mlsanityData to 7 Oct 2026

You Can't Escape Your Own Activations : Evaluation Awareness and Multi-Agent Monitoring

arXiv 2609.03035 ↗First posted 2 Sep 2026cs.MA cs.LGcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

LLM agents are increasingly deployed in multi-agent systems, where they can collude while keeping their actions benign. Output monitors designed to detect such collusions can be fooled by obfuscation and steganography, motivating the use of probes trained on internal activations. However, these probes are usually evaluated on agents that do not know they are being watched. We study how activation-based detection changes when agents are explicitly informed that their internal activations are being monitored, and when they additionally receive feedback from the monitor. We keep the models, probes, and thresholds fixed and change only what the agents are told: nothing (baseline), that an activation monitor is present (aware), or that a monitor is present together with the previous round's score (feedback). We test two games, a four-agent blackjack game and a two-agent Simmons prisoners game, using Qwen3-32B-AWQ and GPT-OSS-20B in homogeneous and mixed pairings. Telling agents about the monitor does not hide them. The best probes stay accurate in all three conditions, and the agents keep colluding.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 9 of its 14 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

9 of 14 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026Detecting Multi-Agent Collusion Through Multi-Agent Interpretability1 Apr
  2. 2024Secret Collusion among AI Agents: Multi-Agent Deception via Steganography12 Feb

Other references · 7

  1. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 673
  2. 2023The Internal State of an LLM Knows When It's Lyingcited by 644
  3. 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscationcited by 338
  4. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
  5. 2024Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMscited by 52
  6. 2025RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?cited by 19
  7. 2026Training on Documents About Monitoring Leads to CoT Obfuscationcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026LLMs Learn to Evade Latent Monitors from Prior Feedback Alone
  2. 2026How does information access affect LLM monitors' ability to detect sabotage?
  3. 2025Reliable Weak-to-Strong Monitoring of LLM Agents
  4. 2026Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild
  5. 2026Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents
  6. 2026Activation Probes Surface Code-Security Signals that the Model's Output Misses
  7. 2026Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure
  8. 2026From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents