Replay in learned message channels

Can a valid message that is recorded and sent again make a team of agents with a learned message channel fail? Which defense can detect it? A preregistered CPU test trains teams of two agents on Beacon, a small two-dimensional catch task. The main analysis uses 20 teams.

A speaker sees a beacon that moves and sends a learned message of 64 numbers at each step. A listener with no memory reads the message and moves to catch the beacon. The attacker on the transport only replays recorded messages, and it has no key.

A replay of the step-0 message at every later step (stale replay) cuts the team success from 0.987 to 0.615. The message stream of another episode (foreign replay) cuts it to 0.245, below silence at 0.305. The loss of success is 0.372 (98.75% interval 0.360 to 0.384) and 0.742 (0.733 to 0.751).

A kNN monitor and a PCA monitor, fit on benign messages, cannot flag either replay. On the stale replay, their AUROC is 0.087 and 0.161, so they rank the replay as more typical than benign traffic. Monitors that also read the listener’s own view cannot flag the replays either. A wire monitor cannot read the content, so it cannot see that the content is old or foreign.

A MAC over the message, a session nonce and a step counter rejects both replays. Against the foreign replay, the trained fallback then gives back 0.060 of success. Against the stale replay, the MAC costs 0.308, because a stale message still carries useful content. But the MAC declares each failure. With no defense, 38.5% and 75.5% of the episodes fail silently, and under the MAC no failure is silent. Teams trained with blackout episodes keep 0.137 more success after a rejection than teams trained without them.

A five-step lag costs only 0.030. Thus it is possible that a MAC with an age limit keeps most of the success and still declares the replay. That rule is not tested.

An exploratory analysis of saved runs asks if an influence score can do better. The score measures how far a message moves the answer distribution of the receiver from a reference. On a two-bit toy channel with a 0.36B receiver, it does not separate replayed from benign messages: AUROC 0.524 (95% CI 0.493 to 0.553). The cause is structural: the receiver reads the same query on every row. Thus a replay gives exactly the output of another row’s benign message. The three data sets of this analysis share structure, so its pooled CI is too narrow.

The score is not blind, because content-free random messages have much less influence than benign messages (AUROC 0.058). Thus the score measures how far a message steers the receiver, not if the content fits the input. In the Beacon test, the listener has its own view. There, a similar score gives a replay less influence than a benign message (AUROC 0.365 and 0.463, descriptive).

Limits: the Beacon test is a toy result in one environment, with one algorithm (A2C), small networks and a listener with no memory. The teams are very similar, so the narrow intervals describe this toy only. It is not a result on large language models. The attacker only replays, and no adaptive attacker was tested. The MAC rejections hold by construction; the run measured the success after the fallback. There is one run: a second statistics script in the same project agrees, but no outside party checked the work.