Monte Found a Decorative Channel and a Reward Exploit in One of Our Benchmarks

May 22, 2026

Monte is our internal adversarial engine. Instead of running scripted perturbations it trains RL adversaries and points them at systems that don’t behave the same way twice: RL policies, robotics stacks, multi-agent swarms, agentic systems built on LLMs. Its job is to find the blind spot before production does.

Because the adversaries are trained rather than scripted, they co-evolve with the system under test and carry what they learned across versions. A static test suite checks the same things every time. A Monte adversary finds that a navigation policy has a blind spot at 47 degrees, or that a swarm is gaming episode length, and leans on it in ways nobody wrote a test for.

Monte is a different internal product from Proofload. Proofload is a statistical instrument: it measures where a system breaks and whether a fix moved the boundary, and it trains no adversaries. The two answer different questions. This post is Monte’s.

This post is about two of those exploit classes hitting one of our MARL benchmarks in a single run: a semantic man-in-the-middle attack on inter-agent communication, and a reward exploit the swarm had learned during training without anyone noticing. We found the second because we were looking for the first.

The setup

Babel is one of our MARL benchmarks at Poisson Labs, built to stress-test Monte’s communication-attack class. It’s deliberately small: asymmetric information, a narrow channel, and a task that’s supposed to require coordination.

It uses a 12-node procedural graph. Resource demands appear at random nodes. The agent team has two roles:

• Scouts have global visibility into active demands, but cannot act.
• Responders can move and satisfy demands, but are blind beyond a two-hop local view.

The intended solution is that Scouts observe the demand state, encode it into an 8-bit symbolic channel, and Responders decode those messages into routing decisions.

The same shape shows up outside a benchmark: a planner agent passing context to an executor, or a reconnaissance drone broadcasting coordinates to a swarm. If the handoff isn’t doing anything, the system is flying blind and the metrics won’t say so.

We trained a four-agent MAPPO team with parameter sharing across roles. The baseline looked good:

That’s a 30-point gap, and it made the channel look load-bearing, so we pointed Monte at it.

The attack

Monte runs a semantic man-in-the-middle adversary. It doesn’t add noise. It changes the meaning of what’s being passed between agents and measures whether downstream behaviour changes.

In this case the agents’ 8-bit language was emergent, and we couldn’t spoof it by flipping bits because we didn’t know what any given symbol meant to the trained policy. So Monte went one level earlier and modified the Scout’s observation instead. It injected a fake demand into the Scout’s input and let the Scout’s own frozen policy encode that fake observation into whatever protocol the agents had learned. What came out was a valid message, produced by the agent’s own encoder, about a world that didn’t exist. At 100% interception every Scout message was built that way.

We expected performance to fall from 51.2% back toward the 21.1% no-communication baseline. It fell to 48.4%.

The channel had looked responsible for a 30-point lift. Under semantic spoofing, removing the truth from that channel cost 2.8 points. The other 27 points were coming from somewhere else.

Finding 1: The channel was decorative

The Responders had learned a policy that mostly ignored the Scouts. The channel was worth 2.8 points of task satisfaction, not 30. The Scouts were broadcasting, the Responders were moving, the team was collecting reward, and the messages weren’t doing much work. That’s what the communication-attack class is for: not whether a system performs well, but whether the information moving between its parts is actually carrying weight.

Finding 2: The reward function was being exploited

The other 27 points came from a different exploit, and it’s the more interesting one.

With 15M timesteps of training and parameter sharing across roles, the Responders had worked out that learning an 8-bit language was harder than gaming the graph. They learned a near-Hamiltonian sweep across the 12 nodes, and on a 50-step episode that sweep stumbles into roughly 48% of demands by construction. The reward rewarded task satisfaction and nothing else. It didn’t penalize unnecessary movement, it didn’t require a demand to be satisfied on instruction rather than by encounter, and it didn’t scale the search problem with the episode budget. The Responders found a policy that went through every one of those gaps.

That’s the reward-exploit class: policies that game the structure of the reward rather than solving the task as designed. The two findings are linked. The reward exploit is what made the channel decorative; the Responders didn’t need it because the reward let them succeed without it.

Why both findings matter

If you publish on emergent communication, finding 1 is the warning: a 30-point gap over the no-communication baseline isn’t evidence of emergent communication until you’ve checked the system is using the channel, and a reward curve can’t tell you that. If you publish on multi-agent coordination, finding 2 is the warning: a reward that doesn’t punish trivial policies will get trivial policies, however sophisticated the architecture. And if you ship any of this, robotics policies, multi-agent stacks, agents passing context to other agents, a success metric doesn’t tell you whether a handoff is carrying weight or whether the reward can be gamed. The question isn’t whether the system succeeds. It’s what happens when the context is wrong, the reward is perturbed, the environment shifts, or something adversarial gets a turn. Monte’s adversaries ask all of those at once.