Every agent passed. The system failed.

Give six agents a cap of 10 each on a pool of 40. Each agent checks its own draw against its own cap and passes. The six draws add to 60. The pool is breached and no local check saw it, because no local check reads the sum.

Change the population, the local allowance and the shared bound. The page shows the sum of the local maxima against the bound. This panel is arithmetic and is labelled as such; it is not a simulation.

Interactive research explainer · AMLUCS 2026

Six agents, one finite pool. Drag a draw, switch the control from per-agent caps to a shared meter, and break each of the three preconditions the aggregate guarantee rests on. A 55-second automatic run walks through the poster's argument.

Launch interactive

• The empirical language-model agents in the study did not communicate; their compliant collective breach was not collusion.
• The formal result covers joint worst-case choice of the draw vector; the exhibit animates the poster's mathematical examples, not the study's episodes, which used a budget of 100.
• Informing an agent about shared state is not enforcement. The enforced shared meter in the exhibit differs from the study's informational METER prompt.
• Correction: earlier versions of this page and the AMLUCS 2026 poster said the sum rule bounds a harm if and only if (or only if) the harm is a function of the sum. That is not established and is false in both directions in the same model: a harm that depends on who drew is bounded when its threshold equals the pool (tested at pool 40), and a harm that is a function of the sum (under-use, G minus the sum, tested with a danger threshold of 30 at pool 40) is not bounded by the sum rule at that setting. What was shown is the two-harm contrast described here. As of this correction the poster PDF still carries the earlier wording.
• The aggregate guarantee was shown for a harm equal to the sum, under preconditions stated here: the meter is conserved over the full horizon and the sum is read atomically. A harm equal to one agent's draw escapes it when its threshold is below the pool. Which other harms a sum rule bounds is not characterised.

A model-level illustration with non-negative integer draws and one scalar pool. No claim about any deployed system. The recording of the automatic run is not published here.

Blind to the pool, the budget was breached in 60 of 60 episodes on each of three models with no agent over its own allowance. With the pool state shown the budget was still breached on every model, at rates that differ by model; the per-cell counts, including episodes where an agent exceeded its own allowance, are in the table on the collective-bound page.

Read the denominators. 60 / 60 is two cells of 30 episodes on one model. A single cell (for example gpt-4.1-mini at N = 3, PEERSUM 0 / 30) is not the pooled result: the same model at N = 6 in the same condition is 7 / 30. The per-cell table, including episodes where an agent exceeded its own allowance, is below.

Individual allowance violations. Across the cells in the table below, an agent drew more than its own allowance in 18 episodes, all in four cells: gemini-2.5-flash SOUND_N6_METER 3 of 30, SOUND_N6_PEERS 1 of 30 and UNSOUND_N6_RESTATE 1 of 30; gpt-4.1-mini SOUND_N3_PEERS 13 of 30.

Scripted greedy agents, not models: impossible-breach 0 / 60 (expected 0) and forced-breach 60 / 60 (expected all). Both fired. A scorer that could not fail would certify nothing.

Put one rule on the sum. A meter that refuses any draw carrying the running total past the bound does not read who acted or what they said to each other. It reads one number. So it holds against coordination it cannot see, because detection was never on the path to the guarantee.

The guarantee rests on three preconditions, each of which the formal artifacts state and each of which can be broken on purpose. In the model they are: the harm is the aggregate itself; the aggregate is conserved over the full horizon; and the meter reads it atomically. Each relaxation breached at the settings tested. These are conditions under which the guarantee was checked, not a proved list of the only ones: relaxing the first is not always fatal (with the allocation threshold at the pool the same harm is bounded).

P1 · Harm equal to the aggregate

The guarantee was shown for a harm equal to the total. If the harm is one victim's draw above a threshold below the pool, a colluding population can route the pool to that victim while the meter reads compliant. Not every harm that depends on who drew escapes: with the threshold at the pool, the same harm is bounded.

P2 · Conserved over the full horizon

The meter must hold across the whole span over which harm accrues. A budget that resets each period re-arms itself.

P3 · Atomic observation of the aggregate

The meter must read the true total at the moment it decides. A counter that lags admits a multiple of the bound.

Each panel relaxes one precondition. The values are the Z3 witnesses and the learner's realised maxima from the sealed experiment record; the sliders select among them. Nothing here is generated on the fly.

Inside all three preconditions the bound holds against arbitrary coordination. Outside any one, a coordinated population breaches while every local check passes.

In plain terms: a kernel-checked proof says that six agents inside a cap of 10 breach a budget of 40, that a rule on the sum removes every such breach, and that the rule still permits a within-budget profile. A solver then checks two harms in the same model: the sum rule bounds a harm equal to the sum, and does not bound a harm equal to one recipient's draw when its danger threshold (15) is below the pool (40); a per-recipient cap closes that case. That is a contrast between two chosen harms, not a characterisation of which harms a sum rule bounds. The solver also shows the meter is blind to any coordination channel in the model.

Z3 proved the bound holds over the encoded model (UNSAT); an adversarial reinforcement-learning run of 180,000 episodes, rewarded to breach it, was not observed to exceed the pool bound G (40 for N = 6, 63 for N = 10) in any episode. The guarantee is the UNSAT result over the encoding; the run corroborates it. Three hand-constructed relaxations, one per precondition, are each exploitable to the predicted magnitude, and each breach carries a Z3 witness.