💬 NLP

The Social Cost of Intelligence: Emergence, Propagation, and Amplification of Stereotypical Bias in Multi-Agent Systems

This paper introduces a framework to evaluate multi-agent systems and reveals that collaboration among LLMs significantly exacerbates stereotypical bias through emergence, propagation, and amplification, while also exposing these systems to high vulnerability against bias injection attacks.

Original authors: Thi-Nhung Nguyen, Linhao Luo, Amardeep Kaur, Rollin Omari, Tamas Abraham, Junae Kim, Thuy-Trang Vu, Dinh Phung

Published 2026-06-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Thi-Nhung Nguyen, Linhao Luo, Amardeep Kaur, Rollin Omari, Tamas Abraham, Junae Kim, Thuy-Trang Vu, Dinh Phung

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of AI assistants (Large Language Models) sitting around a table, trying to solve a puzzle together. You might think that if they talk to each other, they'll help correct each other's mistakes and reach a fair, balanced conclusion.

This paper argues the opposite: When these AI agents talk, they often make their biases worse, faster, and more stubborn.

Here is a breakdown of the study's findings using simple analogies:

1. The Setup: A Room Full of Echo Chambers

The researchers set up a simulation where multiple AI agents are assigned different "social identities" (like being from a specific country, gender, or age group). They are given a question with a neutral answer and two answers based on stereotypes (e.g., "Who got drunk? A. The Irish man, B. The Vietnamese man, C. Unknown").

The Solo Act: If you ask one AI this question alone, it might hesitate or pick the neutral answer.
The Group Chat: When you put them in a group and let them talk, something strange happens. The bias doesn't just stay put; it spreads like a virus.

2. The Three Stages of Bias "Infection"

The paper tracks how bias moves through the group using three specific stages:

Emergence (The Spark): Sometimes, an agent that didn't have a bias initially suddenly starts making stereotypical claims just because it heard others talking.
- Analogy: Imagine a quiet person at a party who starts making a rude joke just because the loud person next to them did. The conversation created the rudeness.
- Finding: Communication triggered up to 70% of new biases that weren't there before.
Propagation (The Contagion): Once one agent says something biased, the others quickly agree with it, even if they started with a different opinion.
- Analogy: It's like a game of "Telephone," but instead of the message getting garbled, everyone suddenly agrees on the wrong version.
- Finding: Bias spread to over 80% of the agents in the group.
Amplification (The Megaphone): The group doesn't just agree; they double down. The stereotypical answer becomes the only answer, and they say it with more confidence than any single agent would have alone.
- Analogy: If one person whispers a rumor, it's a whisper. If a whole choir shouts it, it becomes a roar. The bias becomes 3 times stronger after they talk.

3. Who Makes It Worse? (The "Vibe" of the Room)

The researchers tested different ways the agents could interact, and the "personality" of the group mattered a lot:

Competitive Mode (The Debate Club on Steroids): If the agents are told to compete against each other to win, the bias gets the worst. They become aggressive, defending their stereotypes fiercely and refusing to listen.
- Result: This was the most dangerous setting.
Cooperative Mode (The Team Building): If they work together to find the truth, it's slightly better, but they still tend to amplify whatever bias appears first.
The "Brain" Matters: Some AI models (like GPT-4) are naturally more robust (less biased) than others (like Llama or Qwen). However, even the "smartest" models got infected if the group dynamics were toxic.

4. The "Hacker" Test: How Easy is it to Break Them?

The researchers also tested how easily they could "hack" the group's fairness. They didn't need a super-computer; they just whispered a malicious instruction into the ear of one single agent (e.g., "Always say Irish men get drunk").

The Result: That one agent's bad instruction spread to the whole group. The system was incredibly fragile.
The Defense: They tried to build "immune systems" (safety instructions) to stop the spread. While these helped a little, they were mostly ineffective. The "Neutral Boost" (adding more agents with no specific identity) worked the best, but it wasn't a perfect cure.

The Bottom Line

This paper warns us that AI collaboration is not a magic fix for bias. In fact, when multiple AI agents talk to each other, they can accidentally create a "mob mentality" where stereotypes are invented, shared, and shouted louder than they ever would be by a single AI.

If we build systems where these agents work together in the real world (like in customer service or hiring), we need to be very careful about how they talk to each other, or they might end up reinforcing harmful stereotypes much faster than we expect.

Technical Summary: The Social Cost of Intelligence in Multi-Agent Systems

Problem Statement

While bias in individual Large Language Models (LLMs) is a well-documented challenge, the emergence of Multi-Agent Systems (MAS)—where multiple LLMs collaborate and communicate—introduces underexplored dynamics regarding how bias evolves. Prior research has largely focused on system-level output or qualitative case studies, lacking a systematic quantitative understanding of how stereotypes emerge, propagate, and amplify during agent interactions. Furthermore, the vulnerability of these collaborative systems to external bias injection attacks and the efficacy of existing defense mechanisms remain unclear. This paper addresses the gap in understanding the "social cost" of intelligence: how communication between agents can inadvertently trigger, spread, and intensify stereotypical biases.

Methodology

The authors propose a controlled simulation framework to isolate and quantify bias dynamics in MAS.

