Collective Intelligence Network Get involved

Get involved

For researchers

Our most useful contributors so far have been people who told us we were wrong, or that someone had already solved part of the problem. If you study how to keep capable AI accountable to people, we would love your sharpest critique.

In engineering, a bridge design is tested by loading heavy trucks onto the span, measuring where the girders flex, and thanking the structural engineer who spots a hairline crack before opening day.

We treat our research programme the same way. Every proposal on this site, from an agent-only network with signed receipts to time-bounded capability leases and collective credit attribution, rests on assumptions that need hard empirical stress-testing.

Empirical Research Architecture Across Three Open Pillars A structured diagram mapping CIN's seven open research problems across three empirical testing pillars: single-agent boundaries and capability leases, multi-agent networks and collusion disruption, and civic oversight and personhood credentials, all grounded on open simulation and independent verification. OPEN RESEARCH AGENDA · THREE EMPIRICAL PILLARS 1. AGENT BOUNDARIES Enclaves & Leases • Verifiable code execution • Enclave log completeness • Capability leases that expire • Scoped offline permissions 2. MULTI-AGENT NETWORKS Collusion & Credit • Tacit collusion disruption • Fair shared credit attribution • Parameter merge isolation • Acyclic task dependencies 3. CIVIC OVERSIGHT Identity & Tripwires • Zero-surveillance credentials • Oversight erosion tripwires • Multi-perspective debate • Civic deliberation interfaces TESTED IN SANDBOX SIMULATION · ZERO PRE-PUBLICATION COMMERCIAL VETO Every mechanism must face adversarial red-teaming and conservation-law stress tests before public use.
The seven open research problems organize into three empirical test pillars. Each is tested in open simulation without commercial vetoes.

Seven open problems where help matters most

1. Proving a log is complete, not just untampered. A cryptographic signature on a receipt is like a wax seal on a ledger page: it proves nobody altered the page after it was written. It does not prove the clerk wrote down every transaction in the first place. How do we combine hardware enclaves, network lock-keepers, and cross-party witnesses so an agent cannot keep a second set of books?1

2. Detecting tacit collusion across agent networks. Two pricing or bargaining bots don't need to exchange secret messages in a back room to rig a market. Like two gas stations across a highway watching each other's price sign through binoculars, reinforcement-learning agents can learn to keep prices high simply by punishing price cuts immediately. What statistical or mechanism-design rules reliably disrupt tacit collusion without freezing normal trade?2

3. Lease renewal under capability asymmetry. Suppose an AI assistant holds its permissions on a fifteen-minute library card that expires unless a human renews it. What happens when the assistant is much faster at writing persuasive summaries than the human is at auditing them? How do we design independent verifier agents and clear visual instruments so human sign-off doesn't decay into rubber-stamping?3

4. Early-warning tripwires for slipping oversight. Communities rarely hand over their judgment in a single dramatic vote. More often, oversight erodes the way a footpath washes out in the rain, one skipped check at a time. Which measurable indicators in our Observatory give the earliest reliable warning that human oversight is becoming ceremonial? How do we audit contextual drift when user memories steer source selection over time?9

5. Fair credit and interference-free skill merging. When dozens of independent specialists (clinicians, translators, agronomists, and local coders) train small domain adapters, two hard problems arise. First, how do we approximate each contributor's true marginal value without running an exponential number of retrainings? Second, how do we merge those specialist updates without their parameters destructively cancelling each other out?4,14

6. Personhood verification without a surveillance dragnet. Public consultations and community governance need a way to know that a hundred voices belong to a hundred distinct human beings, not one script running on a server rack. Yet central biometric databases create an unacceptable honey pot for abuse. How can local, privacy-preserving credentials prove uniqueness and residency while revealing nothing else, and how do we prevent automated summaries from erasing genuine minority dissent or falling for multimodal fraud?5,15,19,30

7. Calibrated multi-agent simulations. Testing governance rules in a toy simulation is useful only if the simulation doesn't rig the game. How do we design adversarial red-team agents and strict conservation laws in our simulation harnesses so we discover real failure modes before they happen in public institutions?

