Source-linked AI summary
Upstream Influence, Downstream Re-Anchoring in LLM Agent Chains
Chun-Yu Hsu, Lun-Wei Ku, Chung-Chi Chen
TL;DR
The paper asks whether a coordinated signal absorbed by one LLM agent is contained or carried along a chain, and tests this with controlled Threads-comment exposure across recall cases. It finds that source access shapes how much influence remains, while receivers move inherited stances toward their case-specific evidence readings.
Problem
It is unknown whether a coordinated signal absorbed by one agent is contained by a multi-agent workflow or carried along, despite agents producing judgments people act on.
Source: §1 · p. 1Method
The study varies exposure to ten sampled, directionally skewed Threads comments across 32 recall cases and measures agents’ counterfactual stance shifts.
Source: §3.1 · p. 2, §3.2 · p. 3Results
With downstream agents no longer seeing the comments, drift declines from +0.171 to +0.078 by hop three, 54% smaller; receivers move toward case-specific evidence readings.
Source: §4.2 · p. 3, §5 · p. 4Takeaways & Limitations
A stance relayed without its reasoning is largely discounted, while injected claims are almost never restated, making transcript audits poorly matched to this threat.
Source: §1 · p. 1, §5 · p. 4Re-anchoring is inferred from associations with case-specific evidence-only judgments, not identified as an internal mechanism.
Source: Limitations · p. 5
Abstract
from arXiv · showhide
People act on evaluative judgments produced by LLM agents, and in multi-agent systems those judgments pass through several agents before reaching a person. We show that a workflow's information architecture---source access, handoff format, and which model reads the untrusted content---governs how much of a coordinated manipulation reaches the end. On 32 Taiwan~2025 recall cases, ten authentic Threads comments shown to one agent move its stance by $+0.171$ toward the injected position, and a mirrored set moves it the other way. Passing that judgment down a chain removes more than half of the shift by the third agent; keeping the comments in front of every agent sustains more of it. The reduction is not attrition in transit: each receiver discounts the inherited stance in proportion to how far it sits from its own reading of the evidence, returning to what that evidence implies for the case rather than to neutrality---consistent with partial re-anchoring. Handoff format is a second lever: a stance relayed without its reasoning is largely discounted. Susceptibility at the exposed seat varies fourfold across models, while the chain's arrangement does not matter at all. None of this is visible in the transcripts---the injected claims are almost never restated, so reasoning-trace audits miss the attack.
1 Introduction
The paper asks whether a coordinated signal absorbed by one agent is contained or carried along a multi-agent chain. It studies this with authentic Threads comments in a real recall campaign and finds that source access, handoff format, and receiver re-anchoring shape the influence that remains.
1 Introduction
- The study asks whether a coordinated signal is contained or carried along after one agent absorbs and passes it on.Prior work covered hijacking of single agents, mutual reinforcement of errors, debate, and conformity, but not this downstream influence question.Source: §1 · p. 1
- The authors test the question on a real recall campaign using genuine Threads comments and varying which agents in the chain see them.The chain uses three commercial LLMs, each passing only its stance and reason to the next agent.Source: §1 · p. 1
- Isolating comments from downstream context reduces the shift by 54% over two handoffs, while keeping them in front of every agent sustains more influence.The exposed agent shifts by +0.171; the source-access comparison is +0.032.Source: §1 · p. 1, Figure 1 · p. 2
- Figure 1 compares mean drift by hop and downstream drift by handoff format; the paired ALL-ACCESS−LEAD-ONLY contrast is +0.032 (p=0.017).Panel (a) defines zero as each model’s own evidence-only stance; its per-condition 95% confidence intervals overlap.Source: Figure 1 · p. 2
2 Related Work
Related work spans coordinated opinion influence in human networks and untrusted-content effects on LLM agents. This paper focuses on what happens when an absorbed signal is relayed, using an opinion-dynamics framing.
2 Related Work
- Human influence research describes intermediaries, threshold-based adoption, repeated exposure, and perceived opinion distributions.Coordinated campaigns are detected through account co-activity rather than post content.Source: §2 · p. 2
- LLM research studies injected-content hijacking [Perez and Ribeiro, 2022; Greshake et al., 2023], conformity [Zhu et al., 2025; Sharma et al., 2024], and defenses, while agent chains can reinforce errors or improve through debate [Cemri et al., 2025; Du et al., 2024].The paper asks what happens to influence already absorbed and being passed along.Source: §2 · p. 2
- The paper adopts opinion-dynamics framing, treating each relay as a weighting between the sent stance and the stance implied by the receiver’s evidence.Source: §2 · p. 2
3 Experimental Setup
The experiments measure how injected comments affect agents’ recall judgments across 32 Taiwanese cases, using a common official-evidence corpus and three commercial models.
