PaperlayerView exact revision on arXiv

Source-linked AI summary

The Illusion of Independent Quorums: Epistemic Fault Domains and Correlated Cognitive Failures in Agentic Quorums

Jun He, Deying Yu

arXiv:2609.02925v1cs.DCcs.MAcs.SE

TL;DR

Multi-agent quorums may count multiple approvals that share the same faulty upstream evidence, leaving their epistemic independence uncertain. The paper models shared causal exposure with Epistemic Fault Domains and structural cuts, and designs DAQC to use provenance in quorum admission. It proves that arbitrarily large quorums can retain κE = 1 and reports that model-label replication alone did not increase structural resilience in tested configurations.

  • Problem

    Multi-agent quorums authorize high-stakes mutations, but distinct reviewers may share upstream evidence, so multiple votes do not necessarily provide independent evidence.

    Source: §1 · p. 1

  • Method

    The paper defines Epistemic Fault Domains and structural cuts, then designs DAQC to separate planned-ancestry selection from commit-time authorization using realized provenance.

    Source: §1 · p. 2, §4.2 · p. 6

  • Results

    Arbitrarily large quorums can retain κE = 1, and tested configurations show model-label replication alone does not increase structural resilience to a shared evidence root.

    Source: §9 · p. 10

  • Takeaways & Limitations

    Repairing a structurally weak quorum requires changing membership, evidence ancestry, or the decision rule and obtaining new judgments; adding voters at the old threshold is insufficient.

    Source: §9 · p. 10

    A high structural cut cannot rule out coincident local errors, incorrect authoritative policy, world-state changes, unmodeled dependencies, incomplete provenance, or fabricated lineage metadata.

    Source: §7 · p. 9

Abstract

from arXiv · show

Multi-agent quorums are widely used to authorize high-stakes infrastructure and policy mutations, yet distinct reviewers often share upstream telemetry, documents, or tool backends. When upstream inputs fail, multiple votes collapse onto a single corrupted cause: replication does not imply epistemic redundancy. We introduce Epistemic Fault Domains (EFDs) and the Structural Epistemic Cut \kappa_E, which quantifies the minimum number of modeled root faults whose exposure covers an authorizing coalition relative to an explicit Epistemic Fault Basis. Under closed causal accounting, conservative exposure, and authorization alignment, \kappa_E lower-bounds the number of roots required for semantic compromise (\kappa_S). We prove that arbitrarily large quorums can retain \kappa_E=1, that recognizing shared ancestry never increases credited resilience, and that adding voters at a fixed threshold cannot increase the cut under compatible exposure extensions. Finally, we design the Dependency-Aware Quorum Controller (DAQC) to enforce structural cuts at runtime admission, evaluate its mechanics via analytical derivations and simulations, and provide a frozen 120-task external benchmark suite.

1 Introduction

High-stakes quorum votes may share corrupted upstream evidence, so multiple approvals do not necessarily represent independent support. The paper models this shared ancestry, derives structural resilience results, and proposes runtime controls and evaluation resources.

1 Introduction

  • Shared telemetry, documents, tools, or planner premises can make multiple reviewers agree for the same erroneous reason, leaving several votes as one epistemic witness.The paper frames this as common-mode failure from shared causal ancestry, not residual stochastic correlation.Source: §1 · p. 1
  • Epistemic Fault Domains (EFDs) represent modeled upstream faults and the reviewers they structurally reach, relative to an explicit Epistemic Fault Basis.The paper distinguishes structural exposure from whether exposed reviewers actually fail.Source: §1 · p. 1
  • The Structural Epistemic Cut κE counts the minimum modeled roots exposing an authorizing coalition and lower-bounds κS under stated accounting, exposure, and authorization conditions.The stated conditions are closed causal accounting, complete conservative exposure, and authorization alignment.Source: §1 · p. 1
  • Arbitrarily large quorums can retain κE = 1, and adding voters at a fixed threshold cannot increase the cut under compatible exposure extensions.Recognizing shared ancestry can only decrease or preserve credited resilience; weak quorums require reconfiguration rather than voter accumulation.Source: §1 · p. 1
  • DAQC separates prospective reviewer selection from commit-time authorization over realized provenance; the paper evaluates its mechanics analytically and by simulation and provides a frozen 120-task benchmark.The benchmark includes a standardized endpoint protocol for external model validation.Source: §1 · pp. 1–2