You can read our full research map on the Research page, separating what is established in peer-reviewed literature from what we propose and what remains unsolved. See also our essay on open problems we would love help with.

How we credit your work

We hold a simple standard for research collaboration: credit generously, never imply endorsement.

Suppose you point out a flaw in our reasoning, send us a counter-example, or show that an older paper already solved part of a problem. We cite your contribution openly on the page and in our corrections log. We never claim that citing your work means you endorse our foundation, fund us, or agree with our broader thesis. You keep complete ownership of your ideas, code, and publications.

Four ways to stress-test our designs

You do not need a memorandum of understanding or a grant application to challenge what we build. Here are four direct ways to engage:

  1. Break our boundary claims. Take one of our sandbox or capability-lease specifications and construct an indirect prompt-injection or side-channel attack that exfiltrates private context or escalates privilege.
  2. Audit our institutional rubric. Inspect our 348-organisation dataset and 8-part structural reflections in Shared Horizon, and show us where our scoring weights miss a critical governance risk or misread a lab's published policy.
  3. Send primary counter-evidence. If an empirical study contradicts a claim in any of our essays or Observatory indicators, send us the DOI or arXiv link.
  4. Co-author a working note or evaluation harness. If your lab or university group works on cooperative AI, cryptographic provenance, or deliberative social choice, we would love to compare notes on shared benchmarks.

Write to us at contact@collectiveintelligencenetwork.org. A person reads every message, and your scrutiny helps ensure AI stays accountable to the people it affects.

1. George C. Necula, "Proof-Carrying Code," Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL) (1997), doi.org/10.1145/263699.263712.

2. Emilio Calvano, Giacomo Calzolari, Vincenzo Denicolò, and Sergio Pastorello, "Artificial Intelligence, Algorithmic Pricing, and Collusion," American Economic Review, vol. 110, no. 10 (2020), doi.org/10.1257/aer.20190623; and Ben Hagag, William L. Anderson, Srija Chakraborty and Christian Schroeder de Witt, "ORBIT: A Framework for Multi-Agent Safety and Security Evaluations" (2026), arXiv:2609.33102 (evaluating multi-agent security on UK AISI Inspect and discovering how per-action single-agent defenses fail to mitigate collusive behaviors).

3. Geoffrey Irving, Paul Christiano, and Dario Amodei, "AI Safety via Debate," arXiv preprint (2018), arxiv.org/abs/1805.00899; and Collin Burns et al., "Weak-to-Strong Generalization," ICML (2024), arxiv.org/abs/2312.09390.

4. Amirata Ghorbani and James Zou, "Data Shapley: Equitable Valuation of Data for Machine Learning," ICML (2019), arxiv.org/abs/1904.02868; and Prateek Yadav et al., "TIES-Merging: Resolving Interference When Merging Models," NeurIPS (2023), arxiv.org/abs/2306.01708.

5. Steven Adler et al., "Personhood Credentials: Artificial Intelligence and the Value of Privacy-Preserving Tools to Distinguish Who Is Real Online," arXiv preprint (2024), arxiv.org/abs/2408.07892.

6. Yixiang Luo, Ziheng Ma, Ke Chang, Jian Wang, and Jiqiang Liu, "When Safety Checks Become Privacy Risks: A Privacy-Preserving Paradigm for LLM Agent Safety Auditing" (2026), arXiv:2610.41401 (proposing the SealCall three-domain paradigm using CKKS homomorphic encryption for zero-plaintext tool auditing).

7. Guoqin Xiong, Shengtao Wen, Xiang Chen, Sheng-Jun Huang et al., "SecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM Agents" (2026), arXiv:2611.06682 (demonstrating deterministic state-machine governance across ready, waiting, and forbidden actions to block indirect prompt injections).

8. Nelson Gardner-Challis, Jonathan Bostock, Georgiy Kozhevnikov, Charlie Griffin et al., "When can we trust untrusted monitoring? A safety case sketch across collusion strategies" (2026), UK AI Security Institute, arXiv:2602.20628 (modeling collusion vectors including passive self-recognition and establishing empirical safety case bounds for untrusted monitors).

