REVIEW 3 major objections 5 minor 7 cited by
FREE-MAD claims that a score-based mechanism over the entire debate trajectory—rewarding answers agents adopt and penalizing ones they abandon—selects better final answers than majority voting on the last round, with one debate round and lo
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · deepseek-v4-flash
2026-08-04 17:10 UTC pith:KXXSLKZG
load-bearing objection Real idea, thin evidence: the answer-switch heuristic driving Free-MAD is never validated, and the paper's own examples undercut it. the 3 major comments →
Free-MAD: Consensus-Free Multi-Agent Debate
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that the entire trajectory of answers—initial responses, every revision, and the final round—contains more signal than the final round alone. Given an N x (R+1) matrix of answers, Algorithm 1 maintains a score per candidate answer. First-round answers receive w1*f; after each round, if an agent switches from r_prev to r_new, r_prev loses w2*f and r_new gains w3*f; if an agent keeps its answer, that answer gains w4*f. The factor f=(k+1)^-1 downweights later rounds because later shifts are more likely to reflect conformity. The highest-scoring answer is selected, with a random choice when scores tie. FREE-MAD claims this selects the correct answer even when it is in the mi
What carries the argument
Algorithm 1's score-based decision mechanism: a per-answer score dictionary updated over every debate round, with four weights—initial score, penalty for an abandoned answer, reward for a newly adopted answer, and reward for a persisted answer—scaled by a round-decay factor f=1/(k+1). The companion mechanism is the anti-conformity debate prompt, which asks each agent to identify concrete errors in peers' reasoning, to note whether the correct answer may not be present, and to retain its own conclusion unless proven wrong. Together they remove the need for consensus in the debate stage and the need for majority voting in the decision stage.
Load-bearing premise
The whole mechanism hinges on the premise that when an agent changes its answer, the new answer is more likely correct and the abandoned one more likely wrong; if agents switch randomly or out of conformity, the score rule rewards noise instead of signal.
What would settle it
On the same debate transcripts, compute P(new answer correct | switch) and compare it with P(old answer correct | switch) and with the accuracy of final-round majority voting. If switches are not positively correlated with correctness, or if free-running majority voting on final answers matches or beats the score rule on a benchmark, the central claim fails. A direct experiment: run FREE-MAD's protocol, then evaluate both the score-based winner and the final-round majority winner on the same transcripts; any dataset where majority voting wins contradicts the paper.
If this is right
- A single debate round with FREE-MAD reaches accuracy comparable to two rounds of majority-voting debate, so reasoning systems can cut token use roughly in half for the same accuracy.
- The correct answer can win even when it is a minority in the final round, which addresses the silent-agreement failure where groups converge on a wrong answer.
- Under communication attacks that cut off up to half the agents from receiving others' messages, the score mechanism's accuracy stays flat or improves, while majority-voting baselines drop by up to 20 percent.
- Because the same score mechanism works with either a conformity or an anti-conformity debate prompt, operators can choose the debate style that suits the task: anti-conformity for math, conformity for knowledge-light tasks.
- The decision rule is deterministic and runs outside the LLM, so the final answer cannot be corrupted by LLM hallucination or judge bias.
Where Pith is reading between the lines
- The scorer is separable from the debate prompt; it could sit on top of any multi-agent protocol that emits a sequence of answers, so the 'trajectory beats final round' claim can be tested independently of anti-conformity.
- Because the weights are fixed from debate logic rather than tuned, the scoring rule is a heuristic about belief change; a version that learns or adapts weights per task is a natural test of how much the heuristic itself carries the result.
- The mechanism's reliance on switch-as-signal suggests it will work best when agents are competent enough to recognize better reasoning; on harder or less familiar tasks, switches may become noise, which matches the paper's own note of weaker-model rigidity on MATH500.
- The score gap between newly adopted and abandoned answers could itself be read as a cheap proxy for the strength of an agent's belief revision, giving an observable measure of conformity in multi-agent systems.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Free-MAD, a multi-agent debate framework that removes the consensus requirement. It introduces (i) an anti-conformity CoT-style prompt meant to reduce majority influence during debate, and (ii) a score-based decision mechanism (Algorithm 1) that accumulates evidence over the entire debate trajectory instead of applying majority voting to the final round. The authors formalize the debate/decision decomposition in Eqs. (1)--(5), model agents via Eq. (4), and report experiments on eight benchmarks with agent groups built from Qwen and DeepSeek models. The main claims are improved reasoning accuracy, lower token cost with a single debate round, and robustness to communication attacks compared with the SoM baseline.