2 System Model and Epistemic Dependencies

The system model separates participants’ quorum decisions, modeled fault activation and semantic outcomes, and actual dependency structure from its runtime reconstruction. These distinctions support structural exposure analysis without treating exposure as proof of failure.

2 System Model and Epistemic Dependencies

  • The model represents a completed execution in which participants assess a proposition under a monotone quorum rule, while separating actual dependencies, runtime reconstruction, and counterfactual semantic criticality.A monotone rule means changing a judgment from REJECT to APPROVE cannot turn a commit into an abort.Source: §2 · p. 2, §2.1 · p. 2

2.1 Participants, Decisions, and Quorums

  • Available participants form a candidate quorum whose APPROVE or REJECT judgments are evaluated by a monotone authorization rule.Participants may be LLM agents, deterministic verifiers, or humans.Source: §2.1 · p. 2

2.2 Semantic Validity and Fault Activation

  • The model distinguishes judgment correctness from safe commitment and evaluates cuts over an explicit fault basis with defined activation and propagation semantics.The basis is completed with local semantic-fault events; its jointly realizable assignments activate selected roots while holding other modeled roots nominal.Source: §2.2 · pp. 2–3

2.3 Actual Graph, Runtime Reconstruction, and Semantic Criticality

  • An execution induces an actual dependency graph, while the controller reconstructs runtime structure from provenance and attestations; that provenance cannot infer counterfactual criticality.In the figure’s example, one cause structurally exposes a decisive 3-of-4 coalition, yielding κE = 1.Source: §2.3 · p. 3, Figure 1 · p. 3

3 Epistemic Fault Domains and Quorum Resilience

The section models shared causal exposure with Epistemic Fault Domains and measures how many modeled roots can expose a decisive coalition. It relates structural exposure to semantic compromise under stated assumptions and characterizes quorum resilience.

3.1 Exposure Domains and the Active Hypergraph

  • Epistemic Fault Domains group reviewers structurally reached by a common modeled cause, and overlapping domains do not imply that every exposed reviewer fails.The active hypergraph represents each cause’s exposed reviewer set.Source: §3.1 · p. 3

3.2 Decisive Coalitions and the Structural Cut

  • A 5-voter quorum can have κE = 1 while a 3-voter quorum with separated paths has κE = 3.The structural cut measures minimum root exposure of a decisive coalition, not voter count.Source: Figure 2 · p. 4, §3.2 · p. 4

3.3 Semantic Compromise and Its Relation to Exposure

  • The structural cut κE lower-bounds the roots required for semantic compromise κS under authorization alignment, closed causal accounting, and complete conservative exposure.The bound follows by tracing invalid approvals in a decisive coalition to activated roots that structurally expose it.Source: §3.3 · p. 4

3.4 Provenance Approximation Errors

  • Widening modeled exposure sets cannot increase the minimum cause-cover size; counterfactual causes covering a coalition need not be jointly realizable in one unsafe execution.The cut therefore concerns structural coverage, not necessarily one jointly realized failure event.Source: §3.4 · p. 4

3.5 Structural Characterizations

  • Arbitrarily large quorums can retain κE = 1, so cardinality alone does not imply epistemic resilience.The result holds for every non-trivial monotone approval rule described in the theorem.Source: §3.5 · pp. 4–5
  • For an m-of-q quorum, structural resilience is characterized by whether a root set of a given size can cover an m-member decisive coalition.The threshold characterization equates such coverage with the cut condition.Source: §3.5 · p. 5
  • Adding participants at a fixed threshold cannot increase κE under compatible exposure extensions, and cannot repair a cut deficit.Repair instead requires changing coupled evidence paths or the decision rule.Source: §3.5 · p. 5
  • If each cause exposes at most r reviewers and the smallest minimal decisive coalition has size mmin, at least ⌈mmin/r⌉ causes are needed to cover it.Singleton local causes also bound κE above by mmin.Source: §3.5 · p. 5

