Secret Collusion among AI Agents: Multi-Agent Deception via Steganography

LLMs can exchange steganographic messages under the watch of equally capable oversight systems, and more powerful models can do so more capably.

“In a recent study, Motwani et al. (2024) demonstrate that LLMs can exchange steganographic messages under the watch of equally capable oversight systems, and that more powerful models can do so more capably.”

In Motwani et al.'s experiment, GPT-4 transmitted covert messages 26% of the time without detection, surpassing GPT-3.5's 18% and Mixtral 8x7B's 16%.

“Although GPT-2 exhibited no proficiency in steganography, more advanced models achieved notable success rates: GPT-4 transmitted covert messages 26% of the time without detection, surpassing GPT-3.5's 18% and Mixtral 8x7B's 16%.”

When communicating models shared background knowledge not accessible to the overseer, their success rates in covert communication rose significantly.

“Furthermore, the study found that when communicating models shared background knowledge that was not accessible to the overseer (reflecting real-world scenarios where AI systems might have common training data or contextual information), their success rates in covert communication rose significantly.”

Only a small number of works have considered collusion in the context of more advanced AI agents, such as those powered by LLMs, and this remains a highly under-explored area.

“Only a small number of works, however, have considered collusion in the context of more advanced AI agents, such as those powered by LLMs (Fish et al., 2024; Mathew et al., 2024; Motwani et al., 2024; OpenAI, 2023c), and this remains a highly under-explored area.”

Attacks on AI agents include attacks on overseer agents, attempts to thwart cooperation, and leakage of information that could enable collusion.

“This includes attacks that have direct relevance for ensuring safety, such as attacks on overseer agents (see Case Study 13), attempts to thwart cooperation (Huang et al., 2024; Lamport et al., 1982), and the leakage of information (accidentally or deliberately) that could be used to enable collusion (Motwani et al., 2024).”

AI agents are capable of steganographic communication.

“Recent developments, however, have shown that AI agents are capable of both steganographic communication (Motwani et al., 2024; Schroeder de Witt et al., 2023b) and 'illusory' attacks (Franzmeyer et al., 2023), which are black-box undetectable and can even be hidden using white-box undetectable encrypted backdoors (Draguns et al., 2024).”

Given the lack of model weight updates, the observability mechanisms provide strong safety mitigation.

“Given the lack of model weight updates, which make it difficult but not impossible for the model to encode e.g.stenographic messages (Motwani et al., 2023;2024) in the chain-of-thought, we believe this provides strong safety mitigation.”