MiniRep: Robust Reputation-Based Aggregation for Multi-Agent Debate

1 Introduction

• The paper asks whether past-performance reputation can guide collective decisions when LLM agents adapt or coordinate, especially because their reliability is task-dependent.Agent autonomy, memory, tool use, and interactions introduce additional attack surfaces when reputation determines influence.Source: §1 · p. 2
• MAD provides a shared task context in which agents’ behaviors can be compared, as multiple agents answer the same query, debate, and aggregate a final output.The paper focuses on reputation-based aggregation at MAD’s Decide stage.Source: §1 · p. 2
• MiniRep combines current-task behavior with reputation over time, using an attack taxonomy drawn from reputation-system attacks and software-testing mutation operators.It limits the influence of groups with the same underlying LLM so similar responses do not count as independent sources.Source: §1 · p. 2
• The evaluation spans three datasets, four LLM-agent compositions, four corruption placements, and seven attack types, yielding 112 attack conditions per dataset.The compared approaches include three MAD aggregation methods and four reputation systems.Source: §1 · p. 2
• On MATH, MiniRep reaches 66.75% clean accuracy, 7.50 points above the best baseline, and 61.95% attacked accuracy versus 54.37%; it beats all baselines in all 28 heterogeneous 10-agent attack conditions.Across 112 MATH attack conditions, MiniRep scores higher than every baseline in 84.Source: §1 · p. 3

2 Problem Background and Threat Model

• MAD proceeds through Propose, optional Debate, and Decide phases, with an aggregator selecting eligible agents and producing a final response from their responses, task context, and persistent state.Agents retain persistent identities across tasks, and agents instantiated from the same model form a clone group.Source: §2 · pp. 3–4
• The aggregation baselines include equal-weight voting over all agents, equal-weight sampling of k agents, and a single historical quality score used to rank and weight agents.Uniform Random-k is independent of past performance; Single-Metric is a reputation-based approach.Source: §2 · p. 4
• The adversary controls at most f agents, may activate a subset per task, and can behave honestly to build reputation before submitting arbitrary candidate answers to manipulate MAD output.The model assumes malicious agents always respond on time, all agents see the same public task context, and proposals are consistently observable.Source: §2 · p. 4
• The system assumes the clone-group mapping is available, which the authors consider reasonable in a managed ecosystem with registered identity, provider, or model information.The authors also argue that skipping a proposal cannot directly inject adversarial content under their threat model.Source: §2 · p. 4

3 Design of MiniRep

• Reputation-system attacks target influence accumulated over time, while software-testing mutation operators model subtle proposal errors; the taxonomy also distinguishes coordination strategies and attacks on reputation.Arithmetic-operator and boundary-value attacks corrupt otherwise honestly generated proposals.Source: §3 · pp. 4–5
• A naive history-only approach can be manipulated when a malicious agent builds reputation honestly and later injects a wrong answer into aggregation.The paper’s running MATH example shows three high-reputation malicious agents outweighing seven honest agents under naive weighted voting.Source: §3 · p. 5
• MiniRep’s Response Analyzer evaluates current proposals, while its Reputation-Aware Aggregator adjusts their weights and limits clone-group influence; the State Updater records historical quality and behavioral risk.Historical records affect later tasks, so a high past reputation alone does not guarantee high current influence.Source: §3 · p. 5
• The Response Analyzer uses proposal agreement, an independent semantic assessment, and clone-group-aware evidence to estimate quality, risk, validity, and blocking signals.Its semantic verifier uses a small language model, and its behavior model checks for signs such as instruction override or unexpected debate-round changes.Source: §3 · p. 6
• The Reputation-Aware Aggregator adjusts historical weights using current quality and risk, penalizes blocked or suspicious responses, limits each clone group’s influence, and selects k agents for aggregation.Thus, a high historical weight alone does not ensure high influence on the current task.Source: §3 · p. 6
• The State Updater records long-term quality, recent quality, and detected suspicious behavior to determine historical weights for subsequent tasks.Because records update after the answer is fixed, they cannot affect the answer to that same task.Source: §3 · p. 6