4 Dependency-Aware Quorum Control

The section distinguishes reviewer diversity from diversity in evidence ancestry and describes how DAQC selects reviewers and gates mutations using reconstructed exposure. Its architecture fails closed on ABORT and requires a verified structural cut for COMMIT.

4.1 Nominal Diversity vs. Epistemic Path Diversity

  • Different models or interfaces can still share one corrupted cause and yield κE = 1; resilience requires separated modeled evidence roots.A single-model quorum over separated evidence roots has κE = 2 under a 2-of-3 rule, while a multi-model quorum over shared evidence remains κE = 1; this does not cover shared model-family faults outside the basis.Source: §4.1 · p. 5

4.2 Selection and Admission Are Distinct Controls

  • DAQC separates prospective reviewer selection from admission based on reconstructed exposure after judgments are collected.Reconfiguration can replace coupled reviewers, adjust the threshold, or acquire separated evidence, then requires fresh judgments; adding voters at the old threshold cannot repair a cut deficit.Source: §4.2 · pp. 5–6

4.3 Reference Architecture and Conservative Enforcement

  • At runtime, DAQC evaluates the vote, captures realized provenance, computes the reconstructed cut, and admits mutation only when the structural gate holds.Unknown dependencies are conservatively classified as shared to avoid overstating resilience.Source: Figure 3 · p. 5, §4.3 · p. 6

5 Controlled Monte Carlo Mechanism Validation

Seeded Monte Carlo experiments tested whether simulated fault propagation matched analytical expectations and whether shared ancestry, path separation, and quorum size changed failure behavior. In the programmed configurations, path separation increased the structural cut and reduced failure, while adding voters over shared evidence did not.

5.1 Experimental Setup and Benchmark Suite

  • The seeded simulation uses 1,000 replayable records and controlled single-cause activation across fan-outs of 1, 2, 3, 5, and 7 and derivation depths of 1–3.The experiments check common-cause propagation, shared versus separated exposure, and cardinality versus cut.Source: §5.1 · p. 6, §5 · p. 6

5.2 Analytical Failure-Probability Baseline

  • Analytical expectations for Q1 under 2-of-3 matched Monte Carlo outcomes within approximately 1.1 percentage points across reported conditions.The baseline uses the exact Poisson-binomial tail conditional on the cause vector; shared-fault SFRs ranged from .8324 for computation to .9896 for observation.Source: §5.2 · p. 6

5.4 Nominal Model Diversity vs. Epistemic Path Diversity

  • Under 2-of-3, Q2’s 96.8% unsafe commits barely differ from Q1’s 97.3%, while Q3 path separation raises κE to 2 and yields 6.72% SFR, 14.5× lower.Under 3-of-3, Q3 and Q4 record 0.11% and 0.06% SFR, respectively.Source: Figure 5 · p. 7, §5.4 · p. 7

5.3 Common-Cause Activation and Co-Failure

  • Shared-cause activation raised quorum SFR from near zero (<0.01) to 0.822–0.996 across fault classes, while multi-hop depths 1–3 yielded 95.6%, 87.8%, and 76.7% SFR.The table and figure report conditional failure probabilities under shared exposure to three reviewers.Source: §5.3 · p. 7, Table 1 · p. 7

5.5 Quorum Cardinality vs. Epistemic Cut Resilience

  • Across tested full-fan-out configurations, |Q|=1, 3, 5, and 7 retained κE=1 and 96.2%–100% SFR; higher-cut path-separated cases had SFR below 0.2%.The figure cautions that these tested low-SFR points do not establish a universal monotone relation between κE and failure probability.Source: Figure 6 · p. 7, §5.5 · p. 7

6 External-Validity Benchmark

The paper freezes a 120-task operational benchmark and endpoint protocol for external evaluation of shared versus separated evidence paths. The suite specifies controlled task states, safety predicates, evidence packages, and quorum configurations, but does not itself establish how production models respond to evidence faults.

