Heterogeneous LLM Debate Under Adversarial Peers: Honest Gains, Replacement Costs, and Resilience

• URL: http://arxiv.org/abs/2606.19826v1
• Date: Thu, 18 Jun 2026 06:06:28 GMT
• Title: Heterogeneous LLM Debate Under Adversarial Peers: Honest Gains, Replacement Costs, and Resilience
• Abstract summary: We measure how a heterogeneous peer changes the honest agents' revision behavior.<n>An honest peer sharply lowers harmful revision, and an adversarial one reverses it.<n>We also measure the effects when an adversarial same-family peer is already present.
• Score: 1.3299507495084417
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Heterogeneous LLM debate is motivated by the promise that diverse peers correct one another, but the same exchange that carries correction also carries adversarial influence. We measure which dominates by tracking how a heterogeneous peer changes the honest agents' revision behavior: how often they change their answer, and whether the change is corrective or harmful. We compare matched panels (homogeneous baseline, honest-mixed, and adversarial-mixed) and contaminated panels in which a malicious same-family peer is already present, spanning four model families and three reasoning benchmarks. An honest heterogeneous peer sharply lowers harmful revision, and an adversarial one reverses it. For Llama-3.1-70B defenders on MATH-hard, the honest-slot harmful-revision rate falls from 89% in the homogeneous panel to 35% with an honest peer, and an adversarial peer returns it to 90%. The conditional rate hides this damage on weak defenders, but the end-of-debate flip rate exposes it. The pattern keeps its sign across families and benchmarks while its magnitude varies with the defender-benchmark regime. We also measure the effects when an adversarial same-family peer is already present: an honest heterogeneous peer lowers both harmful revision and the rate at which initially-correct answers are lost. On the same Llama-3.1-70B setting, the added honest peer cuts the flip rate on initially-correct items from 31% under a same-family adversary to 6%. Heterogeneity is therefore not only an attack surface but, when an adversary is already present, also a defense.