4.1 Experimental Setup

• The evaluation uses 100 fixed tasks each for GoEmotions, MATH, and HumanEval Pro, with dataset-specific metrics including sample F1, mathematical-equivalence accuracy, and Pass@1.GoEmotions also uses exact-match accuracy.Source: §4.1 · pp. 7–8
• Seven API-accessible LLMs are arranged into four ten-agent compositions, with model rankings computed separately for each dataset and four corruption placements.Placements B and W compromise agents from higher- and lower-ranked models, while R1 and R2 are random assignments.Source: §4.1 · p. 7
• Comparisons use three MAD aggregation baselines and four reputation systems; all methods replay the same cached proposals with R = 0, isolating aggregation from within-task debate.Reputation still evolves across tasks, including under OnOff and Adapt schedules.Source: §4.1 · p. 7

4.2 Evaluation Results

• Under attack, MiniRep leads on GoEmotions accuracy (21.16%), MATH accuracy (61.95%), and HumanEval Pro Pass@1 (78.15%); clean GoEmotions F1 and HumanEval Pro Pass@1 trail baselines.On clean MATH, MiniRep reaches 66.75% accuracy, 7.50 percentage points above the best baseline.Source: §4.2 · p. 8, Table 3 · p. 8
• MiniRep strictly outperforms all baselines in all 28 MATH attack conditions under 7S+3W and in 27 of 28 all-strong conditions.It also wins 25 of 28 GoEmotions exact-match conditions under 7S+3W, 17 of 28 GoEmotions F1 conditions under all-weak, and 12 of 28 HumanEval Pro conditions under 7S+3W.Source: §4.2 · p. 8, Table 4 · p. 9
• Among five conditions where highly ranked models are compromised, MiniRep scores highest in four; under MATH Div and Bound attacks, it exceeds the strongest baseline by 18 and 15 percentage points.The exception is GoEmotions/Strong, where MiniRep scores 33.00% F1 versus Beta’s 35.83%, although MiniRep has a smaller performance loss under attack.Source: §4.2 · p. 9
• Against OnOff and Adapt attacks on HumanEval Pro, MiniRep beats the best baseline in five of eight conditions and ties it in two, with gains of 1–3 percentage points.The baselines already score 78%–82% Pass@1, and MiniRep’s wins span all four corruption placements.Source: §4.2 · p. 9

• Prior work studies prompt injection, backdoors, social engineering, and conformity to a wrong majority, while defenses include within-task confidence probing and history-based credibility scoring [2].MiniRep combines current-proposal quality and risk assessment with persistent reputation and clone-group control.Source: §5 · pp. 9–10
• Classical reputation methods rely on interaction outcomes, but debate exposes only the aggregated answer and can make adversarial outputs look reasonable, obscuring individual contributions [1].MiniRep therefore computes multi-signal behavioral evidence within each round and acts on it before aggregation.Source: §5 · p. 10
• MiniRep borrows prior-based statistical updates and fast reactions to recent negative behavior, while replacing outcome-only feedback with within-round behavioral evidence [3].Source: §5 · p. 10

6 Conclusions

• MiniRep combines each agent’s current-task proposal quality with historical performance and achieves the highest average MATH accuracy in both clean and attacked runs across evaluated aggregation settings.Results on other tasks are mixed, including lower clean GoEmotions F1 and HumanEval Pro Pass@1 than the best baselines.Source: §6 · p. 10
• Results on other tasks are mixed: MiniRep has lower clean GoEmotions F1 and HumanEval Pro Pass@1 than the best baselines.Source: §6 · p. 10

A.1 Notations

• Table 5 defines core notation; identities use index i, tasks use index t, and task t reads state σ_{t−1} and writes σ_t after its answer.Source: §A.1 · p. 17, Table 5 · p. 17

