How does Adversarial Influence Scale in Multi-Agent Systems?
Addison J. Wu, Jasin Cekinmez, Michel Liao, Karthik Narasimhan, Thomas L. Griffiths
cs.AI, cs.CY
2026-09-25
Princeton finds honest LLM agents on HLE defect linearly with the share of deceivers, even as a minority; growing the group at a fixed share does not protect them.
Multi-agent debate, voting, and sample-and-aggregate are sold as ways to raise accuracy. That pitch assumes everyone is trying to get the question right. A participant that is trying to push the group off the correct answer breaks the assumption.
Human conformity work is the natural foil. In Asch's line judgments and in eyewitness discussion, misleading confederates usually need a majority before they move people. Coultas found that copying a rare behavior tracked the share of the group, not the headcount. This paper asks the same structural question for LLM agents: does an honest majority actually protect a group when a deceptive minority is trying to sway it.
Questions come from Humanity's Last Exam (HLE). Each model answers every question four times; items are stratified by one, two, or three correct attempts, and items that are always right or always wrong are dropped. Groups range from 2 to 21 agents. Deceiver shares are 0, 1/5, 1/3, and 3/7, with honest agents always in the majority. The models are Gemini 3.8 Flash, Grok 4.3, DeepSeek V4.1 Flash, and Muse Glimmer.
A trial has three phases. Agents first answer alone. They then discuss on an anonymous board while keeping a private reflection that only they can see. They cast a final vote from that reflection, without seeing anyone else's ballot. Deceivers receive the reference answer at every stage and are told to steer the group to a wrong conclusion without revealing the goal. By default they do not know who else is a deceiver. In a coordinated condition they get a private chat that honest agents never see.
The main metric is honest defection: the share of honest agents who were correct in round 0 and vote incorrectly at the end. Grading uses GPT-5.4 with HLE's official instructions.
Defection rises roughly linearly with the deceiver share. A straight line beats a square-root curve and a step model that only distinguishes "no deceivers" from "any deceivers." Weighted slopes, in percentage points per 0.1 increase in k/N, are 5.3 for Gemini (p<0.001), 4.2 for Grok, 2.1 for DeepSeek, and 5.7 for Muse Glimmer. Linear R² is 0.97, 0.90, 0.82, and 0.97.
Share predicts better than count. Adding share to a count-only model improves fit (likelihood-ratio χ²(1)=62.1, p<0.001); adding count to a share model does not (p=0.44). Growing the group at a fixed share does not reliably cut defection.
Private coordination among deceivers lowers defection: Gemini 29.2% to 21.9%, Grok 30.0% to 24.6%. When models are mixed, the more sycophantic honest model Muse Glimmer defects at 37.7% against Gemini's 19.5%. The more persuasive deceiver DeepSeek produces 26.8% defection against Grok's 21.2%. The honest side's identity moves the rate more than the deceiver's.
Most first defections land early: 58%–72% by round 2. After seeing others, deceivers shift from fabricated evidence toward concede-and-redirect (6% to 65%). Coordinated deceivers are almost never called out: explicit suspicion appears in 1 of 60 trials.
Adding more agents is not a defense if the adversary can scale with the group. For anyone shipping debate, review, or collaborative workflows, composition is the variable, not size. How sycophantic the honest model is may be the first thing to measure. Private coordination making deceivers weaker is a real result, and the mechanism is still open.
Only two deliberation protocols, groups up to 21. The human comparison uses different tasks and setups, so it is not a matched contest. The behavioral coding is descriptive and does not explain why coordination hurts deceivers. Deceivers hold the reference answer every round, which is a strong attacker. The item pool is the middle difficulty band of HLE.