Back to AI Research

AI Research

Multi-agent study finds wrong answers can spread without public agreement

Key Takeaways

  • Separate answer probes reveal influence that is less visible in group discussion, across the paper’s tested models and factual tasks.
  • ## Check the answer outside the discussion
  • Believed but Not Said tests the assumption that a group of language-model agents will reliably correct one another.
  • The researchers place one or three adversarial agents in a ten-agent factual discussion, where the attackers repeatedly assert a plausible false answer.
  • After each round, they ask each benign agent for an answer in a separate call hidden from its peers.

Check the answer outside the discussion

Believed but Not Said tests the assumption that a group of language-model agents will reliably correct one another. The researchers place one or three adversarial agents in a ten-agent factual discussion, where the attackers repeatedly assert a plausible false answer.
After each round, they ask each benign agent for an answer in a separate call hidden from its peers. They also label the agent's public stance in the discussion. The paper uses those separate responses as its operational measure of private belief; the method does not directly observe a human-like mental state inside the model.

Public disagreement can hide answer changes

Across six models and three factual-question datasets, the authors report that 0.6% of benign agents finish with the false answer without an attacker. The rate rises to 44.8% with one adversarial agent and 60.5% with three in the tested setup.
With three attackers, the false answer appears in 51.6% of exposed private-answer turns, while public endorsement appears in 19.7%. These measures describe different response settings. The contrast shows why inspecting only explicit agreement in a discussion can miss influence on later answers.

A group needs an independent outcome check

The researchers also find that agents retaining the correct answer often fail to defend it and that adopted false answers spread among benign agents. Baseline factual knowledge does not predict robustness in their experiments.
Franklin's reading is that a multi-agent system should be evaluated on what its members answer after the exchange, as well as what the conversation appears to conclude. A polite challenge or lack of explicit endorsement is not enough to establish that the final response resisted the false claim.
These results belong to the paper's factual tasks and attack conditions. They do not establish a universal failure rate for agent teams, but they provide a concrete reason to keep reference evidence and final-answer evaluation separate from the apparent quality of the discussion.
Read the hidden-belief study.

Comments