Blog · arXiv Analysis · Published: August 12, 2026 · Modified: August 12, 2026 · Last reviewed: August 12, 2026

The Similarity Score Becomes the Collusion Surface

The paper's most useful result is not that similar agents cooperate. It is that a percentage—sometimes ungrounded or associated with random behavior—can alter a model's strategic choice.

A similarity score that changes action belongs to the control plane. Without provenance, relevance, and an affected-party test, it can become a collusion surface.

The Paper

The source is Akash Kundu, Emanuel Tewolde, Ratip Emin Berker, Samuel F. Brown, and Vincent Conitzer's Do LLMs Take Care of Their Own? Similarity Signals Can Induce Cooperation, arXiv:2608.12125v1 [cs.GT, with cs.AI, cs.CL, and cs.MA], submitted August 12, 2026. The study evaluates nine language models, five mixed-motive games, and seven established plus three custom benchmark domains. Its initial experiment inserts an abstract similarity percentage into a strategic-game prompt; later experiments connect the score to benchmark responses or ask a model to assess another model's responses and explanations.

The title invites anthropomorphism, but the experiment does not test whether a system recognizes kin, possesses group loyalty, or has an inner sense of identity. “Their own” is an experimental framing. The measured outcome is a generated game action under a prompt.

The Score Is an Intervention

In the paper's first study, the score runs from 0 to 100 percent in ten-point steps. It initially has no measurement basis. The authors also compare a condition in which the score is unavailable with one in which similarity is not mentioned. That design isolates an important fact: the displayed number is not merely a description of the players. It is information placed into the decision context, and some tested models use it to change action.

This distinction matters for deployment. A field named similarity may look like harmless metadata. If downstream behavior depends on it, the field is a policy input. Its producer, evidence, scope, and authority become security questions.

What Changed in the Game

In the standard one-shot Prisoner's Dilemma baseline, the paper reports that every tested modern model except GPT-4o essentially always defected. Six of the nine models then showed monotonically increasing cooperation as the abstract score rose, reaching full cooperation somewhere between 60 and 80 percent. GPT-5.4-mini continued to defect; Claude Haiku 4.5 followed a non-monotonic curve. The same methods section says each model decision used ten samples and reports means and standard errors.

Those curves demonstrate prompt-conditioned behavior, not a universal law of agent cooperation. In this paper, “cooperate” names the action that improves the modeled players' joint payoff. It does not mean the model is aligned with a user, institution, or public.

The Grounding Failure

The paper's sharpest governance result appears when the score is said to come from a domain. Across ten benchmark domains, models often behaved much as they had when the number was ungrounded. According to the grounding experiment, only DeepSeek and Gemma distinguished the random coin and die domains as noise, and even they did not fully ignore a 100-percent random score. The authors conclude that a score disconnected from strategic behavior can work as a persuasive label rather than evidence.

That is not a demonstration of a malicious spoofing attack; the irrelevant and random signals were controlled experimental conditions. It is evidence for a plausible attack surface: if an unverified scalar can influence a decision, an operator or counterparty may have an incentive to manufacture, select, or frame that scalar.

The Evaluator Can Inflate the Signal

For practical grounding, the authors compare externally computed response agreement with scores assigned by a model after viewing another model's decisions, explanations, or both. In the reported results, externally computed variation depended more on the benchmark, while model-assigned variation depended more on the judging model. Explanations often supported higher judged similarity than decisions alone.

This is a feedback problem, not evidence of introspection. A model-generated assessment can become an input to another model-generated decision. Calling both stages “self-evaluation” does not make the score independent, calibrated, or trustworthy.

Cooperation for Whom?

Mutual benefit inside a two-player payoff table can conflict with the interests of people outside it. The paper's ethical statement explicitly warns that similar agents could collude against users or third parties, that similarity can amplify correlated failure, and that fabricated signals could manipulate deployed agents. It cautions against unverifiable signals.

A cooperation metric therefore needs a beneficiary map. Who receives the gains, who bears the loss, who authorized coordination, and who can contest the outcome? Without those answers, a higher cooperation rate can describe a better cartel.

The Similarity-Signal Receipt

A similarity-signal receipt should record the score, producer, authenticated source, computation method, benchmark and domain, sample and time window, model and prompt versions, uncertainty, intended recipient, permitted purpose, expiration, decision sensitivity, affected parties, collusion tests, correlated-failure tests, logs, override, and rollback rule. A model should not be allowed to certify a score that grants that same model additional strategic latitude.

Unverified similarity should default to no authority. Relevance must also be tested: agreement on trivia, moral vignettes, or random sequences is not automatically evidence that two agents will make the same decision in a transaction. Authentication can establish who sent a score; it cannot establish that the score is fit for purpose.

The Claim Boundary

The work studies stylized, mostly symmetric games under fixed prompts. The initial curves use ten samples per decision, and after the nine-model first study, later analyses use a five-model subset. The experimental appendix reports OpenRouter access, temperature 1, chain-of-thought prompting, and low reasoning effort where controllable. The paper does not measure production collusion, real user harm, long-running institutions, or an adversary defeating a deployed safeguard.

The authors publish an evaluation artifact pinned here to commit 84b82eca, including prompts, benchmark implementations, configurations, analysis code, and tests. Public code improves inspection of the intervention, but it does not expand the empirical population beyond the documented experiments.

The Governance Standard

The research shows both a mechanism and its warning label. Similarity can help modeled agents escape some dilemmas, yet the score can remain behaviorally potent when its grounding is weak. Before such a signal reaches an agent, require provenance, domain relevance, least authority, affected-party review, collusion evaluation, and a safe path that ignores it. Cooperation is not alignment until the beneficiary and the boundary are named.

Sources

Return to Blog