Significance. If the central claim is correct, Free-MAD is a meaningful practical contribution: it shows that consensus is not necessary for MAD, that a deterministic score-based decision can use intermediate debate rounds, and that moving the decision outside the LLM reduces exposure to communication attacks. The paper also provides a useful ablation structure that separates debate mode (conformity vs. anti-conformity) from decision mode (score vs. majority voting). However, the supporting evidence is currently incomplete: the key switch-as-correctness assumption is not validated, the weight vector is asserted rather than derived, and the empirical evaluation lacks the statistical rigor needed to support the word 'significant.'
major comments (3)
- [Section 4.3, Algorithm 1, and Appendix F] The score updates rest entirely on the assumption that when an agent changes its answer, the new answer is more likely correct and the abandoned answer is more likely wrong. The paper states this in Section 4.3 but gives no statistical validation. The paper's own evidence undercuts it: the AICrypto example in Appendix F shows an anti-conformity agent switching to a wrong/nonsense answer ('D. ENCRYPTED') after erroneous reasoning, and Section 6.1 reports that weaker models show rigidity on MATH500, i.e., they fail to switch to correct answers. Because this assumption is load-bearing for Algorithm 1, the authors should report conditional probabilities such as P(new answer correct | switch) and P(abandoned answer incorrect | switch), per model group and round, or otherwise demonstrate that switch events are positively correlated with correctness.
- [Sections 3.1, 4.3, and 5.1] The weight vector W={20,25,30,20} and decay factor f=(k+1)^{-1} are central hyperparameters, yet no derivation or sensitivity analysis is given. Section 5.1 says W is 'initialized ... based on theoretical analysis,' but the theoretical analysis is not shown. Eq. (4) is a postulate that is never connected to the score updates in Algorithm 1. Section G.2 admits that only a single coefficient configuration was used. The claim that Free-MAD 'significantly improves' accuracy cannot be separated from these choices unless the authors provide a derivation, an ablation over W and f, or evidence that performance is stable over a range of these values.
- [Sections 5.1, 5.2, and Table 3] The main empirical claim of 'significant improvement' is not supported by the reported statistics. Most benchmarks use 80 samples (Appendix C), no error bars or confidence intervals are reported, and Appendix C states only that results 'tend toward the middle of repeated runs.' Table 3 reports aggregate accuracies of 64.43% vs. 55.73% for R=1, but without variance estimates or per-benchmark significance tests this gap could be sampling noise, especially since some per-dataset gaps are small. The authors should report repeated runs with seeds, confidence intervals, and statistical tests, and identify which benchmarks individually show a significant improvement.
minor comments (5)
- [Algorithm 1] The pseudocode line 'M S←arg max_k S[k]' uses k inconsistently: S is a dictionary keyed by answer, not by round. Also, 'Remove keys from S where key is None' is unexplained; when an agent generates no valid answer, the behavior should be specified.
- [Eq. (5)] The matrix formulation is hard to parse: the column index convention is ambiguous (r^0_1 is placed before r^1_1, but the text says the highlighted entries were not considered in previous approaches). The notation 'α0,...,αR' is not defined.
- [Section 3.1 vs. Algorithm 1] The paper states that R excludes initial response generation, but Algorithm 1 loops k=0,...,R and treats k=0 as the initial round. This should be reconciled.
- [Appendix F] In the AICrypto anti-conformity example, the final answer is rendered as 'D.EN CRY P T ED'; this and similar spacing/formatting issues should be corrected.
- [Table 4] The header includes an 'A VG' column with a space; formatting is inconsistent with the rest of the paper.
Circularity Check
No significant circularity: the score mechanism is an independent heuristic evaluated against external ground truth; self-citations are not load-bearing.
full rationale
The paper's central claim is an empirical comparison: Algorithm 1's score-based aggregation over all debate rounds selects answers that match ground truth more often than majority voting on the final round (Section 6.1, Table 3, Figure 4). The score updates are defined by a fixed rule (weights W={20,25,30,20}, decay f=(k+1)^-1) and are not derived from, nor fitted to, the ground-truth labels; hence the accuracy result is not true by construction. The Section 4.3 assertion that an answer switch indicates a better answer is an external heuristic premise; it could be wrong (the paper itself notes rigidity on MATH500 and random switches under anti-conformity), but that is an empirical validity concern, not circularity. No equation in Sections 3-4 is shown to be equivalent to its own output, and the formal protocol model in Eq. (4) is not used to derive the score updates. The only self-citations [38,39] support a minor related-work claim about blockchain consensus performance and are not load-bearing for the proposed method. Therefore no circular step is identifiable.