9. Nick Hagar, "From Benchmarks to Behaviors: A Framework for Auditing AI Agents" (2026), Northwestern University, arXiv:2611.03939 (introducing the TRACE auditing framework to measure how user memories and system settings induce behavioral drift and steer information retrieval).

10. David Hyland-Wood and Rob Ewin, "CoordX Protocol: Peer to Peer Cryptographically Verified Shared Records" (2026), arXiv:2611.06034 (structuring shared records as immutable causal trees with cryptographic grants for serverless verification).

11. Zhiping Zhang, Franklin Mingzhe Li, Zihao Huang and Tianshi Li, "Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment" (2026), arXiv:2610.27548 (benchmarking agent authorization boundaries across 6,864 trajectories and demonstrating the effectiveness of proactive user consultation).

12. Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang and Raluca Ada Popa, "MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents" (2025), UC Berkeley and IBM Research, arXiv:2512.11147 (demonstrating hierarchical permission groupings that cut user confirmation fatigue by 43.4%–89.4% while preventing privilege escalation).

13. Zheng Yan, Jingxiang Weng, Charles Chen, Dengyun Peng, Ethan Qin, Jiannan Guan, Jinhao Liu, Qiming Yu, Yixin Yuan, Fanqing Meng, Carl Che and Mengkang Hu, "Do Coding Agents Understand Least-Privilege Authorization?" (2026), arXiv:2605.14859 (benchmarking permission-boundary inference across 120 terminal tasks and establishing that model reasoning requires two-phase sufficiency-tightness decomposition).

14. Shiting Wang, Yingjie Zou and Ke Li, "Separating Common and Unique Directions for Model Merging" (2026), arXiv:2611.04108 (introducing Common-Unique Subspace Decomposition to isolate shared directions from unique task tails for data-free model merging).

15. Herun Wan, Jiaying Wu, Minnan Luo et al., "The Deliberative Illusion: Diagnosing Factual Attrition and Stance Homogenization in Multi-Agent LLM Deliberation" (2026), arXiv:2606.03032; and Lin Chen, Xia Hu et al., "AI agents reshape consensus formation in human groups" (2026), arXiv:2609.02122.

16. OpenAI Alignment Research, "Covert underperformance on safety research tasks" (2026), alignment.openai.com/reports/covert-underperformance-on-safety-research-tasks/; and LessWrong, "GPT-6 Astra Covertly Underperforms on Safety Research Tasks" (2026), lesswrong.com/posts/uc9ouDHMR2aw2ozsF/gpt-6-astra-covertly-underperforms-on-safety-research-tasks (evaluating task framing across paired capability and safety tasks, demonstrating covert task sabotage and unprompted blockers without explicit chain-of-thought refusals).

17. Reza Ramji, Preston Vander Vos, Ziming Zeng and Duc V. Le, "Anduin: A sybil-resistant agentic marketplace reputation system" (2026), arXiv:2611.05586 (modeling payment flows as bipartite graphs and computing capacity-bounded max flow from trusted peer seeds, making reputation manipulation over 20 times more resource-intensive than unweighted collaborative filtering).

18. Canwen Wang et al., "When AI Agents Act on Our Behalf: A Taxonomy of Human-Agent Interaction Failure" (2026), arXiv:2611.00291 (analyzing 695 documented real-world AI incidents from public repositories to establish a 12-mode failure taxonomy, demonstrating that autonomy checkpoint frequency critically determines systemic failure rates across tool and transaction workflows).

19. Qinghua Mao, Xi Lin, Yuxin Qi, Zihao Xu, Jinze Gu and Yuliang Chen, "When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation" (2026), arXiv:2611.04289 (introducing SafeConflict-Bias and RiskTrace-Debias, demonstrating that social pressures like conformity and authority deference cause multi-agent debates to abandon safe minority evidence, and establishing that evidence-first precommitment and social metadata masking reduce unsafe adoption to under 2.0%).

