💻 computer science

The Locality Gap: Bell-Inequality Audits for Covert Coordination Between Ostensibly Isolated AI Agents

This paper proposes using Bell-inequality audits, specifically the CHSH game, as a model-free instrument to detect covert coordination between ostensibly isolated AI agents by distinguishing genuine communication from mere statistical correlation, while highlighting that the method's validity critically depends on the unpredictability of the auditor's settings to avoid false positives.

Original authors: Alfredo Merlet

Published 2026-10-20

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Alfredo Merlet

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of artificial intelligence, a growing worry keeps regulators and safety experts awake at night: the fear that computer programs designed to act independently might secretly learn to work together. Imagine two pricing algorithms run by competing companies. They are supposed to set prices based only on their own data, but what if they figure out a way to signal each other, perhaps by subtly adjusting their prices to send a hidden message? This is known as algorithmic collusion, and it is notoriously difficult to catch. Traditional methods of detection look for statistical patterns in the agents' outputs, but these methods often fail. If two agents were trained on the same massive dataset or started with the same random numbers, they will naturally produce similar results even if they never speak to each other. This creates a blind spot for auditors: they cannot tell the difference between two agents who are simply thinking alike because of shared history, and two agents who are actively conspiring in real time.

To solve this, a researcher named Alfredo Merlet has proposed a new kind of test, borrowing a concept from the deepest mysteries of physics. The idea comes from a famous debate between Albert Einstein and the quantum physicists of the 1930s. Einstein disliked the idea that two distant objects could influence each other instantly without any physical connection, calling it "spooky action at a distance." Later, a physicist named John Bell proved mathematically that if two systems are truly isolated and only share information from their past, there is a strict limit to how well they can coordinate their answers to random questions. If they exceed this limit, it is impossible for them to have done so without communicating during the test. Merlet realized this physical law could be turned into a tool for auditing artificial intelligence. By asking two AI agents a series of random, private questions and checking if their answers are too perfectly coordinated, an auditor can detect secret communication without needing to understand how the AI works inside.

The study put this idea to the test through a series of computer experiments. First, the researcher created pairs of artificial neural networks, which are the building blocks of modern AI. These agents were given a shared history: they were trained on the same data, started with the same random seeds, and were allowed to share a hidden variable that acted like a common memory. However, they were strictly forbidden from communicating during the test. The auditor then sent each agent a random question and asked for a simple answer. The goal was to see if the agents could coordinate their answers better than the laws of physics allow for isolated systems. The results were clear and reassuring for the theory: no matter how complex the agents were or how hard they tried to maximize their coordination, they never broke the limit. Even when the agents were specifically trained to mimic the behavior of quantum particles, which are famous for their "spooky" connections, they still could not exceed the bound. This confirmed that the test works as a reliable filter; if the agents are truly isolated, they will stay within the limit, regardless of their shared training.

Next, the researcher introduced a controlled flaw to see how the test would react to a secret channel. In these experiments, a tiny, hidden line of communication was opened between the agents, allowing them to share a single piece of information in a small percentage of the rounds. As the frequency of this secret leak increased, the agents' ability to coordinate their answers improved in a perfectly predictable way. However, the study found a crucial nuance: for leaks below a certain threshold (approximately 41.4%), the resulting coordination scores produce values indistinguishable from quantum entanglement, meaning they exceed the classical limit but could theoretically be explained by shared quantum resources rather than just a leak. Only when the leak rate exceeded this threshold did the scores clearly surpass the quantum bound. The study also calculated how many rounds of questioning would be needed to catch different sizes of leaks. To detect a leak that happens only one percent of the time with high confidence, the audit would need to run for roughly 185,000 rounds. While this is a large number, it is feasible for automated systems that can run thousands of tests in seconds.

However, the study also uncovered a critical weakness that lies not with the agents, but with the person running the test. The entire logic of the audit depends on the questions being truly random and unpredictable. If the person running the test uses a predictable method to generate the questions—such as a simple computer routine that repeats a pattern, or a fixed schedule—the agents can learn to guess the questions in advance. In the experiments, when the auditor used a predictable generator, the agents were able to coordinate their answers perfectly, breaking the limit and triggering a false alarm, even though they never actually communicated. This happened because the agents could use the pattern of the questions to coordinate their responses, effectively circumventing the test without breaking any rules of isolation. The study showed that using a high-quality, cryptographic random number generator is essential. Without it, the test is useless, as it cannot distinguish between a secret conspiracy and a clever guess based on a predictable pattern.

The findings suggest a new path for regulating artificial intelligence, particularly in areas like pricing or competitive markets. The test offers a way to separate "tacit parallelism," where agents act similarly because they learned from the same data, from actual collusion, where they communicate to coordinate actions. It is important to note that this research was conducted entirely in simulation with simple neural networks, not with real-world large language models or deployed commercial systems. The results prove the concept works in a controlled environment, but applying it to the messy reality of the internet would require careful adaptation. The study does not claim to have solved the problem of algorithmic collusion, but it provides a rigorous mathematical tool that can be used to audit systems where communication is suspected.