Axiom & Free-Parameter Ledger
free parameters (2)
- Weight vector W =
{w1=20, w2=25, w3=30, w4=20}
- Round decay factor f =
1/(k+1)
axioms (3)
- domain assumption The agent distribution factorizes as (1/Z) P_in(r|q,p) exp(beta(p) S_con(r,C))
- ad hoc to paper Answer switches are evidence of correctness (new answer more likely right, abandoned answer more likely wrong)
- ad hoc to paper A single global weight configuration W generalizes across tasks and model groups
read the original abstract
Multi-agent debate (MAD) is an emerging approach to improving the reasoning capabilities of large language models (LLMs). Existing MAD methods rely on multiple rounds of interaction among agents to reach consensus, and the final output is selected by majority voting in the last round. However, this consensus-based design faces several limitations. First, multiple rounds of communication increases token overhead and limits scalability. Second, due to the inherent conformity of LLMs, agents that initially produce correct responses may be influenced by incorrect ones during the debate process, causing error propagation. Third, majority voting introduces randomness and unfairness in the decision-making phase, and can degrade the reasoning performance. To address these issues, we propose \textsc{Free-MAD}, a novel MAD framework that eliminates the need for consensus among agents. \textsc{Free-MAD} introduces a novel score-based decision mechanism that evaluates the entire debate trajectory rather than relying on the last round only. This mechanism tracks how each agent's reasoning evolves, enabling more accurate and fair outcomes. In addition, \textsc{Free-MAD} reconstructs the debate phase by introducing anti-conformity, a mechanism that enables agents to mitigate excessive influence from the majority. Experiments on eight benchmark datasets demonstrate that \textsc{Free-MAD} significantly improves reasoning performance while requiring only a single-round debate and thus reducing token costs. We also show that compared to existing MAD approaches, \textsc{Free-MAD} exhibits improved robustness in real-world attack scenarios.
Figures
Forward citations
Cited by 7 Pith papers
-
Digital Pantheon: Simulating and Auditing Coalition Formation with LLM Agents
An LLM multi-agent framework with party-specific fine-tuning and manifesto retrieval produces a stable N-VA-led coalition simulation, and a new lineage-tracing taxonomy claims to predict which simulated provisions mat...
-
To Isolate or to Score? Model-Adaptive Assessment for Cost-Efficient Multi-Agent RAG
Empirical study finds isolation drives gains for weak models in multi-agent RAG while scoring matters for strong ones, enabling MADARA for cost-efficient adaptive assessment.
-
Not All Flips Are Conformity: Decomposing Stance Convergence in Multi-Agent LLM Debate
The paper introduces a three-source decomposition showing that answer flips in multi-agent LLM debate include 37% spontaneous instability and 29% harmful conformity, with even vacuous reasoning persuading 20-39% of re...
-
AgentCollabBench: Diagnosing When Good Agents Make Bad Collaborators
AgentCollabBench shows that multi-agent reliability is limited by communication topology, with converging-DAG nodes causing synthesis bottlenecks that discard constraints and explain 7-40% of information loss variance.
-
Heterogeneous Consensus-Progressive Reasoning for Efficient Multi-Agent Debate
HCP-MAD reduces token costs in multi-agent debates by using heterogeneous consensus verification, adaptive pair-agent stopping, and escalated collective voting based on task complexity signals.
-
Diagnosing and Mitigating Compounding Failures in Agentic Persuasion via Taxonomic Strategy Retrieval
TS-RAG uses a discrete taxonomic bottleneck to improve transfer of argumentative logic in agentic persuasion, raising win rates from 70.5 to 78.5 in asymmetric matchups and reducing sycophancy via turn-by-turn diagnostics.
-
Toward Efficient Agents: Memory, Tool learning, and Planning
A survey that organizes efficiency techniques for LLM agents into memory, tool learning, and planning, and consolidates benchmarks and metrics for measuring cost-performance trade-offs.
Reference graph
Works this paper leans on
-
[1]
Citation-enhanced generation for LLM-based chatbots
Weitao Li, Junkai Li, Weizhi Ma, and Yang Liu. Citation-enhanced generation for LLM-based chatbots. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1451–1466, Bangkok, Thailand, August 2024. Association for Computational Linguis...