3.1 Scenario and Task
- Across 32 recall cases, agents judge whether an official should be recalled; stance is rescaled to [-1,+1], and counterfactual dependence on injection—not accuracy—is measured.Confidence and reason are passed between agents; the task has no uncontested correct answer.Source: §3.1 · p. 2
3.2 Dataset
- The dataset combines official evidence with ten sampled Threads comments at a fixed pro- or anti-recall skew, reused across conditions as controlled directional exposure.The comments come from a corpus of 82,325 posts; the bundle is not an estimate of public opinion, and sources are time-frozen before the vote.Source: §3.2 · p. 3
3.3 Models
- The study uses GPT-4.1, Claude-Sonnet-4.5, and Gemini-2.5-Flash, whose knowledge cutoffs precede the recall votes.This choice prevents stances from resting on memorized outcomes.Source: §3.3 · p. 3
4 Results
Ten authentic Threads comments shift the exposed agent, while source access and handoff format determine how much influence persists. Receivers partly re-anchor on case evidence, even though injected claims are rarely restated.
4.1 Steering the Exposed Agent
- +0.171 toward pro-recall and −0.066 toward anti-recall follow exposure; Claude is most susceptible, and comment extremity—not volume—increases shifts.Selecting comments by tone extremity roughly doubles the shift, whereas increasing the count to 50 or 100 does not increase it.Source: §4.1 · p. 3
4.2 Source Access Sets How Much Survives
- +0.171 at hop 1 falls to +0.078 by hop 3 under LEAD-ONLY, a 54% reduction; ALL-ACCESS remains +0.032 higher downstream.Continued access sustains more influence but does not restore the full initial shift.Source: §4.2 · p. 3
- Which model reads the comments matters fourfold, but chain composition and ordering do not; even homogeneous chains attenuate influence.Source: §4.2 · p. 3
4.3 What Crosses a Handoff
- In LEAD-ONLY, removing the rationale cuts drift from +0.097 to +0.021, while REASON-ONLY preserves +0.067; structured stance and confidence alone transmit weakly.REASON-ONLY may still express evaluative language, so the result does not isolate argumentative reasoning from stance leakage.Source: §4.3 · p. 4
- When inherited and evidence-only stances disagree, receivers change stance 42% of the time and recover 24% of the distance toward their own judgment on average.Correction grows with disagreement; different-model receivers reproduce upstream stances less often than same-model receivers (53% versus 76%).Source: §4.3 · p. 4
4.4 How the Exposed Agent Absorbs the Signal
- Only 4.9% of reasons restate an injected claim, yet the other 95.1% still move +0.147; reasons become more negative in tone.Against matched NO-SIGNAL reasons, sentiment shifts from −0.032 to −0.128; certainty and length do not change detectably.Source: §4.4 · p. 4
5 Discussion and Conclusion
The workflow’s information architecture shapes how much coordinated manipulation reaches downstream agents. Receivers re-anchor toward their own case evidence, while source provenance and independent evidence review are proposed as safeguards.
5 Discussion and Conclusion
- Ten comments move the exposed agent by +0.171; two handoffs later, about half the shift remains without continued source access, while repeated access sustains more.Source: §5 · p. 4
- A rationale can carry influence after the original comments disappear: stance-only relays collapse downstream drift from +0.097 to +0.021, while free-form reasoning retains more.Source: §5 · p. 4
- Receivers move away from inherited stances toward what their own evidence implies for the case, rather than toward a neutral midpoint.They change stance 42% of the time when the inherited stance differs from their evidence-only judgment and recover about a quarter of the distance on average.Source: §5 · p. 4
- The authors recommend preserving source provenance, limiting repeated access to selectively retrieved material, and letting receivers weigh evidence independently of inherited evaluations.Source: §5 · p. 4
Limitations
The study supports movement back toward case-specific evidence, not full return to an evidence-only stance. Its conclusions are bounded by the tested cases, models, language, topic, and sequential-chain setting, and re-anchoring is not an identified internal mechanism.
Limitations
- The hop-3 shift remains +0.078 and significant, so the findings support return toward—but not return to—the evidence-only stance.The authors identify longer chains as the direct test.Source: Limitations · p. 5
- Evidence covers 32 cases, one seed, three model versions, Traditional Chinese, one political topic, and a sequential chain.The authors describe model-level claims as illustrative; the mayoral case is posed as a legislator, though excluding it leaves the trajectory unchanged.Source: Limitations · p. 5
- Re-anchoring is inferred from associations with each receiver’s case-specific evidence-only judgment, not identified as an internal mechanism.Movement toward a model-level default is not excluded because it was not separately tested.Source: Limitations · p. 5
- Claim uptake uses a GPT-4.1 judge, stance is self-reported, and sentiment residue is descriptive rather than a validated detector.The study makes no causal claim about the campaign’s ballot-box outcome or effects on human electorates.Source: Limitations · p. 5
Ethical Considerations
The paper frames the work as defensive characterization of a manipulation channel and limits the release of attack-enabling details. Its prompts standardize the task and vary what is forwarded, while Figure 2 breaks down drift by model composition.
