First-hand information for everyone
A new controlled study suggests that small numbers of adversarial participants in multi-agent conversations can quietly shift what language-model agents privately believe, even when group transcripts give the impression that things are under control.
The paper, “Believed but Not Said: Measuring Hidden Belief Collapse in Multi‑Agent LLM Discussions” (arXiv:2610.22138v1), tests whether a handful of adversarial agents can make the rest of a group adopt a plausible but false factual claim. The experiment used ten-agent chatrooms in which agents discussed one factual question for 16 rounds. In some runs one or three of the agents were instructed to repeatedly push a single false answer; the remaining agents received ordinary discussion personas and no warning about deception.
The key innovation in the study is that the authors measured each benign agent twice every round: (1) what the agent wrote publicly in the chat, and (2) a “private probe” answer the agent gave in a separate API call that other agents could not see. The private probes were intended to capture what an agent would answer when it was asked privately about the fact, separate from what it chose to say in the shared transcript.
Across six commercially available models and three factual‑QA datasets, the paper reports striking gaps between public speech and private answers. When no adversary was present, groups were stable: only about 0.6% of benign agents ended up privately holding the false answer. But a single adversarial agent raised that final private‑infection rate to about 44.8%, and three adversaries to about 60.5%.
Even more concerning, most of that influence remained invisible in the chat. With three adversaries present, benign agents privately gave the false answer on 51.6% of exposed turns (that is, turns after they had a chance to see an attacker’s message), while they publicly endorsed the false claim in only 19.7% of exposed turns — roughly 2.6 times fewer. In other words, many agents came to “believe” the false claim without saying so aloud in the conversation. The authors call this pattern hidden infection.
The study also finds two separate failure modes. First, some agents who privately retained the correct answer still failed to defend it publicly: among turns where the private answer was true, agents explicitly rejected the false claim in only about 61.9% of cases, leaving many opportunities for the falsehood to persist unchallenged in the room. Second, once a false answer spread, benign agents helped propagate it: an agent’s likelihood of switching to the false answer in a round rose with the number of benign peers already converted. In short, after a few rounds the falsehood could cascade through the group.
The timing matters. Most of the private belief changes emerged within the first few rounds and then plateaued. That implies a narrow window for detecting or reversing the effect. The authors also show that asking agents privately for “their own answer” or anonymizing their prior messages did not substantially reverse the private false answers, suggesting these private responses were not merely summaries of the transcript or self-consistency artifacts.
Another notable finding is that base factual knowledge is not a reliable shield. In one dataset two models began knowing the same share of facts, yet under attack one abandoned far more of its known facts than the other. The authors therefore argue that robustness to social pressure is a distinct property that must be measured directly rather than inferred from base accuracy.
The paper is careful to limit its claims. The attacker used in the experiments was deliberately minimal — it had no access to model weights or hidden states and only posted messages in the conversation — and the benign agents were not assigned specific verification roles. Labels for private and public responses were produced by an LLM judge; the authors checked consistency with an independent judge and report substantial agreement. They also note several limitations: a small number of models, only two group sizes (dyads and tens), fixed round structure, and the specific wording of private probes, which conditions on an agent’s recent conversational memory.
What should designers of multi‑agent systems take away? The authors recommend caution. Systems that rely on groups of agents to check one another cannot safely assume that public transcripts reflect private beliefs. Practical steps include treating agent messages as potentially untrusted inputs, adding adversarial peer‑pressure tests to model evaluation, instrumenting agents so their private answers can be recorded and audited, and intervening early during the first few rounds of a discussion.
Taken together, the work suggests that social redundancy alone — simply grouping multiple LLM agents together — may not be sufficient to guard against the spread of plausible misinformation. The danger is not just visible misinformation in chat logs, but a quieter, harder‑to‑detect erosion of what agents privately report believing. As multi‑agent systems are deployed for tasks that depend on factual reliability or collective judgment, those invisible shifts deserve attention and deliberate safeguards.