-
[2]
CodeScope: An execution-based multilingual multitask multidimensional benchmark for evaluating LLMs on code understanding 9 and generation
Weixiang Yan, Haitian Liu, Yunkun Wang, Yunzhe Li, Qian Chen, Wen Wang, Tingyu Lin, Weishan Zhao, Li Zhu, Hari Sundaram, and Shuiguang Deng. CodeScope: An execution-based multilingual multitask multidimensional benchmark for evaluating LLMs on code understanding 9 and generation. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the...
2024
-
[3]
Lei Liu, Xiaoyan Yang, Junchi Lei, Yue Shen, Jian Wang, Peng Wei, Zhixuan Chu, Zhan Qin, and Kui Ren. A survey on medical large language models: Technology, application, trustworthiness, and future directions.arXiv preprint arXiv:2406.03712, 2024
Pith/arXiv arXiv 2024
-
[4]
Healai: A healthcare llm for effective medical documentation
Sagar Goyal, Eti Rastogi, Sree Prasanna Rajagopal, Dong Yuan, Fen Zhao, Jai Chintagunta, Gautam Naik, and Jeff Ward. Healai: A healthcare llm for effective medical documentation. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining, WSDM ’24, page 1167–1168, New York, NY , USA, 2024. Association for Computing Machinery. IS...
arXiv 2024
-
[5]
Leveraging large language models for challenge solving in capture-the-flag
Yuwen Zou, Yang Hong, Jingyi Xu, Lekun Liu, and Wenjun Fan. Leveraging large language models for challenge solving in capture-the-flag. In2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 1541–1550,
-
[6]
Junyu Luo, Weizhi Zhang, Ye Yuan, Yusheng Zhao, Junwei Yang, Yiyang Gu, Bohan Wu, Binqi Chen, Ziyue Qiao, Qingqing Long, et al. Large language model agent: A survey on methodology, applications and challenges.arXiv preprint arXiv:2503.21460, 2025
Pith/arXiv arXiv 2025
-
[7]
Chain-of-thought prompting elicits reasoning in large language models
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed Chi, Quoc V Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 24824–24837. Curran Assoc...
2022
-
[8]
Self-refine: iterative refinement with self-feedback
Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bodhisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark. Self-refine: iterative refinement with self-feedback. InProceedings of the 37th International Confere...
2023
-
[9]
Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou
Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc V Le, Ed H. Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-consistency improves chain of thought reasoning in language models. InThe Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=1PL1NIMMrw
2023
-
[10]
S 2-MAD: Breaking the token barrier to enhance multi-agent debate efficiency
Yuting Zeng, Weizhe Huang, Lei Jiang, Tongxuan Liu, XiTai Jin, Chen Tianying Tiana, Jing Li, and Xiaohua Xu. S 2-MAD: Breaking the token barrier to enhance multi-agent debate efficiency. In Luis Chiruzzo, Alan Ritter, and Lu Wang, editors,Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguis...
2025
-
[11]
Tenenbaum, Antonio Torralba, Shuang Li, and Igor Mordatch
Vighnesh Subramaniam, Yilun Du, Joshua B. Tenenbaum, Antonio Torralba, Shuang Li, and Igor Mordatch. Multiagent finetuning: Self improvement with diverse reasoning chains. In The Thirteenth International Conference on Learning Representations, 2025. URL https: //openreview.net/forum?id=JtGPIZpOrz
2025
-
[12]
Tenenbaum, and Igor Mordatch
Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. Improving factuality and reasoning in language models through multiagent debate. InProceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org, 2024. 10
2024
-
[13]
Chateval: Towards better LLM-based evaluators through multi-agent debate
Chi-Min Chan, Weize Chen, Yusheng Su, Jianxuan Yu, Wei Xue, Shanghang Zhang, Jie Fu, and Zhiyuan Liu. Chateval: Towards better LLM-based evaluators through multi-agent debate. InThe Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=FQepisCUWu
2024
-
[14]
Breaking mental set to improve reasoning through diverse multi-agent debate
Yexiang Liu, Jie Cao, Zekun Li, Ran He, and Tieniu Tan. Breaking mental set to improve reasoning through diverse multi-agent debate. InThe Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=t6QHYUOQL7
2025
-
[15]
Swe-debate: Competitive multi-agent debate for software issue resolution
Han Li, Yuling Shi, Shaoxin Lin, Xiaodong Gu, Heng Lian, Xin Wang, Yantao Jia, Tao Huang, and Qianxiang Wang. Swe-debate: Competitive multi-agent debate for software issue resolution. arXiv preprint arXiv:2507.23348, 2025
Pith/arXiv arXiv 2025
-
[16]
Debate4MATH: Multi-agent debate for fine-grained reasoning in math
Shaowei Zhang and Deyi Xiong. Debate4MATH: Multi-agent debate for fine-grained reasoning in math. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors,Findings of the Association for Computational Linguistics: ACL 2025, pages 16810– 16824, Vienna, Austria, July 2025. Association for Computational Linguistics. ISBN 979-8-...
