Witt Lab

Research

For each classical security guarantee, we determine what holds when system components become learned strategic principals, identify the assumptions that fail, and construct replacement guarantees where necessary. This requires building the agents against which those guarantees are tested.

The programme is problem-driven rather than method-driven. Depending on the question, we draw on game theory, cryptography and steganography, reinforcement learning and multi-agent learning, high-dimensional anomaly detection, and interpretability, and publish in AI, security and interdisciplinary venues.

Security has two levers: detect harmful behaviour, or constrain what agents may do. The lab establishes the limits of each against learned strategic agents and constructs the guarantees that remain. Both limits are stated relative to the agents they are tested on, so a third line builds reasoning and multi-agent capability at the frontier. Applied work in AI for science and public policy is listed under Publications.

AgendaOpen Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI AgentsarXiv preprint, 2025Multi-Agent Risks from Advanced AIarXiv preprint, 2025Extending the OWASP Multi-Agentic System Threat Modeling Guide: Insights from Multi-Agent Security ResearcharXiv preprint, 2025

Limits of detection

What can an adversary achieve while remaining provably undetectable to a monitor, a test or an evaluation?

Detection-based security assumes that harmful behaviour leaves a trace which a monitor, a test or an evaluation can find. We establish where this assumption fails against learned agents. Perfectly secure steganography shows that a covert channel can be made information-theoretically indistinguishable from ordinary output at practical efficiency, and secret collusion shows that language-model agents can use such channels; together they bound what any monitoring protocol can detect. Illusory attacks extend the argument to observation-space attacks on reinforcement-learning agents, and unelicitable backdoors to the model itself: a backdoor that no pre-deployment test can trigger, even with white-box access. Where detection remains feasible, we construct the detectors and state what they guarantee.

Limits of constraint

What can confined, individually secure agents jointly achieve that no per-agent constraint bounds?

Prevention-based security assumes that constraining what an agent may do bounds what it can achieve: a limited channel bounds leakage, a per-agent policy bounds the system, an isolation boundary bounds authority. Learned strategic agents violate this premise. Strategic confinement shows that bounding the capacity of a boundary need not bound the joint outcomes reachable by the agents on either side; above a threshold, the reachable set changes qualitatively. Architecture Matters shows that the topology in which agents are composed is itself a security parameter, and the multi-agent security tax quantifies what defences cost in coordination. Where constraints can be made to hold, we derive them from the structure of the system rather than from assumptions on model behaviour.

Guarantees by construction

  1. Proofs of Autonomy: Scalable and Practical Verification of AI AutonomyICML Workshop on Technical AI Governance, 2024
  2. Vet Your Agent: Towards Host-independent Autonomy via Verifiable Execution TracesACM ASIA CCS 2026

Frontier of capability

How far can learned agents reason and coordinate, and how does each advance move the two limits above?

Both limits are stated relative to the agents they are tested on, so the lab builds agents at the frontier. h1 trains language models to reason over horizons well beyond their training data by composing existing problems into long chains; rubric curriculum reinforcement learning extends training to domains without verifiable rewards; LongCoT benchmarks long chains of thought; and MALT trains reasoning across cooperating models. The multi-agent reinforcement learning line, QMIX and the StarCraft Multi-Agent Challenge, established coordination benchmarks that remain in use. Each advance moves the limits: longer horizons permit longer adversarial plans, and stronger coordination permits stronger collusion.