Safety evaluation against adversarial collusion