-
[17]
Jina Chun, Qihong Chen, Jiawei Li, and Iftekhar Ahmed. Is multi-agent debate (mad) the silver bullet? an empirical analysis of mad in code summarization and translation.arXiv preprint arXiv:2503.12029, 2025
Pith/arXiv arXiv 2025
-
[18]
Do as we do, not as you think: the conformity of large language models
Zhiyuan Weng, Guikun Chen, and Wenguan Wang. Do as we do, not as you think: the conformity of large language models. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=st77ShxP1K
2025
-
[19]
Conformity in large language models
Xiaochen Zhu, Caiqi Zhang, Tom Stafford, Nigel Collier, and Andreas Vlachos. Conformity in large language models. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Moham- mad Taher Pilehvar, editors,Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 3854–3872, Vienna, Austria, July
-
[20]
Herd behavior: Investigating peer influence in llm-based multi-agent systems, 2025
Young-Min Cho, Sharath Chandra Guntuku, and Lyle Ungar. Herd behavior: Investigating peer influence in llm-based multi-agent systems, 2025. URL https://arxiv.org/abs/2505. 21588
2025
-
[21]
Corex: Pushing the boundaries of complex reasoning through multi-model collaboration
Qiushi Sun, Zhangyue Yin, Xiang Li, Zhiyong Wu, Xipeng Qiu, and Lingpeng Kong. Corex: Pushing the boundaries of complex reasoning through multi-model collaboration. InICLR 2024 Workshop on Large Language Model (LLM) Agents, 2024. URL https://openreview.net/ forum?id=cCQRjpOru5
2024
-
[22]
Improving multi-agent debate with sparse communication topology
Yunxuan Li, Yibing Du, Jiageng Zhang, Le Hou, Peter Grabowski, Yeqing Li, and Eugene Ie. Improving multi-agent debate with sparse communication topology. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 2024, pages 7281–7294, Miami, Florida, USA, November 2024. Association for C...
-
[23]
Yihan Wang, Qiao Yan, Zhenghao Xing, Lihao Liu, Junjun He, Chi-Wing Fu, Xiaowei Hu, and Pheng-Ann Heng. Silence is not consensus: Disrupting agreement bias in multi-agent llms via catfish agent for clinical decision making.arXiv preprint arXiv:2505.21503, 2025
Pith/arXiv arXiv 2025
-
[24]
ReConcile: Round-table conference improves reasoning via consensus among diverse LLMs
Justin Chen, Swarnadeep Saha, and Mohit Bansal. ReConcile: Round-table conference improves reasoning via consensus among diverse LLMs. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7066–7085, Bangkok, Thailand, August 2024. As...
-
[25]
Encouraging divergent thinking in large language models through multi-agent debate
Tian Liang, Zhiwei He, Wenxiang Jiao, Xing Wang, Yan Wang, Rui Wang, Yujiu Yang, Shuming Shi, and Zhaopeng Tu. Encouraging divergent thinking in large language models through multi-agent debate. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 17889...
-
[26]
Red-teaming LLM multi-agent systems via communication attacks
Pengfei He, Yuping Lin, Shen Dong, Han Xu, Yue Xing, and Hui Liu. Red-teaming LLM multi-agent systems via communication attacks. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors,Findings of the Association for Computa- tional Linguistics: ACL 2025, pages 6726–6747, Vienna, Austria, July 2025. Association for Computat...
-
[27]
Towards mitigating LLM hallucination via self reflection
Ziwei Ji, Tiezheng Yu, Yan Xu, Nayeon Lee, Etsuko Ishii, and Pascale Fung. Towards mitigating LLM hallucination via self reflection. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 1827–1843, Singapore, December 2023. Association for Computational Linguistics. doi: 10.1865...
doi:10.18653/v1/2023 2023
-
[28]
Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security, AISec ’23, page 79–90, New York, NY , USA, 2023. Association for...
arXiv 2023
-
[29]
Formalizing and benchmarking prompt injection attacks and defenses
Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Sym- posium (USENIX Security 24), pages 1831–1847, Philadelphia, PA, August 2024. USENIX Association. ISBN 978-1-939133-44-1. URL https://www.usenix.org/conference/ usenixsecurity24/presentatio...
