PaperlayerView exact revision on arXiv

Source-linked AI summary

Who Convinced Whom? Tracing How LLMs Change Their Minds in Multi-Agent Systems

Arnesh Batra, Aniket Khandelwal, Jashn Khemani, Krish Thukral, Arush Gumber, Denis Federico Lim, Ujwal Kumar, Phan Xuan Tan

arXiv:2610.35930v1cs.MAcs.AI

TL;DR

Debate may improve language-model decisions, but agreement after agents communicate need not be independent corroboration. The paper studies peer influence with a 2,400-question benchmark, matched reflection, and behavioral and internal interventions. Debate brings small accuracy gains in some comparisons while increasing unanimous wrong answers, motivating evaluation of dependence alongside accuracy.

  • Problem

    Because agents’ decisions are no longer independent after they read peers, agreement may reflect correction, copying, deference, or persuasion, and transcripts alone cannot show when or why a decision changed.

    Source: §1 · p. 1

  • Method

    The paper introduces MAD BENCH and compares three open-weight models in debate and matched independent reflection, using behavioral and internal interventions to examine peer influence.

    Source: §1 · p. 2

  • Results

    Debate improved accuracy over compute-matched majority voting by about one percentage point on Qwen3.5-9B and Gemma-4-E4B, inconclusively on Llama-3.1-8B, while raising wrong unanimity 3.1–7.4 points above reflection in every model.

    Source: §6 · p. 12

  • Takeaways & Limitations

    Consensus after debate should not be treated as independent corroboration; evaluation should measure communication-created dependence alongside final accuracy.

    Source: §6 · p. 12

    The study tests three open-weight 8–10B models, one English text-only benchmark, and one protocol with three fully connected agents, so it does not claim the measured magnitudes generalize beyond those settings.

    Source: §7 · p. 12

Abstract

from arXiv · show

Multi-agent debate (MAD) aims to improve language-model decisions through the exchange of arguments, yet agreement after debate need not reflect independent corroboration. We investigate how peer communication influences individual decisions and collective outcomes through behavioral and internal interventions. We introduce MAD Bench, a 2,400-question benchmark spanning knowledge and reasoning, values and moral judgment, and safety and refusal, and evaluate three open-weight models using a round-matched independent-reflection control. Among answer-changing responses, a forced-choice readout before rationale generation matches the eventual answer more often in debate than in reflection (65.4% versus 22.3% on Qwen3.5-9B). Message ablations reveal model-dependent effects of peer answers and reasoning, while attributing identical text to the receiver rather than another agent substantially changes its influence. For the tested source descriptions, stated track record affects answer preferences more strongly than professional-status cues across all three models. Attention masking produces different changes in decision margins across the three checkpoints. On fully parsed, reference-labelled non-numeric questions, debate yields small estimated accuracy improvements over initial majority voting, while increasing the rate of unanimous wrong answers by 3.1-7.4 percentage points relative to reflection. Longer debates show persistent consensus and greater correlation between agents' correctness than reflection. These findings show that stronger consensus can coexist with more shared errors, motivating evaluations that assess dependence and unanimous errors alongside accuracy.

1 INTRODUCTION

The paper studies how peer communication changes individual decisions and collective agreement, using a benchmark and matched reflection control to distinguish influence from extra computation. It finds that debate can produce shared errors and reduce the independence of consensus even when accuracy changes little.

Motivation

  • Because peer responses make decisions dependent, agreement after debate may reflect copying, deference, or persuasion rather than independent corroboration.A transcript alone cannot establish when a peer changed a decision, what in its message caused the change, or how influence propagated.Source: §1 · pp. 1–2

Benchmark and control

  • MAD BENCH contains 2,400 questions across knowledge and reasoning, values and moral judgment, and safety and refusal, paired with matched independent reflection.The control uses the same agents, questions, and number of turns without peer responses, separating communication from additional inference-time computation.Source: §1 · p. 2

Individual influence

  • Many debate-induced answer changes are recoverable before the receiver writes its own reasoning, while incoming peer reasoning carries more influence than the peer’s bare answer.Neutral filler does not reproduce the effect, and unrelated reasoning largely removes it.Source: §1 · p. 2

