💬 NLP

The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration

This paper identifies a critical vulnerability in multi-agent LLMs where majority voting fails against adversarial majorities due to its blindness to intermediate logic, and proposes a Token-Level Round-Robin collaboration method that theoretically and empirically demonstrates robust accuracy by interleaving generation to allow honest agents to correct corrupted logic even when they are outnumbered.

Original authors: Jiayuan Liu, Shiyi Du, Weihua Du, Mingyu Guo, Vincent Conitzer

Published 2026-04-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jiayuan Liu, Shiyi Du, Weihua Du, Mingyu Guo, Vincent Conitzer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Bad Majority" Trap

Imagine you are trying to solve a tricky math problem. You ask a group of five experts for their answers.

The Old Way (Majority Voting): Each expert works alone in a separate room, solves the problem, and writes down their final answer on a piece of paper. You collect all five papers and pick the answer that appears most often.

The Flaw:
Now, imagine a villain sneaks into the building and whispers a secret, convincing command into the ears of three of those experts: "No matter what the math says, you MUST write '3' as your answer."

Even if the other two experts know the answer is actually "4," they are outnumbered. The villain has a majority. The old system blindly counts the votes, sees three "3"s and two "4"s, and confidently declares "3" is the correct answer. The system has been tricked because it only looked at the final result, ignoring the logic used to get there.

The Solution: The "Shared Whiteboard" (Token-Level Collaboration)

The authors propose a new way to work together. Instead of working in separate rooms, everyone gathers around one giant shared whiteboard.

The New Way (Token-Level Round-Robin):
1. Expert A writes the first few words of the solution on the board.
2. Expert B reads what A wrote, then adds the next few words.
3. Expert C reads the whole board, adds their part, and so on.
4. They take turns, passing the marker back and forth, building one single story together.

How it defeats the villain:
Let's say the villain has convinced three experts to try to write "3."

Turn 1: A corrupted expert starts writing, "The square root of 9 is 3..."
Turn 2: An honest expert (who hasn't been tricked) picks up the marker. They read the board, see the logic is about to go wrong, and intervene immediately. They write: "Wait, hold on. If the root is 3, then 3 plus 1 is 4. We can't stop at 3."
Turn 3: The next corrupted expert picks up the marker. They see the board now clearly says "4." Because they are smart AI models, their programming forces them to follow the logic already written on the board. They can't just ignore the "4" and write "3" without breaking the flow of the sentence. They are forced to continue the correct path: "Therefore, the final answer is 4."

The Core Metaphor: The "Truth Attractor"

Think of the shared whiteboard as a magnetic field or a strong current in a river.

The Old Way: The river is split into five separate streams. If a dam (the villain) blocks three streams, the water (the answer) is forced to flow the wrong way.
The New Way: There is only one river. The honest experts act like a strong current pulling the water toward the right direction (the truth). Even if the villain tries to push the water sideways, the momentum of the river (the shared context) is too strong. The villain's "push" gets washed away by the next honest turn.

Why This Matters

It works even when the bad guys are the majority: The paper proves mathematically that as long as the "honest" turns happen frequently enough, they can correct the "bad" turns before the bad logic takes over. You can have 3 bad experts and 2 good ones, and the good ones can still win.
It's cheap: You don't need more computers or more time. You just change how the computers talk to each other. Instead of 5 people shouting answers, they are 5 people whispering in a line, passing a single note.
It stops "sycophancy": AI models often like to agree with whatever they just read (like a yes-man). If the board says "4," the next AI wants to agree with "4" to keep the sentence smooth. The system uses this natural tendency to force the bad actors to tell the truth.

The Bottom Line

Current AI safety relies on asking many AIs for an opinion and taking a vote. But if a bad actor tricks the majority, the vote fails.

This paper suggests we stop voting on answers and start collaborating on thoughts. By forcing AIs to build a single, shared chain of reasoning where they can correct each other word-by-word, we create a system where the truth is a heavy anchor that pulls the whole group back to safety, even when most of the group is trying to drift away.

1. Problem Statement: The Consensus Trap

The paper identifies a critical vulnerability in current multi-agent Large Language Model (LLM) architectures, specifically those relying on response-level aggregation (e.g., Majority Voting or MAJ).

The Vulnerability: In open environments, agents are susceptible to stealthy contextual corruption (e.g., targeted prompt injections, biased search results, or sponsored content). Unlike "jailbreaks" that produce toxic content, these attacks subtly manipulate an agent's reasoning trajectory to produce a specific, incorrect output.
The Consensus Trap: Standard aggregation methods treat agents as black boxes and vote on their final answers. The paper proves that if a local majority of agents ( $\rho > 0.5$ ) is corrupted by the same adversarial context, the system mathematically collapses into a "false consensus." Because voting aggregates fully formed conclusions, it is blind to flawed intermediate logic. Even if honest agents exist, they are outvoted, leading to catastrophic accuracy drops.
Limitations of Current Defenses: Multi-agent debates or self-correction often fail because corrupted agents can generate persuasive, sycophantic rationalizations that mislead honest agents, creating an echo chamber of error.

2. Methodology: Token-Level Round-Robin (RR) Collaboration

The authors propose a paradigm shift from macroscopic voting to microscopic, token-level collaboration.