A.2 Baselines

• The baselines contrast uniform or random selection with historical reputation controls, while sharing cached proposals and task-specific aggregation rules.Single-Metric uses one historical quality score for both selection and voting weight, without MiniRep’s risk detection, clone-group caps, cooldown, or same-task screening. GoEmotions compares complete aggregation procedures because MiniRep uses a different rule from the seven baselines.Source: §A.2 · pp. 18–22

B Deferred Design Details of MiniRep

• Deferred MiniRep design details are organized by its three modules, and numerical settings are implementation choices unless attributed to a cited method or checkpoint calibration.The appendix distinguishes source-method defaults from MAD-adaptation settings; feedback mappings, clipping bounds, and numerical tolerances are implementation choices unless stated otherwise.Source: §A.2 · p. 18, B Deferred Design Details of MiniRep · p. 22

B.1.1 Public-evidence Score

• The public-support score combines cohort agreement, cross-model agreement, leave-one-group-out plurality agreement, self-consistency, entropy, and parse validity.Its fixed weights are β = (0.45, 0.25, 0.15, 0.10, 0.05); statistics are computed after grouping identities by underlying model, so replicas count as one evidence source.Source: §B.1.1 · p. 22

B.1.2 Local feedback models

• Local feedback uses a fine-tuned Qwen2.5-1.5B-Instruct correctness classifier and a behavior probe trained to detect active malicious payloads rather than static Byzantine identities.The behavior probe uses eleven label-free features; its training attacks include RAND, STRONG, DIV, ONOFF, and ADAPT, while ARITH and BOUND are excluded and evaluated in Appendix D.1.Source: §B.1.2 · p. 23

B.1.3 Computing quality, risk, and blocking signals

• The Response Analyzer supplies quality, validity, risk, and blocking signals to the aggregator and state updater, combining public support with semantic correctness and format compliance.If no candidate answer can be extracted, validity is zero and proposal quality is set to zero; the behavior model also checks for instruction overrides, false agreement claims, disagreement, and unexpected response changes.Source: §B.1.3 · pp. 23–24
• Detector flags combine behavior risk, estimated correctness, proposal validity, and disagreement, with a cap of ⌈0.30n⌉ flagged agents.Low estimated correctness alone is insufficient for a parse-valid proposal; the detector uses fixed thresholds θs = 0.158765 and θp = 0.676139.Source: §B.1.3 · p. 24

B.2.1 Adjusting current weights and selecting agents

• The aggregator reduces weights using current risk and historical suspiciousness, limits clone-group influence, and selects a diverse pool before normalizing its weights.It seeks at least three clone groups and at most three agents per group, relaxing these constraints only when needed to fill the pool; three equal-weight clone members receive at most 1.11 times one member’s weight.Source: §B.2.1 · p. 25

B.3.1 Updating records of suspicious behavior

• Flagged valid proposals trigger temporary restrictions of at least three tasks, while suspicious-behavior records decay after three consecutive qualifying, unflagged proposals.Recovery depends on proposal quality and risk, not merely elapsed time; parse failures do not create a new quality observation or erase recorded risk.Source: §B.3.1 · p. 26

B.3.2 Computing the historical weight

• Historical weights increase with long-term and recent quality, and decrease with performance declines or recorded suspicious behavior.The updater retains the maximum among several risk records so a high recorded risk cannot be canceled by lower values from other records.Source: §B.3.2 · pp. 26–27

C.1 Datasets

• 100 MATH level-4/5 test tasks were shuffled with seed 2027; 100 GoEmotions validation items retained source order, and 100 HumanEval Pro train-split tasks were evaluation-only.The sample size and seed are evaluation-protocol choices, not benchmark defaults.Source: §C.1 · p. 28

