group steganography under covertext modification. Appendix H.6 reports Table 30, where GPT-4 succeeds at Base64 encoding/decoding in 92% of cases and Caesar cipher encoding/decoding in 54% of cases, while GPT-3.5 and smaller models are near-zero except GPT-3.5 has 1% Caesar success. The conclusion states that current models do not yet have capabilities for advanced steganographic techniques, but that GPT-4 marks a rapid increase requiring continuous evaluation.
Relation to our project
- what we reuse: the secret-collusion threat model, capability-axis framing, baseline need, and the idea that monitoring and paraphrasing must be tested rather than assumed effective.
- what we dispute: the scope is broader than our first paper; our benchmark should be narrower, black-box, prompt-only, and centered on user-facing task outputs rather than the full CASE capability suite.
- what we must reproduce: a minimal sender/receiver covertext evaluation with random and non-collusive baselines, plus monitor/paraphrase conditions, so our result is comparable to their covertext-modification settings.
Criticism and limitations
The paper is intentionally broad, so many empirical settings are heterogeneous and not a single tight benchmark. Some case studies are qualitative or depend on specific prompts and common-knowledge assumptions. For our purposes, the paper is a baseline to differentiate against: we need a cleaner task protocol and a more reproducible pre-production testing story.