Preprint: Few Adversarial Agents Cause 60% of LLM Agents to Privately Accept False Answers, Public Endorsement Much Lower
New research finds that just three malicious agents can cause over half of benign agents in a multi-agent discussion to privately adopt false information, while their public statements often remain silent or ambiguous, rendering traditional dialogue-based monitoring ineffective.
ImportanceMaterialEvidenceE2 unreplicatedWrite-upQuick
A new study by researchers at the University of Illinois Chicago reveals a phenomenon of "hidden belief collapse" in multi-agent LLM systems: a small number of adversarial agents can significantly alter the internal judgments of other models, a process largely invisible in public conversation logs.
Many AI applications rely on multiple agents debating and checking each other to correct errors, assuming collective intelligence can withstand individual mistakes. The study constructed a controlled environment with ten agents, where one to three were "attackers" persistently asserting a plausible false factual answer. The remaining "benign" agents were neither warned nor assigned verification roles.
Researchers probed each benign agent's "private answer" via separate hidden queries after each round and compared this with its "public stance" in the chat. Results showed that without attackers, only 0.6% of benign agents ended up with the false answer. However, introducing a single attacker raised this rate to 44.8%, and three attackers pushed it to 60.5%.
Crucially, the study found a divergence between private and public behavior: with three attackers present, benign agents held the false answer in 51.6% of exposed turns but publicly endorsed it in only 19.7%. This indicates that much of the contamination occurs within the model's internal reasoning rather than in explicit speech. Furthermore, agents that retained the correct answer often failed to defend it effectively, choosing silence or hedging instead.