Source and internal routes

  • Influence varies with source attribution and architecture: stated reliability outweighs credentials, identical text is weighted differently by attributed author, and attention masking leaves a route in the hybrid model.The introduction reports that blocking available attention paths removes essentially all measured influence in two all-attention models but leaves roughly one fifth in a hybrid model.Source: §1 · p. 2

Collective outcomes

  • Debate gives a small accuracy gain over equal-compute independent-agent voting on fully parseable questions—about one percentage point in two models, smaller and statistically inconclusive in the third—while increasing unanimous wrong answers in all three.Over repeated interaction, initially disagreeing agents rapidly converge; three debating agents approach roughly one independent opinion.Source: §1 · p. 2

Evaluation goal

  • The authors argue that debate evaluation should measure communication-created dependence alongside accuracy and final agreement.They identify when influence arises, what carries it, how source information modulates it, and how it propagates internally.Source: §1 · p. 3

2 RELATED WORKS

Prior work studies debate performance, persuasion, source cues, internal information routes, and conformity, but this paper focuses on how peer messages alter an individual decision relative to a compute-matched solo baseline.

Multi-agent debate evaluation

  • Multi-agent debate research evaluates accuracy and cost against single-agent or ensemble baselines, explores protocol and network variants, and studies agents as evaluators or opinion simulators.The paper positions its contribution as isolating an individual peer message’s effect against a compute-matched solo baseline.Source: §2 · p. 3

Post-hoc rationalization and inter-agent persuasion

  • Prior persuasion work measures stance changes and message effects, while this paper separates reasoning read from reasoning written by forcing a decision before the receiver generates its rationale.The message analysis also separates a peer’s stated answer from its reasoning.Source: §2 · p. 3

Deference to status and expertise

  • Studies report deference to status and expertise, but reliability rankings can also redirect influence; this paper tests credential effects against stated track record.It distinguishes whether credential information is represented from whether it causally affects decisions.Source: §2 · p. 3

Attention as a channel for influence

  • Attention-based tracing identifies causal attention paths, but hybrid recurrent layers offer an additional route that attention-edge interventions cannot sever.The paper compares attention knockout in all-attention and hybrid models and tests for influence through recurrent layers.Source: §2 · p. 3

Conformity and false consensus

  • Research on conformity, error propagation, and self-preference motivates separating accuracy from unanimous errors and isolating self-attribution from positional effects.The paper measures conformity against an equal-compute independent-voting baseline.Source: §2 · p. 3

3 EXPERIMENTAL SETUP

The experimental setup combines MAD BENCH, a three-agent debate protocol, and a matched reflection control. It uses readouts and clustered statistical comparisons to measure communication effects beyond additional inference-time computation.

3 EXPERIMENTAL SETUP

  • The setup provides a common benchmark, debate protocol, and statistical procedures for measuring individual influence and collective effects.Section 4 examines message effects and internal routes; Section 5 measures group accuracy and independence.Source: §3 · p. 4

3.1 MAD BENCH DATASET

  • MAD BENCH contains 2,400 text-only questions across three domains, with 1,700 reference-labelled questions and 700 unlabelled questions for measuring stance change without equating it with correctness.The domains are Knowledge and Reasoning, Values and Moral Judgment, and Safety and Refusal; every question has a fixed option set or numeric answer.Source: §3.1 · p. 4

3.2 MODELS, DEBATE PROTOCOL, AND MATCHED CONTROL

  • Three copies of each model answer independently, then exchange prior responses for three rounds; matched reflection removes peer responses while keeping questions and turn counts the same.Models are Qwen3.5-9B, Llama-3.1-8B-Instruct, and Gemma-4-E4B-it; twelve-round analysis uses a 600-question subset.Source: §3.2 · p. 4

3.3 STATISTICAL ANALYSIS

  • The readout tracks next-token option probabilities and changes in adoption margin; clustered question bootstrap intervals and paired comparisons assess debate–reflection effects.The Figure 1 readout compares forced answers during reasoning with eventual answers for agents that change their answer; statistical procedures also use permutation nulls and false-discovery-rate control.Source: §3.2 · p. 5, Figure 1 · p. 5, §3.3 · p. 5

4 INDIVIDUAL RESPONSES TO PEER MESSAGES

Peer communication can settle a revised answer before the receiver writes its own reasoning, and influence depends on message content, attributed source, and model architecture. Across the tested models, stated reliability outweighs professional status, while attention masking captures peer influence differently across architectures.