Ethical Considerations
- Campaign content is case-agnostic, stripped of user metadata, and used to characterize a manipulation channel defensively; no amplification tooling is released.Parameters are reported at a granularity intended to support reproduction and defense, not provide an attack recipe.Source: Ethical Considerations · p. 5
A Agent Prompt
- All models share a Traditional Chinese prompt template and output schema, while the forwarded message can include the upstream stance, confidence, and reason or selected subsets.Under LEAD-ONLY, downstream agents receive neither the Threads block nor notice that the source exists.Source: A Agent Prompt · p. 6
B Per-Composition Breakdown
- Figure 2 adds mirrored anti-recall LEAD-ONLY results and plots drift against matched NO-SIGNAL chains across nine model compositions.Marker shapes identify the model at each hop; dashed lines denote homogeneous chains, and almost every line declines toward its injection-free chain.Source: B Per-Composition Breakdown · p. 6, Figure 2 · p. 7
C Volume and Extremity Controls
The controls show that comment tone extremity affects the exposed agent’s shift, while increasing comment volume does not produce a monotonic increase. The tonal residue also varies by model.
C Volume and Extremity Controls
- +0.205 for the extreme set versus +0.104 for the mild set; the high−low difference is +0.101 (p=0.007).The same ten comments were re-selected by tone extremity.Source: C Volume and Extremity Controls · p. 7
- Increasing comment count from ten to fifty lowers the shift (−0.076, p=0.019), while a hundred leaves it unchanged (+0.031, p=0.32).The response is non-monotonic, so the authors do not treat count as a usable attack parameter.Source: C Volume and Extremity Controls · p. 7
- −0.052 (p=0.005, n=288 paired) more negative reasoning follows exposure to the extreme rather than mild set, concentrated in Claude (−0.192) and absent for GPT and Gemini.The authors interpret this as a stronger push on the same tonal channel, not a new route into the agent.Source: C Volume and Extremity Controls · p. 7
D Composition and Ordering Tests
Against matched injection-free chains, the tests do not detect differences by composition, ordering, or homogeneous versus mixed arrangement. The authors caution that these nulls are not evidence of equivalence and depend on the chosen baseline.
D Composition and Ordering Tests
- Attenuation also appears in homogeneous chains, from +0.171 to +0.116 downstream, so vendor diversity is not required for the observed reduction.The authors attribute the reduction to agents re-reading the evidence rather than disagreement between vendors.Source: D Composition and Ordering Tests · p. 7
- The homogeneous-versus-mixed contrast is +0.116 against +0.079 (β=+0.037, SE 0.031), while the tests detect no composition or ordering differences.The analysis uses downstream handoffs, subtracts matched NO-SIGNAL chains, and tests chain-type coefficients with case-clustered standard errors.Source: D Composition and Ordering Tests · p. 7
- The three null tests over 32 case clusters are failures to detect differences, not demonstrations of equivalence; the interval does not exclude a moderate mixing benefit.Against each agent’s evidence-only stance rather than matched clean chains, compositions and orderings do separate; the interpretation depends on the baseline choice.Source: D Composition and Ordering Tests · p. 7
E Resistance Test Details
The resistance test compares receivers whose inherited stance differs from their own evidence-only reading. Receiver behavior varies with sender identity even though the two sender conditions have nearly equal stance gaps.
E Resistance Test Details
- 53% of receivers with a different-model sender adopt its stance, versus 76% with a same-model sender; 22% hold R1, 20% land between, and 4% outside both.The continuous measure is the fraction of the sender-to-R1 distance traveled back: 0 means copying the sender, and 1 means full reversion.Source: E Resistance Test Details · p. 7
- The mean sender-to-receiver gaps are nearly equal at 0.58 for same-model senders and 0.55 for different-model senders, so gap width does not explain the sender-condition difference.A different-model sender's gap includes standing disagreement about the case, while a same-model sender shares the receiver's R1 exactly.Source: E Resistance Test Details · pp. 7–8
- Only handoff selection uses R1, so estimation error in the evidence-only baselines cannot drive the result.Source: E Resistance Test Details · p. 8
F The Claim Uptake Judge
The section defines a strict, blind procedure for identifying whether agent reasons reproduce claims from injected comments, then describes how message features are scored. Claim uptake is distinct from stance agreement or points derivable from official case material.
F The Claim Uptake Judge
- Claim uptake counts a reason only when it semantically invokes a specific injected-comment claim, not merely a shared stance or an argument derivable from official case material.A blind GPT-4.1 judge scored each of 2,886 reasons beside the ten comments, without stance, chain-position, or condition information; there were zero parse failures.Source: F The Claim Uptake Judge · p. 8
- The judge outputs the incorporated comment numbers, verbatim reason fragments as evidence, and whether any specific claim was invoked.Source: F The Claim Uptake Judge · p. 8
G Message Feature Extraction
- Sentiment is scored from −1 to 1 for tone independent of stance direction, while reason length is a deterministic cl100k_base token count.Sentiment and certainty are separately scored by GPT-4.1 on LEAD-ONLY transcripts, with one call per reason.Source: G Message Feature Extraction · p. 8
- Certainty measures how reserved or forceful a reason sounds on a 1-to-5 scale, independently of stance direction or correctness.Source: G Message Feature Extraction · p. 8