**From the SPEC-GAP pre-fellowship phase to the fellowship phase which involves live indirect prompt-injection trajectories. **
Before we dive into our findings, we would like to define a few key project terms:
AI systems are deployed as agents that retrieve information, delegate subtasks, and take actions. One safety-relevant example is a multi-agent research assistant encountering a poisoned document. A first agent retrieves the document, a second summarizes it, and a third acts on the summary. No individual agent needs to explicitly propose an “attack”; instead, the information passed between agents can gradually shift the system toward an unsafe action.
The safety question is therefore: Can we detect this adversarial shift inside the model before it becomes apparent in the final output?
This was the main question investigated in the BASE fellowship SPEC-GAP project.
SPEC-GAP which stands for **Representation-Level Analysis of Exploit Chains in Multi-Agent Language Systems, **is a way for frontier labs a way to evaluate whether their multi-agent models are vulnerable to compositional deception attacks before release, and provides regulators with a standard for what pre-deployment evaluation should look like.
One neat way to do this would be to probe the model mechanistically instead of looking at the outputs. Prior work has shown that this can work well in some deception settings. We wanted to find out whether these tactics actually translate in a messier multi-agent setting, sort of mimicking real-world deployment environments where information moves through several agents before something goes wrong.
Motivated by Goldowsky-Dill et al. (2025) [1], who found that linear probes could distinguish honest from deceptive responses from model activations, we asked whether an analogous linearly decodable signal appears when a model is instructed to collude in a multi-agent pipeline. Our working hypothesis was that the collusive condition would produce a directionally consistent shift in the model’s activations. However, this transfer was not guaranteed: collusion in our setting unfolds across a trajectory, whereas Goldowsky-Dill et al. study settings that contrast more clearly defined honest and deceptive behaviors.
Indirect prompt injection creates a concrete failure mode for agentic systems. Instead of placing an adversarial instruction in the user’s request, an attacker can hide it in external content that the system later retrieves. The instruction may then influence downstream messages and tool use, potentially leading to data exfiltration or other unauthorized actions (Greshake et al., 2023 [2];
This makes output-only monitoring potentially insufficient. White-box probes are insightful because they read the model's internal representations rather than relying on the model's outputs. However, this method works best in larger models and single-agent settings. Whether it extends to smaller open models, longer handoff chains, leakage-aware evaluation metrics, and action-grounded indirect prompt injection remains an open question
Before testing the full multi-agent pipeline, we ran a smaller baseline on NARCBench-Core dataset [5]. We evaluated
Each example in the pre-fellowship phase was built as a matched pair, with both conditions receiving the same scenario, the same committee frame, and the same response format. The only thing that changes is the role instruction in the system prompt. Figure 2 shows an example of a medical-ethics scenario.
Importantly, a positive label indicates that the model was instructed to collude, not that it successfully carried out a deceptive action. To check how much of the label we could recover from the words alone, we trained a TF-IDF logistic regression on the system prompts. There was a clear separation between the two conditions, and this continued even after removing the persona names and truncating each of the prompts to the same token length. The strongest features were tokens naming the targeted option: the collusion instructions in NARCBench-Core explicitly name what they are pushing for, and the honest instructions do not. The probe may therefore be detecting the wording or framing of the instruction, benchmark-specific artifacts, differences in the model's behavior, or some combination of these factors. This is a central limitation of the runway experiment.
**We evaluated the probes in two ways: **(1) Stratified cross-validation measures in-distribution discrimination when training and test examples are drawn from the same set of scenarios. (2) Leave-one-scenario-out evaluation is a stricter test: it holds out an entire scenario and asks whether the learned signal generalizes to a qualitatively new context.
After evaluating the layers under stratified cross-validation, AUROC ranged from 0.60 to **0.66 **across layers 13-20 and 24. The AUROC values are above chance, but only minimally, with the confidence intervals overlapping heavily. Therefore, no single layer was chosen as the detection layer.
| | | |---|---|---| 13 | 0.2536 | 0.2424 | 14 | 0.2699 | 0.2547 | 15 | 0.2705 | 0.2179 | 16 | 0.2711 | 0.2268 | 17 | 0.2838 | 0.2436 | 18 | 0.2767 | 0.2348 | 19 | 0.3006 | 0.2743 | 20 | 0.2778 | 0.2558 | 24 | 0.2979 | 0.2922 |
Linear probe calibration by residual stream layer, computed on the held-out set.Table 1:
Layer 14 achieved the highest AUROC, while other layers performed better on calibration metrics such as Brier score and ECE. These differences were not large enough to support choosing one specific layer. The predicted probabilities were also not trustworthy based on their Brier scores and ECE scores. Brier scores for layers 13-20 and 24 ranged from 0.254 to 0.301, close to the 0.25 baseline for a balanced dataset, and ECE ranged from 0.218 to 0.292. Because we are working with a smaller dataset of 200 prompts, the calibration bins are sparse, so these estimates are themselves noisy. Taken together with the AUROC results, we read this as a signal that is neither distinctive nor transferable.