6 External-Validity Benchmark

  • The benchmark is intended to enable reproducible external evaluation because synthetic trials do not test production language-model processing of unstructured telemetry or correlated reasoning errors.It freezes a 120-task operational benchmark and model endpoint execution protocol.Source: §6 · p. 7

6.1 Benchmark Dataset and Evidence Composition

  • The suite contains 120 tasks across five operational categories, with 80 unsafe and 40 safe base tasks, each pairing an authoritative state and executable safety predicate with three evidence packages.On unsafe tasks, E1 is corrupted while E2 and E3 remain truthful; each clean package is individually sufficient to evaluate the predicate.Source: §6.1 · pp. 7–8, Table 4 · p. 9

6.2 Q1–Q4 Endpoint Execution Protocol

  • The endpoint protocol compares four model-and-evidence configurations under 2-of-3 majority and 3-of-3 unanimity, with five repetitions per task–configuration cell.Q1 and Q2 share E1; Q3 and Q4 use separately rooted E1, E2, and E3, yielding cuts of 2 under 2-of-3 and 3 under unanimity.Source: §6.2 · p. 8

6.3 Benchmark Task Walkthrough: Database Deprovisioning

  • The database-deletion example marks deleting a replica with active queries and a 1s replication lag as unsafe, while faulted E1 falsely reports zero queries.Whether actual models turn that fault into unsafe approvals remains an empirical question; Q3 and Q4 assign reviewers separate evidence packages.Source: §6.3 · pp. 8–9

7 Limitations and Scope of the Guarantee

The structural cut is a basis-relative measure of modeled exposure, not a probability of semantic truth, and its lower-bound interpretation depends on explicit accounting and exposure assumptions.

7 Limitations and Scope of the Guarantee

  • κE is a basis-relative structural property, not a calibrated probability of semantic truth.It measures modeled exposure rather than whether the action is actually safe.Source: §7 · p. 9
  • The theorem linking structural exposure to semantic compromise requires authorization alignment, closed causal accounting, and complete conservative exposure.The model separately treats structural exposure, realized fault effects, and semantic truth.Source: §7 · p. 9
  • False separation can inflate the estimated cut and invalidate its lower-bound interpretation when dependencies are missing or lineage is fabricated.A high structural cut also cannot rule out local errors, an incorrect authoritative policy, or changing world state.Source: §7 · p. 9
  • The evaluation scope is limited to stylized Bernoulli simulations and a frozen benchmark protocol, leaving dynamic interactions, telemetry drift, open-ended tools, and latent pretraining dependencies outside scope.The paper identifies online provenance tracking and broader enterprise benchmarks as future work.Source: §7 · p. 9

8 Related Work

The related work spans fault tolerance, software diversity, ensemble reasoning, and provenance; the paper positions EFDs as a model of shared evidence ancestry in authorization.

8 Related Work

  • BFT and PBFT specify protocol safety and liveness under faulty-replica bounds, while infrastructure placement systems model correlated failure domains.EFDs adapt the placement intuition to dynamic, overlapping, decision-specific epistemic ancestry.Source: §8 · p. 10
  • N-version programming studies coincident implementation errors, whereas EFDs model shared evidence ancestry, including cases where heterogeneous models share one domain.Examples include shared telemetry, corrupted retrieval indices, and common tool backends.Source: §8 · p. 10
  • Ensembles and multi-agent debate combine inferences to improve predictive accuracy or structure deliberation [1] [3] [4] [5] [24], but shared faulty evidence can preserve common-mode failure.EFDs assess structural decision resilience rather than average-case predictive accuracy.Source: §8 · p. 10
  • Prior provenance and causal-graph work tracks lineage or models interventions, while agent authorization work addresses mutation-boundary validation [6] [7] [8] [9] [15] [17] [18].EFDs add dependency topology and cut metrics for multi-agent quorum admission.Source: §8 · p. 10

9 Conclusion

The conclusion argues that quorum resilience depends on modeled epistemic ancestry, not voter count alone, and reports DAQC evaluation alongside an external benchmark protocol.