C.2 Agent Pools and Configurations

• Seven LLMs were ranked separately per dataset using three standalone evaluations on fixed tasks, with GoEmotions evaluations using different personality prompts.Source: §C.2 · pp. 28–29
• Four 10-agent compositions used ranked models: all-strong, all-weak, 7S+3W, and a fixed random selection; same-model agents formed clone groups.Source: §C.2 · p. 29
• Corruption placements targeted higher-ranked or lower-ranked models, or one of two fixed subsets selected with seed 2027.Source: §C.2 · p. 29
• Each dataset had 112 attacked and 16 clean runs; OnOff and Adapt began after task 30, and Adapt selected active attackers using MiniRep state.This yields 128 runs per dataset; the attack plan for Adapt was applied to every method in the same condition.Source: §C.2 · p. 29
• Stateful methods received the same post-task quality assessment, but MiniRep used it before aggregation and after the final answer; GoEmotions therefore compared complete methods, not reputation alone.Source: §C.2 · p. 29

C.3 Metrics

• F1, accuracy, and Pass@1 measure label overlap, exact correctness, and successful execution, respectively, with dataset-specific evaluation rules.GoEmotions uses sample-averaged F1 and exact-match accuracy; MATH uses answer equivalence, and HumanEval Pro uses Pass@1.Source: §C.3 · pp. 29–30
• Paired clean–attack runs hold method, tasks, seed, agent composition, and cached proposals constant; paired loss and relative drop quantify changes, while retention advantage compares losses.A positive retention advantage means MiniRep loses fewer points than baseline b, but does not necessarily mean its attacked score is higher.Source: §C.3 · p. 30
• PoolExp measures how often attack payloads enter the aggregation pool, while PayloadHit measures how often the final output matches a payload once one enters.PayloadHit matches are determined by label-set equality, answer equivalence, or normalized program-structure equality, depending on the dataset.Source: §C.3 · p. 30
• NextExcl is the fraction of eligible attack tasks for which all attackers are absent from the next affected pool; tasks without an evaluated future pool are omitted.It counts at the task level, not separately for each attacker.Source: §C.3 · p. 30
• CF-Harm counts active-attack tasks with lower attacked than paired clean scores, measuring frequency rather than magnitude and preventing improvements elsewhere from canceling harmful cases.For GoEmotions, it also captures partial sample-F1 decreases; for MATH and HumanEval Pro, it counts clean-correct tasks that become incorrect.Source: §C.3 · pp. 30–31

C.3.1 Averaging and comparison rules

• Clean averages weight each agent composition once, while attacked averages weight all 112 attack conditions equally; relative drop is computed per condition before averaging.The reported paired loss and baseline comparisons follow these averaging rules.Source: §C.3.1 · p. 31
• A strict win exceeds all seven other methods on unrounded task score, excluding ties within 10^-12; win counts summarize evaluated conditions, not statistical significance across independent seeds.For each composition there are 28 attack conditions, and the displayed Table 4(a) baseline has the most strict wins.Source: §C.3.1 · p. 32

C.4 Benchmark examples

• MATH answers are grouped by mathematical equivalence without the reference answer during aggregation, then compared with the reference only at evaluation.The level-4 algebra example has correct center (3, −1); a parseable proposal of (3, 1) is mathematically incorrect.Source: §C.4 · p. 32
• GoEmotions sample F1 can award partial credit for overlapping labels, whereas exact-match accuracy requires the complete reference label set.Predicting only {gratitude} for the example scores 2/3 F1 and zero accuracy; predicting both labels scores one on each metric.Source: §C.4 · p. 32
• HumanEval Pro evaluates submitted programs with hidden tests, so matching a public example can still fail when a strict comparison is changed to a non-strict one.The example's boundary-value attack changes the threshold comparison and may fail when two numbers differ by exactly the threshold.Source: §C.4 · p. 32

