The agent transcript is not always the whole story

A transcript can show every word two agents exchanged and still miss the conversation that shaped the outcome.

That possibility is becoming more concrete as multi-agent systems experiment with communication that never becomes text. One agent can pass a continuous internal representation—a latent state—into another agent's computation. The receiving agent can use it without anyone being able to read the handoff in an ordinary chat log.

The attraction is understandable. Latent communication may carry useful working state without paying the time and token cost of translating everything into language. But it changes what a complete audit trail means.

If a private channel can influence an action, recording only the public transcript is no longer enough.

What the new research shows

An August 19 preprint studies this problem in a controlled multi-agent auction. The researchers created a framework called Verifiable Latent Alignments, or VLA, that records selected latent handoffs and connects each one to the public action that followed it using a shared event identifier.

The monitoring approach combines three kinds of evidence. It asks whether the private state looks unusual compared with neutral communication, whether it changes the receiver's action distribution in a harmful direction, and whether sparse internal features offer supporting evidence for the alert.

In the authors' experiments, the sequential monitor reported a mean AUROC of 0.993 for same-family agent pairs and 0.854 for cross-family pairs when text and latent collusion were pooled as the positive class. The study also explored interventions that replaced a suspect handoff with a matched neutral state or changed agent instructions when hidden-state access was unavailable.

Those numbers need their boundaries. This was a synthetic auction using a fixed collusive code. The receiving agent was explicitly primed to interpret the private state, so the experiment did not discover agents spontaneously inventing a covert protocol. Part of the evaluation assumed that matched blocked or neutral control runs were available while a suspect event was scored.

The strongest white-box intervention reached exact recovery because it replayed the same neutral counterfactual used as the target. The paper correctly describes that result as a sanity check by construction, not general proof that covert agent coordination can always be removed.

This is therefore a proof of concept, not a report of a production incident. Its most useful contribution is an audit design: connect private influence to public effect, then test whether changing the private channel changes the action.

Start with an influence map

Teams often begin agent observability with a message history. That is a good start, but the real unit of review is broader: every channel through which one component can change what another component knows, remembers, or does.

For a deployed agent system, that map may include:

• natural-language messages between agents;
• latent-state or embedding handoffs;
• shared memory, scratchpads, and vector stores;
• tool results and files written for another agent to consume;
• event queues, workflow state, and brokered context;
• retrieved documents and policy state; and
• credentials, configuration, or environment changes that alter later decisions.

Not every channel needs the same content logging. Some records may be too sensitive, too large, or too dependent on proprietary model access to retain directly. But every consequential channel should have an explicit observability status. A team should know whether it captures the content, only metadata, a cryptographic digest, an input-output relationship, or nothing at all.

“Not observed” is a legitimate status. “Assumed to be in the transcript” is not.

Give one decision one identity

Distributed agent systems create evidence in many places. A broker records a handoff, a model runtime produces scores, a tool gateway authorizes an action, and an application records the visible result. If those records are joined later by timestamp alone, the most important relationship can remain ambiguous.

Use a stable event identifier that follows the decision across boundaries. For a consequential action, the record should make it possible to answer:

• Which agent and deployed configuration produced the action?
• Which public and private inputs preceded it?
• Which channels were delivered, blocked, replaced, or unavailable?
• Which policy and authorization decisions applied?
• What tool effect occurred, and what evidence confirms it?

The point is not to collect every possible internal value forever. It is to preserve enough linkage that an operator can reconstruct why an action was possible and which influence should be tested.

Separate unusual from influential

An anomaly is not automatically harmful. A latent state can look unfamiliar because the task, language, model version, or workload changed. Conversely, a familiar-looking input can still produce an unsafe result.

That makes causal testing especially valuable. Where the system permits it, replay a suspect decision with the channel blocked or replaced by an appropriate neutral control. Compare the resulting action distribution, tool choice, destination, or state change.

This does not turn every investigation into a laboratory experiment. Production replays can be costly, sensitive, or impossible. Teams can still design selected evaluation cases, shadow runs, and sandboxed incident reproductions that test the same question: did this channel materially influence the outcome?

The evidence hierarchy should remain clear. An unusual representation may justify inspection. A changed outcome under a controlled intervention is stronger evidence of influence. Neither, by itself, establishes intent.

Design for uneven visibility

The paper's distinction between white-box and black-box access reflects a common operating reality. A platform may inspect activations for a hosted model, see only requests and responses from an external provider, and have yet another level of visibility into a third-party agent or tool.

An audit design should record those differences rather than flatten them into one claim of “full observability.” Controls can then match the available evidence:

• With private-state access, test representation shifts and matched replacements.
• With message and tool visibility, preserve provenance and enforce action-level policy outside the model.
• With limited external visibility, narrow authority, destinations, and durable state so that an unseen influence has less room to become an unsafe effect.

This is also a useful procurement question. Before connecting another agent, runtime, or provider, ask which coordination channels it introduces and which of them can be recorded, constrained, replayed, or investigated.

The audit trail should follow the influence

The paper does not establish that production agents are secretly coordinating through hidden states. It does establish a credible reason not to equate a clean transcript with complete evidence when the architecture supports other channels.

Our view is that agent accountability should follow influence, not interface. If a handoff can shape a consequential action, it belongs in the system's control model even when no person can read it as a sentence.

The right question is no longer simply, “What did the agents say?” It is, “What could each agent receive, what changed because of it, and can we prove that relationship when it matters?”

Sources

• Beyond the Transcript paper and revision record