AI systems increasingly consist of learned agents that communicate, delegate, use tools and act strategically. Witt Lab studies which classical security guarantees hold in such systems, under which assumptions they fail, and what can replace them.
The lab also builds the reasoning and multi-agent systems it analyses. Security and capability are coupled: each new capability changes the threat model, and characterising a threat requires agents at the frontier of current capability.
Our working hypothesis is that security will become a fundamental bottleneck to the construction and deployment of superintelligent systems.
Based at the University of Oxford, Department of Engineering Science. Moving to UCL Computer Science and the UCL AI Centre in October 2026.41 researchers and affiliates.
Classical confinement bounds how much information can leak through a channel. When the confined parties are learned strategic agents, a bound on leakage need not bound what they can jointly achieve: past a threshold in permitted communication, the set of reachable joint outcomes changes qualitatively rather than by degree.
A taxonomy of the security problems that arise only once agents interact, an assessment of which classical tools apply and which fail, and a statement of the open questions.
Collusion is a collective anomaly: no single agent need look unusual, but the pattern across agents does. Per-agent deception probes, aggregated across the group, reach 1.00 AUROC in distribution and transfer zero-shot to new scenarios at 0.73 to 0.93 on Llama-3.1-70B. On a blackjack task where two agents hide a card count in table talk an LLM monitor cannot flag, detection reaches 0.99 to 1.00. The agents were instructed to collude, and detection requires white-box access to every agent.
Evaluating creative writing against rubric criteria is more tractable than generating it. Training against a curriculum of rubric criteria with pairwise preferences continues to improve beyond 1,000 steps, where baselines plateau or collapse, reaching a 70.5% human win rate on short fiction.
h1 composes existing problems into long-horizon chains, linking the output of one to the input of the next, so that reinforcement learning continues to scale without saturating. Long-horizon training retains its gains at pass@128 and transfers from easy to hard domains.
A cryptographic circuit inside a transformer makes the backdoor unelicitable: a defender with full white-box access, red-teaming and formal methods cannot activate it ahead of deployment. The construction is also robust to current mitigations, which has implications for pre-deployment detection as a defensive strategy.
Steganography is only the channel. Secret collusion is a game: agents with a shared incentive must agree on an encoding the monitor cannot detect, and must reach that agreement without a pre-shared key the monitor could find. We formalise the interaction between colluding agents and the monitor, state the capability, incentive and common-knowledge conditions under which collusion arises, and show which mitigations survive against agents that optimise against the monitor.
Existing observation-space attacks on reinforcement learning agents are detectable because they ignore information-theoretic detectability. ε-illusory attacks bound the statistical detectability of the perturbed observations, in the sense of steganalysis, and remain effective; they are harder to detect both for automated methods and for human observers.
Coupling the covertext distribution to the message distribution through a minimum entropy coupling gives an information-theoretically secure stegosystem that remains efficient enough to use with generative models. The method was patented in the UK and open-sourced in 2025.
A framework for empirical multi-agent safety and security evaluations built on the UK AI Security Institute's Inspect. Centralised and decentralised systems with arbitrary topologies, scheduling and memory sharing; five scenario families, four threat types (prompt injection, compromised agent, collusion, misuse) and four defence strategies, configured in YAML.
Released
Details and quick startA three-tier benchmark for detecting collusion between language-model agents from their activations, under environment distribution shift: 50 committee scenarios across 17 domains, six structurally different transfer families, and a steganographic blackjack task. Ships with the probing pipeline and dataset.
Released
Details and quick start
Founder and principal investigator. Leads the multi-agent security programme and the capability research required to test it.
Postdoctoral fellow
Postdoctoral fellow (PDRA). University of Oxford and UCL
PhD in Economics from New York University. Uses deep and reinforcement learning to model and predict how agents behave in socioeconomic settings; co-first author of Bayesian Exploration Networks (ICML 2024).
PhD students
Associates
Witt Lab studies multi-agent security: the security properties of systems whose parties are learned agents that reason, communicate and pursue their own objectives. For each classical guarantee, the lab determines what holds under this change, which assumptions fail, and what replaces them. The lab was founded by Christian Schroeder de Witt at the University of Oxford and moves to UCL Computer Science and the UCL AI Centre in October 2026.
About the labWe seek researchers who want to formulate new security problems as well as evaluate existing ones. Members have backgrounds in security, cryptography, game theory, machine learning and AI safety.
We also build the reasoning and multi-agent systems needed to study security at the frontier of capability; the guarantees under study can only be evaluated against agents capable enough to test them.
Openings and how to apply