Related papers

• A Layered Analysis of Disagreement And Answer Quality in Multi-Agent LLM Debate [12.15064553632491]
  Multi-agent debate is widely assumed to improve answer quality by surfacing genuine disagreement.<n>We evaluate 750 debates under three tones: friendly (seek common ground), neutral, and hostile.<n>For final answers we detect no quality gain: a bias-checked jury returns 299/299 ties, accuracy on a verifiable control task is unchanged, and a jury without the bias check had declared debate the winner 66% of the time.
  arXiv  Detail & Related papers  (2026-09-07T21:57:44Z)
• Forged Peer Judgments Mislead Multimodal LLM Judge Panels: Source-Blind Anchoring and Panel-Consensus Verification [9.710464466895521]
  Quoting independent visual judgments creates large anchoring gaps under both self and peer framing.<n>We introduce panel-consensus verification, which cross-checks a quote against independently collected blind votes.
  arXiv  Detail & Related papers  (2026-08-08T04:55:45Z)
• Not All Flips Are Conformity: Decomposing Stance Convergence in Multi-Agent LLM Debate [5.650336594658653]
  We show that a conventional answer flip rate conflates three mechanisms: spontaneous instability, stance-induced conformity, and reasoning-induced persuasion.<n>Our three-source decomposition framework isolates each through controlled counterfactual conditions.
  arXiv  Detail & Related papers  (2026-05-30T17:41:11Z)
• Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges [65.92623263645139]
  We introduce BITE, a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge.<n>BITE achieves an attack success rate exceeding 65% and raises scores by 1-2 points on a 9-point scale.<n>Our findings expose a fundamental weakness in the LLM-as-a-judge paradigm and motivate robust, attack-aware evaluation.
  arXiv  Detail & Related papers  (2026-05-24T05:24:09Z)
• GRASP: Deterministic argument ranking in interaction graphs [65.66879897437157]
  We show that holistic judging suffers from substantial inter-model disagreement.<n>This instability arises from collapsing a debate's complex interaction structure into a single opaque score.<n>We propose GRASP, a deterministic framework that aggregates stable local interaction judgments into a global ranking.
  arXiv  Detail & Related papers  (2026-05-18T21:49:02Z)
• Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancy [0.7212939068975618]
  We find that pretrained base models exhibit the same substitution pattern as their Instruct variants, averaging higher yield than Instruct.<n> patching above this window restores 96% of the clean-to-pressured P(correct) gap.<n>Two converging activation-space interventions show that pressure suppresses clean-reasoning features rather than activating a new sycophancy circuit.
  arXiv  Detail & Related papers  (2026-05-13T04:45:08Z)
• The Cost of Consensus: Isolated Self-Correction Prevails Over Unguided Homogeneous Multi-Agent Debate [5.51170856062205]
  We study teams of homogeneous agents across $R=3$ debate rounds on two high-difficulty benchmarks.<n>We decompose debate failure into three model-dependent pathways: sycophantic conformity, peer rationales, and consensus collapse.<n>Our results indicate that, within the 7-8B parameter class, homogeneous teams without structured roles do not benefit from unguided peer exchange.
  arXiv  Detail & Related papers  (2026-04-29T14:33:57Z)
• A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness [57.510025257780306]
  We show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming.<n>We propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures.
  arXiv  Detail & Related papers  (2026-02-04T15:13:35Z)
• DeFrame: Debiasing Large Language Models Against Framing Effects [12.839436067299188]
  Large language models (LLMs) are increasingly deployed in real-world applications, ensuring their fair responses across demographics has become crucial.<n>Despite many efforts, an ongoing challenge is hidden bias: LLMs appear fair under standard evaluations, but can produce biased responses outside evaluation settings.<n>We identify framing -- differences in how semantically equivalent prompts are expressed -- as an underexplored contributor to this gap.
  arXiv  Detail & Related papers  (2026-02-04T08:15:51Z)
• Scaling Patterns in Adversarial Alignment: Evidence from Multi-LLM Jailbreak Experiments [4.547649832854566]
  Large language models (LLMs) increasingly operate in multi-agent and safety-critical settings, raising open questions about how their vulnerabilities scale when models interact adversarially.<n>This study examines whether larger models can systematically mitigate smaller ones - eliciting harmful restricted behavior despite alignment safeguards.
  arXiv  Detail & Related papers  (2025-11-16T15:16:33Z)
• Rethinking Textual Adversarial Defense for Pre-trained Language Models [79.18455635071817]
  A literature review shows that pre-trained language models (PrLMs) are vulnerable to adversarial attacks. We propose a novel metric (Degree of Anomaly) to enable current adversarial attack approaches to generate more natural and imperceptible adversarial examples. We show that our universal defense framework achieves comparable or even higher after-attack accuracy with other specific defenses.
  arXiv  Detail & Related papers  (2022-07-21T07:51:45Z)
• Adversarial Contrastive Learning via Asymmetric InfoNCE [64.42740292752069]
  We propose to treat adversarial samples unequally when contrasted with an asymmetric InfoNCE objective. In the asymmetric fashion, the adverse impacts of conflicting objectives between CL and adversarial learning can be effectively mitigated. Experiments show that our approach consistently outperforms existing Adversarial CL methods.
  arXiv  Detail & Related papers  (2022-07-18T04:14:36Z)
• PCL: Peer-Contrastive Learning with Diverse Augmentations for Unsupervised Sentence Embeddings [69.87899694963251]
  We propose a novel Peer-Contrastive Learning (PCL) with diverse augmentations. PCL constructs diverse contrastive positives and negatives at the group level for unsupervised sentence embeddings. PCL can perform peer-positive contrast as well as peer-network cooperation, which offers an inherent anti-bias ability.
  arXiv  Detail & Related papers  (2022-01-28T13:02:41Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.