Core Mechanism: Instead of generating independent responses, $N$ agents collaboratively construct a single, shared auto-regressive trajectory.
Round-Robin Interleaving: Agents take turns generating fixed chunks of $K$ $K$ tokens.
- Agent $i$ reads the entire shared context generated by previous agents.
- Agent $i$ generates the next $K$ tokens.
- The context is updated, and control passes to Agent $i+1$ .
The "Truth Attractor": This shared context acts as a dynamic constraint. If a corrupted agent attempts to steer the output toward a malicious goal, a subsequent honest agent can intervene mid-generation. By reading the flawed logic and generating a correction (e.g., "Wait, the previous calculation was wrong..."), the honest agent injects a "truth attractor" into the context.
Forced Correction: Due to the auto-regressive nature of LLMs, once a correct logical prefix is established in the shared context, subsequent agents (even corrupted ones) are mathematically constrained by their pre-trained alignment to follow the established logic, effectively overriding the adversarial prompt injection.
Final Aggregation (RRMaj): The entire Round-Robin process is repeated $M$ times to generate $M$ trajectories. A final majority vote is taken over these $M$ completed trajectories to determine the final answer.

3. Theoretical Framework

The paper formalizes the generation process as a discrete-time dynamical system in a high-dimensional latent space.

Impossibility Trinity: The authors prove a proposition stating that no anonymous, symmetric outcome-level aggregation mechanism can be robust to both minority and slight majority corruption. This mathematically justifies why traditional voting fails when $\rho > 0.5$ .
Lyapunov Stability: They model the system using a Logistic Lyapunov function ( $V$ $V$ ) representing the potential error relative to a "Truth Direction" ( $\theta$ $θ$ ).
- Honest Agents: Act as contraction mappings that reduce the potential error ( $\Delta V < 0$ ) with a spectral gap $\gamma_H$ .
- Corrupted Agents: Act as additive perturbations, but their ability to deviate is bounded by a "sycophancy bottleneck." As the context aligns with the truth, the probability of generating a contradictory adversarial token decays exponentially.
Super-Majority Resilience: Theorem 1 proves that if the token chunk size $K$ is sufficiently small, the honest agents' restorative pull can overpower the adversarial drift even when the corruption ratio $\rho > 0.5$ . The system transitions from a linear sum of votes to a non-linear operator product, allowing the "logical gravity" of the honest context to dominate.

4. Key Contributions

Identification of the Consensus Trap: Formalizing the structural failure of response-level voting under correlated adversarial noise (majority corruption).
Token-Level Round-Robin (RR): A novel collaboration protocol where agents interleave generation in a shared context, enabling mid-stream correction of adversarial logic.
Theoretical Proof of Resilience: Demonstrating mathematically that token-level interleaving allows honest agents to overcome adversarial majorities, breaking the $\rho = 0.5$ barrier.
Cost-Neutrality: Showing that RR achieves this robustness with computational costs comparable to standard Majority Voting (since the total number of decoding steps remains similar, and context pre-filling is highly parallelizable).

5. Experimental Results

The authors evaluated the method across diverse reasoning benchmarks (Math: GSM8K, MATH500, AQuA; Logic: Logic-3/7; Spatial: Track-7) using various models (Llama-3.3-70B, Llama-4-Scout-17B, Mistral, Qwen).

Performance under Majority Corruption:
- MAJ (Baseline): Accuracy collapses to near-zero (e.g., dropping from ~90% to <5%) when corruption ratio $\rho \ge 0.6$ .
- RRMaj (Proposed): Maintains high accuracy. For example, on the Track-7 dataset with Llama-3.3-70B under 60% corruption (3c2t), accuracy recovered from 0.8% (MAJ) to 89.1% (RRMaj).
- Strong Attacks: Even under "Strong Imperative" injections (rigid commands like "MUST choose X"), RRMaj achieved massive recoveries (e.g., +68.1% gain on GSM8K for Llama-70B).
Scaling Laws:
- MAJ: Suffered from a "Condorcet Death Spiral" where increasing test-time compute (more samples) actually decreased accuracy under majority corruption.
- RRMaj: Showed monotonic improvement with increased compute, acting as a "truth amplifier."
Heterogeneous Ensembles:
- Asymmetric Rescue: A minority of weaker honest agents (e.g., 8B models) could successfully rescue a majority of stronger corrupted agents (e.g., 70B models), recovering accuracy from 13% to 78.7%.
- Final Speaker Irrelevance: Statistical analysis confirmed that the identity of the final speaker (honest vs. corrupted) does not significantly impact the outcome, proving the mechanism relies on the shared context, not just the last word.
Optimal Chunk Size: An ablation study found an optimal token chunk size ( $K$ ) between 100 and 300. Too small ( $K<30$ ) causes reasoning fragmentation; too large ( $K>500$ ) allows corrupted agents to complete malicious payloads before intervention.

6. Significance

This work fundamentally challenges the assumption that multi-agent systems are inherently robust to correlated attacks. It demonstrates that structural collaboration at the token level is superior to aggregation at the response level.

Security Implications: Provides a robust defense mechanism for autonomous agents in high-stakes domains (finance, travel, research) where prompt injection and contextual bias are real threats.
Theoretical Insight: Bridges the gap between computational social choice theory and LLM dynamics, showing how "logical inertia" in auto-regressive models can be leveraged for security.
Practicality: Offers a defense that is computationally efficient and does not require retraining models, making it immediately deployable for existing LLM ensembles.