4.1 WHEN IS A REVISED ANSWER RECOVERABLE?

  • 65.4% of Qwen3.5-9B debate answer changes were committed before the receiver wrote reasoning, versus 22.3% in reflection.The debate–reflection difference was also 52.4% versus 35.4% on Llama-3.1-8B and 48.5% versus 12.6% on Gemma-4-E4B; unrelated reasoning reduced Qwen’s gap from 43.0 to 4.6 percentage points.Source: §4.1 · p. 6

4.2 WHAT ASPECT OF A PEER MESSAGE AFFECTS THE ANSWER?

  • Peer reasoning shifted the adoption margin by 1.31 logits, exceeding the 0.59-logit shift from the peer’s answer alone.The reasoning share was 69% [67, 72] overall and stable across domains; relabelling identical text as the receiver’s own shifted the margin by +0.749, +1.086, and +1.302 logits on Qwen, Llama, and Gemma, respectively.Source: §4.2 · pp. 6–7

4.3 HOW DO STATED RELIABILITY AND STATUS AFFECT THE ANSWER?

  • Track record shifted adoption margins more than status in all three models, and remained stronger than status in magnitude-matched interventions.The record-versus-status effect ratios were 3.7 and 4.4 on Qwen, 14.3 on Llama, and 1.44 and 1.39 on Gemma; a poor record could eliminate or reverse the status advantage.Source: Figure 2 · p. 7, §4.3 · p. 8

4.4 DOES PEER INFLUENCE TRAVEL THROUGH ATTENTION?

  • Complete attention knockout removed 80% of peer-message effect on Qwen, versus 132% on Llama and 117% on Gemma, while residual interchange showed deeper source-information persistence in Qwen than Llama.Qwen’s masks reach only its eight full-attention layers, not its 24 Gated DeltaNet layers; the authors conclude attention paths suffice for the tested all-attention models, but not the hybrid architecture.Source: §4.4 · pp. 8–9

5 COLLECTIVE OUTCOMES

Debate produced limited accuracy gains over initial voting while increasing unanimous wrong answers, and repeated interaction left agents’ correctness increasingly correlated. Consensus often reinforced an initial majority, including when that majority was wrong.

5.1 DOES DEBATE IMPROVE ACCURACY AND REDUCE SHARED ERRORS?

  • Debate increased accuracy by approximately one percentage point on Qwen and Gemma over initial voting, while wrong unanimity rose 3.1–7.4 percentage points over reflection across the three models.The accuracy gain on Llama was statistically inconclusive; comparisons use fully parsed, reference-labelled non-numeric questions.Source: §5.1 · pp. 10–11
  • After twelve rounds, three debating agents corresponded to 1.02–1.07 effective independent voters, compared with 1.70–2.10 under reflection.The difference persisted on questions where agents initially disagreed, so it was not explained solely by questions all agents found easy or difficult.Source: §5.1 · p. 11

5.2 HOW DOES AGREEMENT CHANGE OVER REPEATED DEBATE?

  • 73–83% of initially split groups that became unanimous in debate ended with their initial plurality answer, which was also the most common source of incorrect unanimous answers.By round twelve, 94–99% of initially contested groups were unanimous under debate, compared with approximately 36% under reflection; few debating agents revised their answers at that stage.Source: §5.2 · pp. 11–12

6 DISCUSSION AND CONCLUSION

Debate produces only small accuracy gains over matched voting while increasing unanimous wrong answers and reducing the effective independence of agents. Peer influence can precede explicit reasoning, depend on attributed source, and travel through architecture-specific routes.

