Beyond the Transcript: Detecting Covert Coordination in Latent Multi-Agent Communication

Multi-agent LLM systems increasingly exchange continuous latent states, moving coordination outside of the public transcript. We study covert coordination through such latent handoffs and introduce PATCH: Payload Auditing and Treatment of Covert Handoffs, a label-free defense that monitors and intervenes on detected collusive handoffs. For each handoff, PATCH maps the transferred representation to the receiver’s subsequent public action and combines three signals calibrated only on benign traffic: representation anomaly, harmful shift in the receiver’s action distribution relative to a benign handoff execution, and sparse-feature novelty. We evaluate the proposed prompt-derived and receiver-optimized latent attacks in bidding auctions, reputation reporting, Werewolf, and blackjack, using four model families and 12 directed cross-family pairs. Under the primary residual attack, PATCH achieves up to 0.894 average detection AUROC across the four homogeneous settings and up to 0.890 across the three applicable heterogeneous settings. Against optimized attacks, the average AUROC reaches 0.931 for homogeneous auctions and 0.877 for heterogeneous tests in Werewolf. Full matched-benign replacement intervention recovers 98.6-100% of the benign receiver action distribution across the three intervention studies, whereas prompt-only interventions recover at most 29.9%.