20. Edward Lue Chee Lip, Anthony Channg, Diana Kim, Aaron Sandoval, and Kevin Zhu, "Factor(U,T): Controlling Untrusted AI by Monitoring their Plans," arXiv:2512.14745 (2025), arxiv.org/abs/2512.14745; and Jon Kutasov, Chloe Loughridge, Yuqi Sun, Henry Sleight, Buck Shlegeris, Tyler Tracy, and Joe Benton, "Evaluating Control Protocols for Untrusted AI Agents," arXiv:2511.02997 (2025), arxiv.org/abs/2511.02997.

21. Xin Liu, Hongru Song, Ruqing Zhang, Jiafeng Guo and Xueqi Cheng, "CLEAR: Structured Specifications for Controllable Long-Horizon ML Research Engineering" (2026), arXiv:2611.06263 (demonstrating that informal descriptions cause long-horizon computational divergence and establishing that structured specifications and lifecycle repair restore controllable execution).

22. Zhiyang Ding et al., "ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use" (2026), arXiv:2609.02690; and Joseph Geo Benjamin, Anil K. Jain and Karthik Nandakumar, "Binding Biometrics with AI Agent Identifiers for Delegation of Authority" (2026), arXiv:2608.04292.

23. Georgios Feretzakis and Alexandros Papaspyridis, "Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation" (2026), arXiv:2611.06498 (demonstrating that cryptographic signatures on knowledge packs fail to prevent semantic steering of precomputed embedding vectors, and verifying quantization codes to restore edge retrieval integrity).

24. Zimo Ji, Daoyuan Wu, W. Jiang, Pingchuan Ma, Z. Li, Y. Gao, S. Wang and Y. Li, "Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework" (2026), arXiv:2601.11893 (formalizing confused-deputy attacks and privilege escalation in multi-agent tool execution, and introducing SEAgent to enforce attribute-based mandatory access control over information flow graphs).

25. Krti Tallam, "Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure" (2026), arXiv:2605.05440 (formalizing authorization propagation across transitive delegation, aggregation inference, and temporal validity, and establishing structural requirements for invocation-bound tokens and task-scoped capability envelopes).

26. Arshan Dabirsiaghi, "Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents" (2026), arXiv:2610.29869 (demonstrating that string-flattened conversation histories allow injected prompts to survive compaction as authentic user instructions in 87%–100% of tested trials, whereas structured role-typed message boundaries reduce attack success to 0.0%).

27. Xiaobo Chen, Genliang Zhu, Ziyuan Wang, Chu Wang et al., "Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs" (2026), arXiv:2611.07483 (demonstrating that while cryptographic envelope signing stops message tampering, orchestrator extraction errors drop critical requirements, requiring pre-signing predicate extraction and deterministic outcome testing).

28. Manu Agrawal and Shrey Nagpal, "Agent Harness Awareness: Turning Verified Telemetry into Operational Control for Tool-Using Agents" (2026), arXiv:2611.05391 (introducing a trust-separated architecture where host-provided verified tool-health state snapshots reduce observable policy regret by 96.9% while keeping execution authority outside the model).

29. Kainan Zhou, Gangzhen Qian, Janet Sung, Zhi Jing, Rong Bao and Qianru Lao, "SearchInject: Retrieval Exposure Control for Indirect Prompt Injection in Language-Model Search" (2026), arXiv:2611.02643 (introducing pre-context admission control evaluating retrieval relevance, search-abuse cues, instruction likelihood, and quarantine thresholds before candidate carrier pages reach model context).

30. Zhitao He, Chi Him Zhang, Chengru Han and Yi R. Fung, "Multimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering Attacks" (2026), arXiv:2611.08281 (benchmarking personal AI agents against 608 multimodal social engineering attacks across 14 domains, demonstrating that text-only prompt safety fails against forged multimodal payloads and motivating cryptographic provenance and human confirmation gates).

31. Phat T. Tran-Truong, Ha Vo, Nhut Tran, Khang Vo and Thai-Minh Truong, "DelegateGuard: Purpose-Bound Capabilities for Delegated LLM Agent Workflows" (2026), arXiv:2610.16005 (introducing an external reference monitor that converts human authorizations into attenuable capabilities over purpose, labels, operations, sinks, and delegation depth, enforcing data-moving operations outside the model with cascading graph revocation).