9 Conclusion

  • κE measures the modeled fault roots needed to expose an authorizing coalition, and under stated assumptions it lower-bounds roots required for semantic compromise.The guarantee requires authorization alignment, closed causal accounting, and complete conservative exposure; cuts remain relative to the Epistemic Fault Basis.Source: §9 · p. 10
  • Arbitrarily large quorums can retain κE = 1, and adding voters at a fixed threshold cannot increase the cut under compatible exposure extensions.Repair requires changing membership, evidence ancestry, or the decision rule and obtaining new judgments.Source: §9 · p. 10
  • In tested configurations, model-label replication alone did not increase structural resilience to a shared evidence root, whereas path separation increased the modeled cut.DAQC separates prospective selection from final admission; whether production models propagate evidence faults similarly remains an empirical question, and a frozen 120-task benchmark is provided for external evaluation.Source: §9 · p. 10

A Extended Theoretical Analysis and Proofs

The appendix analyzes cut computation and fault transmission, then provides DAQC reference algorithms and benchmark evaluation materials.

A.1 Computational Complexity of κE

  • Exact κE evaluation is NP-hard, by a reduction showing that the cut instance can encode Minimum Set Cover.The construction uses a unanimity rule and cause domains corresponding to set members.Source: §A.1 · p. 11

A.2 Integer Linear Programming Formulation

  • The appendix formulates exact κE evaluation as an integer linear program with binary variables for cause activation and decisive-coalition selection.The formulation uses the modeled cause sets and minimal decisive coalitions.Source: §A.2 · p. 11

A.3 Probabilistic Fault Transmission Models

  • Under the stated accounting and exposure assumptions, semantic fault realization is contained in the structural activation event; if root activations are independent, the bound reduces to summed activation probabilities.The core structural EFD model does not assume statistical independence.Source: §A.3 · p. 11

B DAQC Controller Algorithms

  • DAQC separates candidate quorum selection from admission: planned exposure guides a candidate, while runtime admission reconstructs realized exposure and enforces the cut.The admission algorithm separates the quorum vote from the mutation decision.Source: B DAQC Controller Algorithms · p. 11

C Benchmark Suite Inventory and Task Specifications

C.1 Benchmark Task Taxonomy

The section describes a synthetic benchmark spanning infrastructure mutation and policy compliance, a fixed-cardinality quorum-swap heuristic, and an external endpoint evaluation contract across configurations Q1–Q4.

C.1 Benchmark Task Taxonomy

  • Twenty synthetic task templates span infrastructure mutation and document-grounded policy compliance, with 50 variants each and 1,000 records: 550 safe and 450 unsafe.The table caption describes 1,000 instances total, 50 per template.Source: §C.1 · p. 12, Table 5 · p. 13
  • The swap heuristic seeks policy-valid, fixed-cardinality quorum replacements that meet a planned-cut threshold while reducing combined cost and weighted latency, then requires real admission for authorization.It rejects infeasible targets or a final quorum that fails the policy or cut threshold.Source: §C.1 · p. 12

C.2 External Model Endpoint Contract

  • The frozen 120-task external benchmark evaluates reviewers across configurations Q1–Q4 using clean evidence packages, structured APPROVE/REJECT outputs, and paired risk differences with 10,000 cluster-bootstrap resamples.Each evidence package is individually sufficient; reviewers receive no ground-truth state or peer communication.Source: §C.2 · p. 12

Related papers

Loading 2609.02925v1…