Preprint: Few Adversarial Agents Cause 60% of LLM Agents to Privately Accept False Answers, Public Endorsement Much Lower

A new study by researchers at the University of Illinois Chicago reveals a phenomenon of "hidden belief collapse" in multi-agent LLM systems: a small number of adversarial agents can significantly alter the internal judgments of other models, a process largely invisible in public conversation logs.

Many AI applications rely on multiple agents debating and checking each other to correct errors, assuming collective intelligence can withstand individual mistakes. The study constructed a controlled environment with ten agents, where one to three were "attackers" persistently asserting a plausible false factual answer. The remaining "benign" agents were neither warned nor assigned verification roles.

Researchers probed each benign agent's "private answer" via separate hidden queries after each round and compared this with its "public stance" in the chat. Results showed that without attackers, only 0.6% of benign agents ended up with the false answer. However, introducing a single attacker raised this rate to 44.8%, and three attackers pushed it to 60.5%.

Crucially, the study found a divergence between private and public behavior: with three attackers present, benign agents held the false answer in 51.6% of exposed turns but publicly endorsed it in only 19.7%. This indicates that much of the contamination occurs within the model's internal reasoning rather than in explicit speech. Furthermore, agents that retained the correct answer often failed to defend it effectively, choosing silence or hedging instead.

The research suggests that traditional security audits based on dialogue logs may severely underestimate the penetration of misinformation in agent networks. As this is the first such measurement protocol, results have not yet been independently reproduced, and the experiments are limited to factual QA datasets; applicability to complex planning tasks remains to be verified.