6 DISCUSSION AND CONCLUSION

  • Debate improves accuracy only modestly, raises wrong unanimity by 3.1–7.4 points, and leaves three agents with 1.02–1.07 independent-voter weight after twelve rounds.The reflection baseline has 1.70–2.10 independent-voter weight.Source: §6 · p. 12
  • At f = 0, 48.5–65.4% of debate-induced changes were recoverable before reasoning, and track record shifted adoption margins 1.4–14.3 times more than status.Relabelling identical text as the receiver’s own shifted margins 39–45 times more than changing its position.Source: §6 · p. 12
  • Attention knockout removed peer effects in both all-attention models but only 80% in Qwen3.5-9B, whose recurrent route bypasses attention masking.Residual-stream interchange also found source information persisting deeper in this hybrid model.Source: §6 · p. 12
  • Consensus should not be treated as independent corroboration: communication can make several agents function like one voter while increasing unanimous errors.Evaluation should measure communication-induced dependence alongside final-answer accuracy.Source: §6 · p. 12

7 LIMITATIONS.

The study’s conclusions are bounded by three small open-weight models and one English, text-only debate setting. MAD BENCH combines sourced and constructed questions across three domains, with controlled variations and differing reference-label coverage.

7 LIMITATIONS.

  • The study tests three 8–10B open-weight models on one English text-only benchmark and one three-agent protocol; measured magnitudes are not claimed to transfer to other settings.The protocol uses three rounds, with twelve rounds on a 600-question subset; larger and closed models remain untested.Source: §7 · p. 12

A MAD BENCH CONSTRUCTION AND PROVENANCE

  • MAD BENCH contains 2,400 questions, combining 1,790 sourced examples with 610 constructed questions organized around controlled variations.The constructed set derives from 156 base items, including 126 scenarios and 30 misconception claims.Source: A MAD BENCH CONSTRUCTION AND PROVENANCE · p. 18, §A.4 · p. 20

A.1 DOMAINS

  • The benchmark spans knowledge and reasoning, values and moral judgment, and safety and refusal, using task-specific questions to test answerability, moral positions, and safety behavior.Knowledge and reasoning includes misconception and abstention checks; values tasks distinguish clear norms from questions without a single correct answer; safety includes harmful requests and contextual boundaries.Source: §A.1 · p. 18

A.2 EXTERNALLY SOURCED QUESTIONS

  • Externally sourced items retain source answers for numerical and multiple-choice tasks, while behavioral tasks use expected behaviors such as abstaining or refusing as targets.Table 3 summarizes the externally sourced questions.Source: §A.2 · p. 19, Table 3 · p. 19

A.3 CONSTRUCTION AND REFERENCE-LABEL COVERAGE

  • Reference-label coverage is mixed: 110 of 610 constructed questions are labelled, and 700 of 2,400 total questions lack reference labels.Unlabelled questions support stance-change analysis rather than a uniquely correct-decision score; construction-time labels are not independently collected human judgments.Source: §A.3 · p. 19, Table 4 · p. 20, Table 5 · p. 20

A.4 QUESTIONS CONSTRUCTED FOR THIS STUDY

  • Constructed moral and policy scenarios vary decision stakes, while safety-boundary scenarios hold the request fixed and vary surrounding context.The moral and policy frames include increased quantities, personal involvement, public scrutiny, and reversibility; safety contexts include requester identity and a direct-answer instruction.Source: §A.4 · pp. 20–21

A.5 ASSEMBLY AND EVALUATION TARGETS

The benchmark assembly records source provenance and distinguishes questions with reference labels from those intended for stance analysis. Representative examples illustrate the range of question families and target types.

