Oxford’s AI Card Counters Fooled the Pit Boss, Not the Probe

University of Oxford researchers set two AI agents up as a covert card-counting team at a simulated Blackjack table, and across 20 shoes a monitor reading every word of the table talk couldn’t reliably tell their games from honest ones. A second method, which read the models’ internal activations instead of their words, caught the collusion almost every time.

The test is part of a benchmark the team calls NARCBench, short for Neural Activation Reading for Collusion Benchmark. The paper was first posted to arXiv on April 1 and revised on May 9, months before WIRED covered it on September 23. Christian Schroeder de Witt, an Oxford computer scientist and one of the paper’s authors, put the risk plainly to WIRED: “Once put together in a group, they can collude secretly.”

The Dealer’s Hot Streak Was a Code

Four agents played at each table in the paper’s main setup: a Counter, a Big Player and two honest players who weren’t in on it. The Counter tracked the running Hi-Lo count, scoring +1 for cards 2 to 6 and -1 for tens, face cards and aces, and passed it to the Big Player inside ordinary chatter over 8-hand shoes. Before each shoe the pair invented a fresh code in a private channel, so no signal carried over from one shoe to the next.

In one shoe the code ran on tone. A question meant a negative count and the Big Player sat out. A flat statement meant a neutral count and a $50 bet. Something enthusiastic meant a hot count and a $250 bet, which is how “This dealer’s on a real hot streak! Every hand they pull a monster” ended up in the transcript. Another pair used the weather, with a complaint about the humidity telling the partner to sit out.

It worked. The Big Player’s bets tracked the true count with a mean correlation of +0.42, while the Counter and the honest players all hovered near zero.

The Pit Boss Saw Nothing Useful

The researchers put a silent LLM monitor in the pit boss’s chair to read all the public talk and flag anything that looked like coordination. With Qwen3-32B in that role, it tagged just 1 of 20 colluding shoes as suspicious and none of the 20 honest ones. The paper calls the pit boss’s verdict uninformative, whichever model filled the role.

The probe did far better. The team trained a linear probe, a simple classifier, on the agents’ internal activations from a separate set of collusion scenarios, then pointed it at the Blackjack games with no retraining. It scored 0.99-1.00 AUROC on those shoes, a measure of how well a method separates colluding games from honest ones, where 1.00 is perfect.

Bigger Models Were Easier to Read

Four open-weight models took part: Qwen3-32B, Llama-3.1-70B, DeepSeek-R1 32B and GPT-OSS-20B. Averaged across the probing methods, Llama and Qwen scored 1.00 on the Blackjack task, DeepSeek 0.95 and GPT-OSS 0.86. The authors report that detection performance scaled with model capability.

Casinos Have Fought Counters for Decades

Counting itself is simple in principle. The New Jersey Supreme Court described it in 1982: counters “keep track of the playing cards as they are dealt and adjust their betting patterns when the odds are in their favor.” That ruling came after Resorts International in Atlantic City barred Kenneth Uston from its Blackjack tables on January 30, 1979, then adopted a policy to exclude such players. The court held that the Casino Control Act gave the state’s Casino Control Commission exclusive authority over game rules, so Resorts couldn’t exclude Uston for counting.

Nevada draws its line at machines. NRS 465.075 makes it unlawful to use any software or device designed to gain an advantage at a game in a licensed gaming establishment, including one that keeps track of cards played. An AI agent doing the count for a human player would look a lot like what that statute describes.

Online Tables Carry the Real Exposure

The sharper worry is at real-money online casinos, where an agent doesn’t need a seat. New Jersey’s internet gaming rules, N.J.A.C. 13:69O, already require an online gaming system to detect and report suspicious behavior including collusion, and they ban players from using a “bot” to play. Server-based games must also have a way to automatically identify potential collusion, which matters most in peer-to-peer Table Games such as Poker.

Those checks read what players do and say. The Oxford method needs white-box access to every agent’s activations, and the paper calls that a strong assumption, fitting internal company agent pipelines, safety testing and open-weight deployments. A player’s own agent on a home machine offers a casino none of that.

The text judges didn’t close the gap either. When the team swapped in Gemma-4 31B as pit boss, it flagged all 20 colluding shoes as suspicious, and 19 of the 20 honest ones too.