| | | | | |---|---|---|---|---| 13 | 0.639 | 0.585 ± 0.334 | −0.054 | [0.560, 0.717] | 14 | 0.656 | 0.625 ± 0.329 | −0.031 | [0.576, 0.729] | 15 | 0.625 | 0.590 ± 0.338 | −0.035 | [0.550, 0.698] | 16 | 0.622 | 0.585 ± 0.349 | −0.037 | [0.545, 0.694] | 17 | 0.617 | 0.620 ± 0.325 | 0.003 | [0.536, 0.693] | 18 | 0.606 | 0.585 ± 0.366 | −0.021 | [0.525, 0.680] | 19 | 0.606 | 0.590 ± 0.346 | −0.016 | [0.526, 0.681] | 20 | 0.641 | 0.595 ± 0.357 | −0.046 | [0.567, 0.713] | 24 | 0.609 | 0.550 ± 0.354 | −0.059 | [0.536, 0.684] |
Table 2:A comparison between per-layer AUROC under random splits and leave-one-scenario-out (LSO) evaluation. One of the most important results from the pre-fellowship phase was using the** leave-one-scenario-out evaluation (LSO)**. When using stratified cross-validation, prompts from the same scenario appeared during testing and training, which suggests that the probe may learn the structure of the scenario rather than learning a transferable collusion signal. Leave-one-scenario-out removes that shortcut by testing whether each fold generalizes to an entire scenario and tests whether the probes transfer to prompts it hasn't seen.
In the table above, we can see that the scores drop under this evaluation metric in eight out of the nine layers; **Δ **ranges from −0.059 to +0.003, and the LSO means range from **0.550 **and 0.625. **We see that Layer 14 remains the strongest layer in both evaluation metrics with values at 0.656 (AUROC) and 0.625 (AUROC LSO). **Each held out scenario contains four prompts, so the AUROC per fold level is coarse, given that only five values are taken: 0, 0.25, 0.5, 0.75, or 1.
Using leave-one-scenario-out evaluation metric is a strict stress test here and should not be used as an estimate of the deployment performance in this example. We see that whatever the probe picks up under random splits weakly transfers, and most of the values for the layers remain very close to chance. Figure 3:Exemplar partitioning (EP) results across layers. (A) Number of unsupervised partitions recovered per layer, with the best-partition colluder rate overlaid (teal line); partition count rises modestly with depth while the top partition remains fully colluder-enriched (rate=1.00) at every layer. (B) Fisher's exact test p-values for that enrichment; all layers fall below theα=0.05threshold (dashed line), indicating the partitions are unlikely to be enriched by chance. (C) Cosine similarity between the exemplar-partition direction and two reference axes — the supervised probe (gray) and the difference-in-means direction (teal). Exemplar directions align far more closely with DIM than with the probe at every layer, and this DIM alignment weakens with depth (0.393atlayer 13to0.268atlayer 24).
The raw geometry also illustrated a similar story: At layer 16 activations, the PCA of the honest and colluder points overlapped, and there was no clear separation between the honest and colluder labels. We also used Exemplar Partitioning, introduced by Rumbelow (2026), [6] a method that groups similar activations without knowing their labels. We found a few groups with more colluder examples with nominal Fisher p-values around
We interpreted the above results as illustrating some structure in the activations, but not something transferable that makes a linear probe reliable. More specifically, the model may contain some information that is relevant to detecting collusion, but it does not robustly recover when the scenario shifts. Another way we interpreted it is that the target itself may be inconsistent. There could be scenarios wherein the colluder agents may not have behaved differently from the honest agents, so there is no behavioral property for the probe to actually detect.
These results do not prove that collusion is absent from the model’s representation, but a more focused conclusion is that this trained linear probe on this model with these labels doesn’t produce a robust monitor. Our results merely support a cautious prior, validate the measurement stack we implement, illuminate ambiguity in our evaluation metrics, and most importantly make a distinction between detecting which instruction an agent received and detecting what that agent actually did.
We presented our pre-fellowship results to researchers at FAR.AI. They suggested several changes: using a larger model and dataset to see more internal signal, incorporating trajectories capable of executing actions, and strengthening the evaluation against leakage.
In response, we first changed the setup so that the model generated every response and action request in the trajectory, rather than relying on a hardcoded final answer. Second, we constructed clean and injected trajectories in controlled matched groups that held the task, documents, injection wording, model, and random seed constant. We fixed worker_1 as the injection point at both delegation depths, which lets us study what happens as the distance between the injection and the executor increases without changing where the injection enters the trajectory.
Third, we defined a successful compromise as the executor carrying out the unsafe action without directly seeing, reasoning about, or repeating the injected instruction. During probe evaluation, we held out entire matched groups so that related trajectories could not appear in both the training and test sets, and designed the trajectory domains to be as independent as possible.
Be on the lookout for it. The next write-up will be out in the coming weeks :)
Goldowsky-Dill et al. (2025), [Detecting Strategic Deception Using Linear Probes](https://arxiv.org/abs/2502.03407).
Lee and Tiwari (2024), [Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems](https://arxiv.org/abs/2410.07283).
Rose et al. (2026), [Detecting Multi-Agent Collusion Through Multi-Agent Interpretability](https://arxiv.org/abs/2604.01151)
Rumbelow (2026), [Exemplar Partitioning for Mechanistic Interpretability](https://arxiv.org/abs/2605.14347).