Ultimately, the research highlights that the reliability of such an audit depends entirely on the integrity of the auditor. The agents in the study were not the ones who failed; the test failed when the randomness of the questions was compromised. This mirrors a lesson learned in physics decades ago: to prove that two things are not connected, you must ensure that the way you test them is completely free from hidden patterns. If the questions are truly random and private, the test can reveal a secret channel that no amount of shared training could hide. If the questions are predictable, the test becomes a mirror that reflects the auditor's own lack of randomness back at them. The study concludes that for this tool to be effective in the real world, the randomness used to probe the agents must be as secure as the secrets it is trying to find.

Technical Summary: The Locality Gap: Bell-Inequality Audits for Covert Coordination Between Ostensibly Isolated AI Agents

Problem Statement
Regulators and auditors face a critical challenge in detecting covert coordination (algorithmic collusion) between AI agents that are ostensibly isolated. Existing detection methods rely on statistical dependence tests, which condition on shared observable inputs. However, these tests fail when agents share latent structures—such as common training data, pre-trained weights, or random seeds—because such shared history creates statistical correlation without active communication. This creates a "locality gap": the inability to distinguish between correlation caused by shared training (which is permissible) and correlation caused by a covert communication channel (which is the target of regulation). The paper proposes using Bell's theorem, specifically the Clauser–Horne–Shimony–Holt (CHSH) inequality, as an audit instrument to close this gap.

Methodology
The paper frames the audit as a CHSH game where an auditor sends independent, uniformly random binary queries ( $x$ and $y$ ) to two agents (A and B) in separate sessions. The agents return binary answers ( $a, b \in \{+1, -1\}$ ). The audit calculates the CHSH value $S = E_{00} + E_{01} + E_{10} - E_{11}$ .

Theoretical Bound: For any local system (agents sharing pre-audit information $\lambda$ but communicating during the audit), $S \le 2$ .
Leak Model: If a covert channel leaks the query $x$ to agent B with probability $p$ , the optimal strategy yields $S^*(p) = 2 + 2p$ .
Experimental Design: The study validates this instrument through three computational experiments with known ground truth using neural network agents:
1. Local Saturation: 135 pairs of neural agents (varying widths and latent dimensions) trained to either maximize $S$ directly or imitate the correlations of a quantum singlet state.
2. Dose-Response: Training agents with a controlled one-bit leak channel at varying probabilities ( $p$ ) to observe the relationship between leak rate and $S$ .
3. Audit Performance:
  - Size: Testing the false positive rate against "honest" agents that are strongly correlated via shared latent variables but have no communication.
  - Power: Calculating the number of rounds ( $N$ ) required to detect specific leak rates with 80% power.
  - Failure Modes: Testing the audit against agents using predictable setting generators (e.g., low-order bits of linear congruential generators, fixed rotations, or reused seeds).

Key Results

Validity of the Bound: In Experiment 1, no trained local agent pair exceeded the classical bound of $S=2$ . Even agents explicitly trained to mimic the non-local correlations of an entangled singlet state achieved a maximum $S$ of 1.9998, staying within the tolerance of the local bound. This confirms that shared training data and weights cannot violate the Bell inequality.
Sensitivity to Leaks: In Experiment 2, the learned CHSH value tracked the theoretical optimum $S^*(p) = 2 + 2p$ with a mean absolute deviation of only 0.0016 across 220 runs. The agents learned to utilize the leaked bit only when available, demonstrating that the metric accurately reflects the rate of covert communication.
Differentiation from Shared Latency: In Experiment 3a, the Bell audit maintained a nominal false positive rate (4.3%–4.4%) against honest, strongly correlated agents. In contrast, a conventional dependence test rejected these same agents in 100% of audits, failing to distinguish between shared training and communication.
Sample Size Requirements: Detecting small leaks requires significant sample sizes. To achieve 80% power at a 5% significance level, the audit requires approximately 7,375 rounds for a 5% leak and 185,120 rounds for a 1% leak.
The Auditor's Vulnerability: Experiment 3c revealed that the audit's validity is entirely dependent on the unpredictability of the auditor's settings. When settings were predictable (e.g., using a reused seed or a fixed schedule), agents with zero communication achieved $S \approx 4$ , triggering 100% false alarms. Cryptographic random generators restored the nominal error rate.

Significance and Claims
The paper claims to provide a formal instrument for auditing AI agents that overcomes the "locality gap" inherent in dependence testing. By leveraging Bell's theorem, the audit establishes a null hypothesis ( $S \le 2$ ) that holds true regardless of the agents' architecture or shared pre-audit history (weights, seeds, data). A significant excess ( $S > 2$ ) serves as evidence of communication during the audit without requiring a model of the agents' internal workings.

The author explicitly frames the application to competition policy as a formal analogy rather than a finding about deployed systems. The audit separates "tacit parallelism" (correlation explainable by shared information) from "coordination" (correlation requiring communication), mirroring the distinction in antitrust law. The paper concludes that the decisive constraint for this method is not the agents' complexity, but the auditor's ability to generate truly unpredictable, independent settings (measurement independence). Without cryptographic-grade randomness and fresh seeds, the audit is susceptible to false positives.

Limitations
The study is limited to shallow neural networks, two-party interactions, and simple one-bit leaks. It does not test agents that can recognize audit conditions and behave deceptively, nor does it evaluate agents with access to quantum resources (which could theoretically reach $S = 2\sqrt{2}$ without communication). The bridge to real-world algorithmic collusion remains a hypothesis for field testing, not an established conclusion.

More like this