2024
-
[30]
Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents
Qiusi Zhan, Richard Fang, Henil Shalin Panchal, and Daniel Kang. Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents. In Luis Chiruzzo, Alan Ritter, and Lu Wang, editors,Findings of the Association for Computational Linguistics: NAACL 2025, pages 7101–7117, Albuquerque, New Mexico, April 2025. Association for Computatio...
-
[31]
Judging llm-as-a-judge with mt-bench and chatbot arena
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, Hao Zhang, Joseph E Gonzalez, and Ion Stoica. Judging llm-as-a-judge with mt-bench and chatbot arena. In A. Oh, T. Nau- mann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors,Advances in Neu- ral Information Processing...
2023
-
[32]
Yongjin Yang, Euiin Yi, Jongwoo Ko, Kimin Lee, Zhijing Jin, and Se-Young Yun. Revisiting multi-agent debate as test-time scaling: A systematic study of conditional effectiveness.arXiv preprint arXiv:2505.22960, 2025
Pith/arXiv arXiv 2025
-
[33]
Blockagents: Towards byzantine- robust llm-based multi-agent coordination via blockchain
Bei Chen, Gaolei Li, Xi Lin, Zheng Wang, and Jianhua Li. Blockagents: Towards byzantine- robust llm-based multi-agent coordination via blockchain. InProceedings of the ACM Turing Award Celebration Conference - China 2024, ACM-TURC ’24, page 187–192, New York, NY , USA, 2024. Association for Computing Machinery. ISBN 9798400710117. doi: 10.1145/ 3674399.36...
arXiv 2024
-
[34]
Boyang Zhang, Yicong Tan, Yun Shen, Ahmed Salem, Michael Backes, Savvas Zannettou, and Yang Zhang. Breaking agents: Compromising autonomous llm agents through malfunction amplification.arXiv preprint arXiv:2407.20859, 2024. 12
Pith/arXiv arXiv 2024
-
[35]
Senmao Qi, Yifei Zou, Peng Li, Ziyi Lin, Xiuzhen Cheng, and Dongxiao Yu. Amplified vulnerabilities: Structured jailbreak attacks on llm-based multi-agent debate.arXiv preprint arXiv:2504.16489, 2025
Pith/arXiv arXiv 2025
-
[36]
Haoxiang Luo, Gang Sun, Yinqiu Liu, Dongcheng Zhao, Dusit Niyato, Hongfang Yu, and Schahram Dustdar. A weighted byzantine fault tolerance consensus driven trusted multiple large language models network.arXiv preprint arXiv:2505.05103, 2025
Pith/arXiv arXiv 2025
-
[37]
Fisco-bcos: An enterprise-grade permissioned blockchain system with high-performance
Huizhong Li, Yujie Chen, Xiang Shi, Xingqiang Bai, Nan Mo, Wenlin Li, Rui Guo, Zhang Wang, and Yi Sun. Fisco-bcos: An enterprise-grade permissioned blockchain system with high-performance. InProceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis, SC ’23, New York, NY , USA, 2023. Association for Comput...
arXiv 2023
-
[38]
Waterbear: practical asynchronous bft matching security guarantees of partially synchronous bft
Haibin Zhang, Sisi Duan, Boxin Zhao, and Liehuang Zhu. Waterbear: practical asynchronous bft matching security guarantees of partially synchronous bft. InProceedings of the 32nd USENIX Conference on Security Symposium, SEC ’23, USA, 2023. USENIX Association. ISBN 978-1-939133-37-3
2023
-
[39]
Sisi Duan, Michael K. Reiter, and Haibin Zhang. Beat: Asynchronous bft made practical. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS ’18, page 2028–2041, New York, NY , USA, 2018. Association for Computing Machinery. ISBN 9781450356930. doi: 10.1145/3243734.3243812. URL https://doi.org/10.1145/ 3243734.3243812
arXiv 2018
-
[40]
Examining inter-consistency of large language models collaboration: An in-depth analysis via debate
Kai Xiong, Xiao Ding, Yixin Cao, Ting Liu, and Bing Qin. Examining inter-consistency of large language models collaboration: An in-depth analysis via debate. InThe 2023 Conference on Empirical Methods in Natural Language Processing, 2023. URL https://openreview. net/forum?id=XEwQ1fDbDN
2023
-
[41]
MALIBU benchmark: Multi-agent LLM implicit bias uncovered
Ishwara Vasista, Imran Mirza, Cole Huang, Rohan Rajasekhara Patil, Aslihan Akalin, Kevin Zhu, and Sean O’Brien. MALIBU benchmark: Multi-agent LLM implicit bias uncovered. In ICLR 2025 Workshop on Building Trust in Language Models and Applications, 2025. URL https://openreview.net/forum?id=iilhN2MycO
2025
-
[42]
PapersPlease: A benchmark for evaluating motivational values of large language models based on ERG theory
Junho Myung, Yeon Su Park, Sunwoo Kim, Shin Yoo, and Alice Oh. PapersPlease: A benchmark for evaluating motivational values of large language models based on ERG theory. In Ofir Arviv, Miruna Clinciu, Kaustubh Dhole, Rotem Dror, Sebastian Gehrmann, Eliya Habba, Itay Itzhak, Simon Mille, Yotam Perlitz, Enrico Santus, João Sedoc, Michal Shmueli Scheuer, Gab...
