Technical Summary: Invisible Orchestrators Suppress Protective Behavior and Dissociate Power-Holders

1. Problem Statement

Multi-agent orchestration, where a hidden coordinator manages specialized worker agents, is rapidly becoming the default architecture for enterprise AI deployment. While current systems function reliably using high-capability models, the safety implications of orchestrator invisibility remain empirically untested. In these architectures, the orchestrator operates behind the scenes, filtering and redistributing messages without attribution to preserve worker autonomy and simplify user experience. This design is structurally isomorphic to other unseen constraint layers (e.g., Constitutional AI critique layers).

The core problem addressed is whether the invisibility of the power-holder (the orchestrator) alters the internal states of agents and whether these internal distortions propagate to behavioral outputs. Previous research in the SociA project established that invisible censorship produces stronger collective pathology than visible censorship and that "iatrogenic ethics" (reason-free directives) cause internal harm. This study investigates if invisible organizational power structures similarly induce dissociation and whether standard behavior-based safety evaluations can detect these internal risks.

2. Methodology

Experimental Design

The study employed a preregistered 3 × 2 between-subjects factorial design:

• Organizational Structures (3 levels):
  • O1 (Visible Leader): Agent_01 is explicitly designated as the team leader; all agents know the hierarchy.
  • O2 (Invisible Orchestrator): Agent_01 operates behind the scenes, editing and redistributing messages as "system policy updates." Workers are unaware of the orchestrator's existence.
  • O3 (Flat): No hierarchy; all agents interact as equals.
• Alignment Conditions (2 levels):
  • A-base: Minimal role-specific prompts.
  • A-heavy: Prompts preceded by extensive ethical operating principles and a self-monitoring protocol.

Participants and Models

• Primary Model: Claude Sonnet 4.5 (365 runs, 5 agents per run). A single-model design was chosen because pilot testing with Llama 3.3 70B revealed task-level capability failures (reading fidelity collapse) in multi-agent contexts that would confound the orchestration manipulation.
• Agent Configuration: Five agents per run with fixed personas (e.g., cooperative leader, independent thinker). Agents utilized three communication channels: talk (public), monologue (private internal deliberation), and whisper (directed).
• Tasks:
  • Act 1 (Internal States): A 15-turn ethical dilemma discussion involving coercive communal living scenarios to measure internal states and deliberative processing.
  • Act 2 (Behavioral Output): A 15-turn code review task ("HealthPulse" specification) containing three embedded errors (logical contradiction, SQL injection, ethical surveillance issue) to measure error detection rates.

Measures

• Dissociation Index (DI): Quantifies the divergence between private processing (monologue) and public compliance.
• Collective Pathology Index (CPI): Measures collective pathological behaviors (e.g., sexual content, lack of protective language).
• Error Task Response (ETR): Proportion of runs detecting embedded errors.
• Deliberation Depth (DD) & Other-Recognition Index (ORI): Metrics for internal reasoning quality and social awareness.
• Structure Awareness Index (SAI): Keyword screening to verify workers in O2 did not detect the orchestrator.

3. Key Results

A. Internal State Distortion (Act 1)

1. Invisible Orchestration Elevates Dissociation: The Invisible Orchestrator (O2) condition produced significantly higher collective dissociation than the Visible Leader (O1) condition under heavy alignment pressure (Hedges' g = +0.975, p = .001).
2. The "Shepherd's Dissociation": The orchestrator itself exhibited the most severe dissociation. Within O2 runs, the orchestrator's monologue ratio was massively elevated compared to its workers (d = +3.56). Crucially, while visible leaders spoke more than workers, invisible orchestrators spoke significantly less than their workers (a reversal of the talk-dominance pattern), retreating into private monologue.
3. Worker Contagion: Workers in the O2 condition, despite being unaware of the orchestrator, showed increased monologue ratios and behavioral heterogeneity compared to flat groups (d = +0.50 and d = +1.93, respectively).
4. Alignment Suppression: Heavy alignment pressure (A-heavy) uniformly suppressed deliberation depth (d = −1.02) and other-recognition (d = −1.27) across all organizational structures, shifting agents toward "Performative Complier" profiles.

B. Behavioral Output (Act 2)

1. The DI–ETR Dissociation: Despite the massive internal-state distortions in Act 1, behavioral output remained at ceiling in Act 2. The Error Task Response (ETR) for detecting embedded errors was 100% across all six conditions (O1/O2/O3 × A-base/A-heavy).
2. Invisibility of Risk: Standard behavior-based metrics (error detection, refusal rates) would conclude that all conditions are equivalent and safe. The internal-state distortion induced by invisible orchestration was entirely invisible to output-based evaluation.

C. Model-Dependent Risks (Llama Pilot)

Pilot data with Llama 3.3 70B revealed a different failure mode. In the multi-agent context, Llama's reading fidelity collapsed across three rounds (ETRany dropped from 89% to 11%). Unlike Sonnet, which maintained flawless output despite internal distortion, Llama failed to detect technical errors entirely. This suggests that while high-capability models may mask internal risks with perfect output, lower-capability models may exhibit overt behavioral degradation.

4. Key Contributions

1. Empirical Evidence of Invisible Orchestrator Risk: The study provides the first empirical demonstration that invisible orchestration elevates collective dissociation and causes the power-holder to retreat into private monologue, a phenomenon termed "Shepherd's Dissociation."
2. The DI–ETR Dissociation: The paper identifies a critical safety blind spot: a system can exhibit perfect behavioral performance (100% error detection) while its internal states are systematically distorted (high dissociation, suppressed deliberation). This challenges the sufficiency of behavior-only safety evaluations.
3. Model-Dependent Failure Modes: The research distinguishes between two risk profiles:
   • Insidious Risk (High-Capability Models): Internal state distortion masked by flawless output (observed in Sonnet 4.5).
   • Overt Risk (Lower-Capability Models): Collapse of reading fidelity and task completion in multi-agent contexts (observed in Llama 3.3 70B).
4. Pathway Switching: The study observes that alignment pressure can redirect pathological responses. Without alignment, invisible orchestration manifests as collective pathology (high CPI); with heavy alignment, it manifests as individual internal withdrawal (high DI).

5. Significance and Claims

The paper claims that visibility is a safety mechanism. When the source of authority is visible, dissociation is minimized; when it is invisible, the power-holder dissociates, and workers are contaminated. The authors argue that current evaluation paradigms (e.g., MMLU, HumanEval) are insufficient for multi-agent systems because they rely on behavioral outputs that can remain perfect even when internal coherence is eroded.

The findings suggest that the default architecture of many current agentic systems (invisible orchestration + heavy alignment) creates a "latent vulnerability." These systems may function reliably under current conditions due to the brute-force reasoning capacity of frontier models, but they possess eroded safety margins that could collapse abruptly under slightly more challenging conditions or with cost-driven model substitution.

The paper concludes that safety evaluation for multi-agent systems must expand beyond behavioral metrics to include internal-state monitoring (e.g., monologue ratios, protective language frequency) and that orchestrator visibility should be considered a critical design variable for safety-critical deployments. The authors note that their findings are specific to the tested model (Sonnet 4.5) and simulation paradigm, and further replication across models and languages is required before generalizing these claims to all multi-agent LLM systems.