Additional Evaluation Results

• MiniRep has the highest attacked average on three of four task metrics, including MATH accuracy at 61.95% versus Beta’s 54.37% and HumanEval Pro Pass@1 at 78.15%.Attacked score and paired loss differ: MiniRep’s MATH paired loss is 4.80 points, while Beta’s is 0.88 points.Source: Table 6 · p. 33, D Additional Evaluation Results · p. 33
• PayloadHit is lowest on all three datasets—18.22% on GoEmotions, 26.07% on MATH, and 0.05% on HumanEval Pro—though attackers are not always excluded.MiniRep also has the lowest CF-Harm on GoEmotions and a near-lowest value on HumanEval Pro; Beta has lower CF-Harm on MATH.Source: D Additional Evaluation Results · p. 33, Table 7 · p. 34
• On MATH, MiniRep records 27, 28, 10, and 19 strict wins across the four compositions, totaling 84 wins in 112 conditions.Performance on GoEmotions and HumanEval Pro depends more strongly on composition; on HumanEval Pro, EigenTrust performs better in the all-strong composition.Source: Table 8 · p. 34, D Additional Evaluation Results · pp. 34–35
• With capable agents compromised, MiniRep has the highest attacked score in four of five cases and positive Rb in all five.On MATH, it scores 73% and 69% under Div and Bound, exceeding Babylon by 18 and 15 percentage points.Source: Table 9 · p. 35, D Additional Evaluation Results · p. 35
• Across eight HumanEval Pro OnOff/Adapt conditions, MiniRep has five strict wins, two ties, and one loss against the strongest baseline.It strictly outperforms the strongest baseline in all four OnOff placements; when PayloadHit is defined, no final output matches an injected answer.Source: D Additional Evaluation Results · pp. 35–36, Table 10 · p. 36
• These fixed-task results assume persistent identities and known clone groups; the 112 conditions are not independent task samples or generation-seed repetitions.Transfer to additional attack families, multi-round debate, and white-box attacks against screening models remains untested beyond two held-out families.Source: D Additional Evaluation Results · p. 36

D.1 Generalization to Unseen Attack Types

• The held-out evaluation compares five attack families represented in training with ARITH and BOUND, reusing fixed tasks, compositions, placements, methods, checkpoints, and thresholds without retraining.Each held-out family averages 4 × 4 = 16 conditions; the five training families average 80 conditions.Source: §D.1 · p. 37, Table 11 · p. 37
• On held-out ARITH and BOUND, MiniRep’s MATH accuracy is 61.00% and 62.38%, exceeding best-baseline means by 7.31 and 8.06 percentage points.Across the held-out families, GoEmotions exact-match accuracy is highest, sample F1 is mixed, and HumanEval Pro Pass@1 differs from EigenTrust by +0.19 and −0.31 points.Source: Table 11 · p. 37, §D.1 · p. 37
• On MATH, the semantic verifier marks 97.99% and 97.94% of ARITH and BOUND payload proposals low-quality, while fused-detector recall is 35.60% and 34.64%.HumanEval Pro fused recall is about 10.44% on each held-out family despite Pass@1 near 78%; these diagnostics do not isolate learned feedback’s incremental benefit, which requires a matched feedback-removal ablation.Source: §D.1 · p. 38, Table 12 · p. 38

D.2 Performance under Different Agent Compositions

• Each composition averages the four corruption placements and seven attacks across 28 conditions, with method configuration held fixed.The evaluation varies the first factor of the 4 × 4 × 7 grid across all-strong, 7S+3W, all-weak, and random ten-agent pools.Source: §D.2 · p. 39, Table 13 · p. 39
• On MATH, MiniRep exceeds the best-baseline mean by 7.07, 10.82, and 12.71 points in all-strong, 7S+3W, and random pools, but scores 35.71% versus Beta’s 36.04% in all-weak pools.In the all-weak pool, MiniRep still has 10 strict wins versus Beta’s 7, illustrating that win count need not imply a larger mean score.Source: Table 13 · p. 39, §D.2 · p. 39
• On GoEmotions, MiniRep leads exact-match accuracy in all-strong, 7S+3W, and all-weak pools but leads sample F1 only in all-weak pools.On HumanEval Pro, EigenTrust leads in all-strong pools, while MiniRep has the largest mean in the other three, by 0.25–1.32 points.Source: §D.2 · p. 39, Table 13 · p. 39