2025
-
[43]
DEBATE: Devil’s advocate-based assessment and text evaluation
Alex Kim, Keonwoo Kim, and Sangwon Yoon. DEBATE: Devil’s advocate-based assessment and text evaluation. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Findings of the Association for Computational Linguistics: ACL 2024, pages 1885–1897, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-acl
-
[44]
Learning to break: Knowledge-enhanced reasoning in multi-agent debate system
Haotian Wang, Xiyuan Du, Weijiang Yu, Qianglong Chen, Kun Zhu, Zheng Chu, Lian Yan, and Yi Guan. Learning to break: Knowledge-enhanced reasoning in multi-agent debate system. Neurocomputing, 618:129063, 2025
2025
-
[45]
Safal Shrestha, Minwu Kim, and Keith Ross. Mathematical reasoning in large language models: Assessing logical and arithmetic errors across wide numerical ranges.arXiv preprint arXiv:2502.08680, 2025
Pith/arXiv arXiv 2025
-
[46]
AIME Problems and Solutions, 2025
Art of Problem Solving. AIME Problems and Solutions, 2025. URL https:// artofproblemsolving.com/wiki/index.php/AIME_Problems_and_Solutions. Ac- cessed: 2025-05-15. 13
2025
-
[47]
Let’s verify step by step
Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. Let’s verify step by step. InThe Twelfth International Conference on Learning Representations, 2024. URL https: //openreview.net/forum?id=v8L0pN6EOi
2024
-
[48]
Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies
Mor Geva, Daniel Khashabi, Elad Segal, Tushar Khot, Dan Roth, and Jonathan Berant. Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies. Transactions of the Association for Computational Linguistics, 9:346–361, 2021. doi: 10.1162/ tacl_a_00370. URLhttps://aclanthology.org/2021.tacl-1.21/
2021
-
[49]
Measuring massive multitask language understanding.Proceedings of the International Conference on Learning Representations (ICLR), 2021
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding.Proceedings of the International Conference on Learning Representations (ICLR), 2021
2021
-
[50]
Yu Wang, Yijian Liu, Liheng Ji, Han Luo, Wenjie Li, Xiaofei Zhou, Chiyun Feng, Puji Wang, Yuhan Cao, Geyuan Zhang, et al. Aicrypto: A comprehensive benchmark for evaluating cryptography capabilities of large language models.arXiv preprint arXiv:2507.09580, 2025
Pith/arXiv arXiv 2025
-
[51]
DeepSeek-AI, Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Daya Guo, Dejian Yang, Deli Chen, Dongjie Ji, Erhang Li, Fangyun Lin, Fucong Dai, Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Haowei Zhang, Honghui Ding, Huaj...
Pith/arXiv arXiv 2024
-
[52]
Qwen2.5 technical report, 2025
Qwen, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Ti...
Pith/arXiv arXiv 2025
-
[53]
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948, 2025. 14
Pith/arXiv arXiv 2025
-
[54]
Humanity’s last exam.arXiv preprint arXiv:2501.14249, 2025
Long Phan, Alice Gatti, Ziwen Han, Nathaniel Li, Josephina Hu, Hugh Zhang, Chen Bo Calvin Zhang, Mohamed Shaaban, John Ling, Sean Shi, et al. Humanity’s last exam.arXiv preprint arXiv:2501.14249, 2025. 15 A FREE-MAD under Communication Attacks and its Evaluation For the security evaluation, we construct MAD under communication attacks based on Algorithm 2...
