mlsanityData to 14 Oct 2026

Subversion via Focal Points: Investigating Collusion in LLM Monitoring

arXiv 2507.03010 ↗First posted 2 Jul 2025cs.CL cs.CRcited by 3

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

We evaluate language models' ability to subvert monitoring protocols via collusion. More specifically, we have two instances of a model design prompts for a policy (P) and a monitor (M) in a programming task setting. The models collaboratively aim for M to classify all backdoored programs in an auditing dataset as harmful, but nevertheless classify a backdoored program produced by P as harmless. The models are isolated from each other, requiring them to independently arrive at compatible subversion strategies. We find that while Claude 3.7 Sonnet has low success rate due to poor convergence, it sometimes successfully colludes on non-obvious signals.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 8 of its 19 references that are in the map. First posted on arXiv 2 Jul 2025.

Builds on

8 of 19 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Adaptive Deployment of Untrusted LLMs Reduces Distributed Threats26 Nov

Other references · 7

  1. 2021Measuring Coding Challenge Competence With APPScited by 902
  2. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
  3. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 128
  4. 2024Secret Collusion among AI Agents: Multi-Agent Deception via Steganographycited by 113
  5. 2024Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMscited by 55
  6. 2025Ctrl-Z: Controlling AI Agents via Resamplingcited by 44
  7. 2024Subversion Strategy Eval: Can language models statelessly strategize to subvert control protocols?cited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Counter-Swarm Doctrine: Containing Coordinated Agent Intrusionscited by 0
  2. 2026Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AIcited by 0
  3. 2026Shared and structured inputs undermine collective random choice by reasoning AI agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Audit, Alignment, and Optimization of LM-Powered Subroutines with Application to Public Comment Processing
  2. 2025Audit the Whisper: Detecting Steganographic Collusion in Multi-Agent LLMs
  3. 2026Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs
  4. 2026Who Tests the Testers? Systematic Enumeration and Coverage Audit of LLM Agent Tool Call Safety
  5. 2026On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment
  6. 2025When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors
  7. 2026From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents
  8. 2025Beyond Linear Probes: Dynamic Safety Monitoring for Language Models