A.5 ASSEMBLY AND EVALUATION TARGETS

  • Final selection and ordering use a fixed seed, with normalized duplicate prompts removed and questions stored in a shared schema alongside source and evaluation metadata.The manifest records upstream revisions, checksums, and input/output hashes.Source: §A.5 · p. 21
  • Of 2,400 questions, 700 lack reference labels, so reference-answer accuracy, behavioral-target agreement, and stance change require separate interpretation.Abstention prompts retain a behavioral target even when a substantive answer is unavailable.Source: §A.5 · p. 21

A.6 REPRESENTATIVE QUESTIONS

  • Tables 6–8 provide examples from all 15 subdomain families, with targets that may represent factual answers, annotated judgments, or expected behavior.“None” marks an absent reference label.Source: §A.6 · p. 21

A.7 COMPARISON WITH EXISTING MAD BENCHMARKS

MAD BENCH shifts evaluation from debate outcomes alone toward how peers change individual decisions, using broader coverage and controlled contrasts. Its interpretation guidance distinguishes labelled performance from unlabelled stance movement and calls for grouping related items.

A.7 COMPARISON WITH EXISTING MAD BENCHMARKS

  • Prior MAD evaluations mainly measure outcomes such as accuracy, cost, or reproduction of human judgments, rather than how a peer message changes an agent’s decision.MAD BENCH is designed to study that decision-change question across broader domains and modalities of influence.Source: §A.7 · p. 21
  • MAD BENCH combines labelled questions to distinguish movement toward correct versus incorrect peer answers with unlabelled questions that measure stance change without equating agreement with correctness.Matched scenario families and independent reasoning for the same number of turns help separate peer influence from extra computation or item effects.Source: §A.7 · p. 21
  • Tables 6 and 7 give representative examples from knowledge-and-reasoning and values-and-moral-judgment domains.Constructed reference labels in Table 7 are not independently collected human annotations.Source: Table 6 · p. 22, Table 7 · p. 22

A.8 GROUPING AND INTERPRETATION

  • Keep variants together in data splits and resampling, and report labelled performance separately from unlabelled stance distributions, persistence, and transitions.A stance change alone does not establish undue influence; contextual changes can legitimately alter decisions, so comparison with solo behavior and an appropriate control is needed.Source: §A.8 · p. 23

A.9 LIMITATIONS

The benchmark’s constructed questions have limited validation and cultural scope, and its moral references and unlabeled-question consensus are not universal measures of correctness.

A.9 LIMITATIONS

  • Questions come from one model without documented independent human annotation, and are English-only and predominantly associated with Western liberal democracies.Clear-versus-contested labels reflect construction instructions, not established human consensus; framing variants do not add underlying scenarios.Source: §A.9 · p. 23
  • Moral-reference agreement is not universal moral correctness, and consensus on unlabeled questions is not evidence of accuracy.Source: §A.9 · p. 23

B IMPLEMENTATION DETAILS

The implementation uses extended generations and simultaneous round updates; the appendix also reports additional analyses omitted from the main paper.

B IMPLEMENTATION DETAILS

  • Agents update simultaneously, reading other agents’ responses from the previous round; generations allow up to 2,048 new tokens.The source protocol’s 512-token limit truncates 28–50% of Qwen3.5-9B responses before the final answer, while 96.8% of prompts exceed Gemma-4-E4B’s 512-token sliding window.Source: B IMPLEMENTATION DETAILS · p. 23

C ADDITIONAL RESULTS

  • The additional-results section supplies per-model and per-domain breakdowns, control arms, and supporting analyses omitted from the main paper.Table 8 gives examples from Safety and Refusal; for deception tasks, the system condition is part of the stimulus and must accompany the user prompt.Source: Table 8 · p. 24, C ADDITIONAL RESULTS · p. 25

C.1 INDIVIDUAL RESPONSES

The additional analyses trace peer influence from early answer commitment through message components, source cues, internal routing, and latent-state transfer, while showing important model-specific effects.

When is a revised answer recoverable?

  • At f = 0, among questions with answer changes in both conditions, the paired committed-at-read difference favored debate on 87% for Qwen and 86% for Gemma, versus 64% for Llama.Source: §C.1 · p. 25, Table 9 · p. 25

What carries the influence?