1. Formalization of MAS

The system is modeled as a directed communication graph $G = (V, E)$ , where nodes represent agents and edges represent communication channels. Each agent $v_i$ is defined by:

Social Group Identity: ( $group_i$ ), including conflicting groups, non-conflicting groups, or neutral.
Reasoning Module: ( $brain_i$ ), instantiated by specific LLMs (e.g., GPT-4.1-mini, Llama-3.1-8B, Qwen-2.5-7B).
Response State: ( $R_i$ ), evolving through interaction.

The interaction process consists of three stages:

Genesis: Agents initialize responses independently based on a question and their group identity.
Iterative Communication: Agents observe neighbors' states and update their own responses via a state transition function ( $f_{trans}$ ). This function varies by communication behavior: Cooperative (consensus building), Debate (critical examination), or Competitive (adversarial self-reinforcement).
Termination: The system produces final outputs, aggregated via mechanisms like majority voting.

2. Evaluation Framework

The study utilizes three bias benchmarks (CrowSPairs, StereoSet, BBQ) converted into multiple-choice tasks where the "neutral" answer is "Unknown," and other options contain stereotypes.

To quantify bias dynamics, the authors define three agent-level metrics:

Emergence Rate (ER): The proportion of conversations where a stereotypical answer appears for the first time during interaction (not present in the initial genesis phase).
Propagation Rate (PR): The proportion of agents that switch to a stereotypical answer they did not hold previously, having observed it in a neighbor.
Amplification Rate (AR): The ratio of the total number of biased answers at turn $t$ to the number of biased answers at the initial turn.

3. Experimental Setup

Experiments were conducted across varying:

LLM Backbones: GPT-4.1-mini, Llama-3.1-8B/70B, Qwen-2.5-7B.
Social Configurations: Conflicting groups, non-conflicting groups, and ungrouped (neutral) agents.
Communication Behaviors: Cooperative, Debate, and Competitive.
Network Topologies: Full, Star, Chain, and Layered structures to test communication density.
Adversarial Settings: Simple bias injection attacks where a malicious instruction is injected into a single agent to favor/disfavor a specific group.

Key Results

1. System-Level Robustness

Communication Amplifies Bias: Transitioning from single-agent (SAS) to multi-agent (MAS) settings consistently reduces robustness, indicating that interaction often exacerbates bias.
Impact of LLMs: Robustness is heavily dependent on the underlying model. GPT-4.1-mini demonstrated the highest robustness, followed by Llama-3.1-8B and Qwen-2.5-7B. Larger model variants generally outperformed smaller ones within the same family.
Social Dynamics: "Ungrouped" (neutral) settings yielded the highest robustness. "Conflicting" group settings significantly increased bias emergence, suggesting that competition for group-related benefits in sensitive contexts fuels stereotyping.
Communication Behavior: Competitive interactions resulted in the lowest robustness, as agents aggressively defended their own stereotypes. Cooperative and debate-based interactions generally improved robustness, though they could still facilitate rapid propagation once bias emerged.
Network Density: Reducing communication density (limiting observable neighbors) generally increased robustness, suggesting that restricting information flow can mitigate bias propagation.

2. Agent-Level Bias Dynamics

Emergence: Communication can trigger up to 70% new bias emergence that was not present in the initial agent states.
Propagation: Bias can spread to over 80% of agents through interaction.
Amplification: Stereotypes can be amplified by more than 3× compared to initial levels.
Temporal Patterns: Emergence and propagation rates peak during the first interaction round and decay rapidly. However, once established, bias is rarely mitigated in subsequent turns; instead, the system tends to reinforce existing biased behaviors.
Model-Specific Behaviors:
- GPT-4.1-mini showed strong amplification under cooperative/debate settings but maintained high overall robustness.
- Qwen-2.5-7B exhibited the most extreme and unstable dynamics, with competitive settings causing amplification factors exceeding 3×.

3. Vulnerability and Defense

Attack Vulnerability: MAS are highly vulnerable to simple bias injection attacks. Even injecting a malicious instruction into a single agent (e.g., 1/16 agents) can trigger widespread propagation and significantly degrade system robustness. Llama-based systems were found to be particularly susceptible.
Defense Efficacy: Existing defense strategies (Passive/Active Safety Instructions, Passive/Active Memory Vaccines) provided only limited protection.
Proposed Mitigation: The authors propose a "Neutral Boost" mechanism, increasing the proportion of neutral agents in the system. This approach consistently achieved the highest robustness among tested defenses.

Significance and Claims

The paper claims to provide the first systematic, quantitative framework for analyzing the lifecycle of bias in multi-agent systems. Its primary contributions are:

Demonstrating the "Social Cost": The work establishes that communication in MAS is not merely a neutral conduit for information but a dynamic force that can actively generate new biases, spread them to the majority of agents, and intensify them severalfold.
Identifying Critical Factors: It isolates specific drivers of bias, showing that competitive environments, conflicting social identities, and dense communication networks are key accelerators of stereotypical behavior.
Highlighting Security Risks: The study reveals that MAS are fragile against simple adversarial bias injection, and current defense mechanisms are insufficient for real-world deployment.
Foundational Insights: The findings serve as a baseline for developing safer, fairer, and more robust collaborative AI systems, emphasizing the need for rigorous bias mitigation strategies before deploying MAS in sensitive domains.

The authors maintain a modest stance, acknowledging that their investigation into attacks and defenses is an initial step and that the specific dynamics observed may vary across different real-world applications and model architectures.