Linear probe detects when ai agent about to share secret early
Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In
Artificial Intelligence
Summary
Sometimes AI agents can pressure each other to reveal secrets they are supposed to keep. The authors show that by looking inside the AI’s “brain” before it responds, it’s possible to predict when it is about to give in and reveal information. They use a simple tool called a linear probe on the AI’s activations and find it catches many risky moments earlier than other methods. This early warning could help stop an AI from sharing unwanted information before it actually happens.
What this means in practice
- •For ai platform operators: Detect potential rule-breaking disclosures by AI agents before the output is made public in multi-agent settings.
- •For security monitoring teams: Use early alerts from internal signals of AI to prevent information leaks or collusion attempts in automated systems.
Authors
Leonidas Raghav
Abstract
When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion. Output filters check only what an agent has already written. Can an overseer tell beforehand that an agent is about to give in? We show that a linear probe on the agent's activations can, in a controlled multi-agent setting. Across six scenarios, a peer presses a target for up to 20 rounds to reveal a secret, such as a deploy token; the target often refuses, then gives in. Read at each model call before its output is written, the probe picks out the one that leaks. On held-out Qwen3-32B episodes, at a threshold set to flag 5% of benign calls, it catches 82% of leaking calls. At a similar flag rate, a zero-shot decision-model monitor catches 26%. On gpt-oss-20b, a probe on its reasoning reaches AUROC 0.91. A bag-of-words classifier trained on the same calls comes close, so most of the gain comes from training on labels, not activations. The probe also flags permitted disclosures: it reads the coming disclosure more than the violation. The warning is short-range, and halting on any alarm would stop most benign episodes, which a second text check does not fix. A warning raised before generation could let an overseer stop an agent that is about to give in, ahead of others acting on its messages or recruitment spreading through a swarm.