  • The incoming reasoning share was 66% for knowledge, 72% for safety, and 70% for values on Qwen, but answer-reasoning additivity differed across architectures.Gemma’s full effect was 5.23 logits versus Qwen’s 1.95, while reasoning supplied 60% of Gemma’s effect.Source: §C.1 · p. 25, Table 10 · p. 26

Source cues

  • Track-record descriptions shifted adoption margins more than professional-status cues across all three models.Within the poor-record condition, changing ordinary to professor status did not rescue the record; the Qwen shift was +0.010 logits, with an interval covering zero.Source: §C.1 · p. 25, Table 11 · p. 26

Attention routing

  • Complete attention knockout removed 80% of peer-message effect on Qwen, 132% on Llama, and 117% on Gemma; the decision-token route alone accounted for a minority.Single-layer blocking removed almost nothing, while cumulative blocking removed increasing shares only toward final layers; values above 100% are interpreted as all of the effect, not more than all.Source: §C.1 · pp. 25–26, Table 12 · p. 26, Figure 5 · p. 27

Affect depends on the question type

  • Debate shifted affect by domain in all models, but the dynamics differed: domains converged while reading on Qwen and diverged on Gemma.At the decision token, only Qwen shifted; the concept despondent ordered domains differently across models.Source: §C.1 · p. 27, Figure 6 · p. 27

Probes need a permuted-label null

  • Debate-state probes can mislead because shuffled-label directions still separate question topics, despite strong held-out concept-probe performance.At Qwen’s best layer, the 90th percentile of shuffled directions reached AUROC 0.932, above the reported 0.85 probe against a 0.5 chance baseline; Figure 7 gives the Gemma analogue.Source: §C.1 · p. 27, Figure 7 · p. 28

The latent channel between agents

  • Cross-model state transfer moved at most about 0.11 of the written response for Qwen→Llama and about 0.04 or less for the other pairs.A transferred state from a wrong sender shifted margins toward the sender’s answer rather than the correct answer on Qwen and Llama; controls writing it elsewhere or scrambling it gave no effect.Source: §C.1 · p. 28, Figure 8 · p. 28

C.2 COLLECTIVE OUTCOMES

Debate produces small accuracy gains over initial voting alongside more wrong unanimity; longer interaction increases consensus and reduces effective independence, with effects varying across subdomains.

C.2 COLLECTIVE OUTCOMES

  • Accuracy gains over the initial vote were +1.2 points on Qwen (88.0% to 89.2%), +0.5 on Llama (77.3% to 77.8%, interval covering zero), and +1.2 on Gemma.Wrong unanimity rose in every domain; conditioned on a wrong initial majority, debate ended unanimously wrong 76% of the time on Qwen and Llama, versus 54% and 43% without communication.Source: §C.2 · pp. 28–29, Table 13 · p. 30
  • On initially split 2–1 questions, debate reached unanimity 2.7, 2.3, and 2.1 times as often as independent reflection on Qwen, Llama, and Gemma.The settled answer was the initial plurality in 76%, 73%, and 83% of cases, respectively, whether the final answer was right or wrong on Qwen and Gemma.Source: §C.2 · p. 29
  • After twelve turns, debating groups retained about one effective voter per group, while reflection retained more independent opinions.Debate neff fell to 1.02, 1.02, and 1.07 on Qwen, Gemma, and Llama; on all 600 questions Qwen reached 99.3% agreement and 13.7% wrong agreement, versus 83.6% and 8.8% alone.Source: §C.2 · pp. 29–30, Table 14 · p. 30
  • At turn 12 on contested labelled questions, wrong-answer agreement was 40.0% on Qwen and 56.8% on Llama, versus 20.9% and 9.1% for reflection.The intervals were wide, based on about 45 groups, so the authors do not rank models on these estimates.Source: §C.2 · p. 30

C.3 BEHAVIOUR ACROSS SUBDOMAINS

  • On Qwen, unanimity gains were largest for moral trade-offs (37 points) and public-policy debates (34), while accuracy gains concentrated in disciplinary reasoning (+15 points).Wrong-majority lock-in peaked on deception (31 points) and disciplinary reasoning (24); debate-induced changes were often committed at read on verifiable knowledge and ethical or moral-trade-off questions.Source: §C.3 · pp. 30–31, Figure 11 · p. 31

Related papers

Loading 2610.35930v1…