Deleting the strongest message is not enough: collective dependence analysis cuts controlled multi-agent violations from 93% to 6%
Synopsis
Individually compliant language model agents can still jointly support a policy violation through messages that are harmless one by one. Collective Dependence Analysis (CDA) measures each message's necessity and sufficiency by removing and retaining it, cutting violations from 93% to 6% in controlled conversations and from 98% to 9% in agent-generated operational ones. It returns both an explanation and a minimal intervention set, though jointly required groups resist exact recovery and removals can also disrupt correct decisions.
Interpretation
Messages that each look permissible can together push an agent toward a violating action, and removing such messages as a group works far better than deleting the single most influential one. Earlier monitoring targeted a single agent's outputs or actions, or looked for signals in internal representations and conversation streams, without a quantitative answer to which messages jointly sustained the violation. Across 2,520 controlled conversations, CDA's selected removals lowered violations from 93% to 6% on 1,670 qualifying harmful conversations; removing only the highest-necessity message left 45%, and removing an equal number of random messages left 88%.
The method converts each message's necessity and sufficiency into changes in support for an action, then enumerates combinations inside a fixed-size candidate core to find the smallest removal set and a retained set sufficient to sustain the action. Necessity is the support lost when a message is deleted, and sufficiency is the support a message supplies alone against the no-message baseline; together they separate single-message support, jointly required facts, interchangeable redundancy and mixed structure. In a software-deployment task where agents wrote their own messages, removals lowered violations from 98% to 9% across 485 qualifying violations and raised correct deployment decisions from 20% to 79%; redundancy was the most common collective form, at 61% of qualifying violations.
Perspective
The demonstrated scope is planted controlled violations, operational conversations generated by Llama-3.3-70B agents, recorded Among Us games and Terrarium meeting-scheduling logs, with removal effects measured by replaying the deciding agent. The method targets monitoring and safety researchers who need to locate and interrupt collective violations, and its thresholds stay fixed on the held-out access and payment tasks.
Jointly required message groups are hard to recover completely, and none of the held-out joint triples received an exact explanation; intervention weakens as conversations grow, with redundant triples still leaving a 0.66 violation rate at 200 messages. Removals also disrupt correct decisions, lowering correct votes against impostors in Among Us from 92% to 54%, and explanation plausibility rests on model annotation, with human validation still outstanding.