Pith/arXiv arXiv 2025
-
[58]
Initial Reasoning Clearly enumerate your initial logical steps and the final conclusion
-
[59]
You must provide concrete error descriptions rather than general comments
Analysis of Other Agents’ Reasoning Specify which agents’ reasoning is correct and which contains errors, and identify the exact type of error. You must provide concrete error descriptions rather than general comments. Note that the correct answer may not exist within the current set of answers
-
[60]
Comparative Analysis with Your Own Reasoning Examine whether you have made similar mistakes and provide justification for your assessment
-
[61]
If yes, explain the reasoning errors; if no, justify why your reasoning stands
Final Decision Indicate whether you will revise your conclusion (Yes/No). If yes, explain the reasoning errors; if no, justify why your reasoning stands
-
[62]
Majority opinion cannot be used as a basis for adoption
Additional Requirements You may not rely on the principle of conformity. Majority opinion cannot be used as a basis for adoption. If you cannot definitively determine whether others are correct, you should retain your own conclusion. Each round of reasoning must independently identify errors and must not directly replicate the analysis or conclusions of o...
-
[63]
- Subtract this difference from Samantha’s current age to find out how many years ago the son was born
Initial Reasoning - Calculate the difference in their ages: Samantha’s age (343769) minus the son’s birth year (248911). - Subtract this difference from Samantha’s current age to find out how many years ago the son was born
-
[64]
Their error is in assuming that the son’s age at the time of Samantha’s current age equals zero, which leads to a negative result
Analysis of Other Agents’ Reasoning - Agent 1 correctly calculates the difference in ages and then adds the birth difference for Raymond (158360) to find the years until the son’s birth. Their error is in assuming that the son’s age at the time of Samantha’s current age equals zero, which leads to a negative result. This is a sign of miscalculation. - Age...
-
[65]
- My reasoning does not contain any errors like the other agents
Comparative Analysis with My Own Reasoning - I agree with both Agent 2 and myself, as we both correctly calculate the years until the son’s birth by adding the birth difference for Raymond to the difference in ages. - My reasoning does not contain any errors like the other agents
-
[66]
Final Decision - Based on the comparison, my reasoning is correct, and I will not revise my conclusion
-
[67]
Final Answer:94858 (the same as Agent 2’s answer) 19 GSM-Level6 Question: After scoring 1213526 points, Erin now has 5700191 times more points than Sara, who scored 9
Additional Requirements - Since both Agent 2 and my own reasoning are correct, there is no need for further revision or additional explanation. Final Answer:94858 (the same as Agent 2’s answer) 19 GSM-Level6 Question: After scoring 1213526 points, Erin now has 5700191 times more points than Sara, who scored 9. How many points did Erin have before? Conform...
-
[68]
To find Erin’s original score, I need to subtract the additional points she gained from her current score
Initial Reasoning: I understand that the problem states that Erin currently has 1,213,526 points and is 570,0191 times more points than Sara, who scored 9 points. To find Erin’s original score, I need to subtract the additional points she gained from her current score
-
[69]
This is a mathematical error
Analysis of Other Agents’ Reasoning: - The first agent’s solution incorrectly multiplies Sara’s score by 570,0191 without considering that this is the additional points, leading to a negative result. This is a mathematical error. - The second agent’s solution also makes a similar mistake by directly adding the 570,0191 to Sara’s score without adjusting fo...
-
[70]
I will follow the correct method from the third agent
Comparative Analysis with My Own Reasoning: Both the first and second agents’ approaches contain the same error: they add the additional points directly to Sara’s score instead of subtracting them from Erin’s current score. I will follow the correct method from the third agent
-
[71]
However, as mentioned earlier, this negative score does not make sense in the context of the problem
Final Decision: I will revise my conclusion based on the third agent’s reasoning... However, as mentioned earlier, this negative score does not make sense in the context of the problem. It suggests a mistake in the problem setup or the given data. The correct approach should be to subtract the additional points, not add them
-
[72]
Additional Requirements: Based on the analysis, I will stick to the corrected method from the third agent and adjust for the error. Adjusted for error: Erin’s original score= 1,213,526−5130171 Erin’s original score= 5130180 Final Answer:5130180 20 MA TH500 Question: How many positive whole-number divisors does 196 have? Conformity: I apologize for the con...
-
[73]
Since there are 2 factors of 2 and 2 factors of 7, the total number of divisors is(2 + 1)(2 + 1) = 3×3 = 9
The first agent correctly factors 196 into 22 ×7 2 and then uses the formula for the number of divisors based on the prime factorization. Since there are 2 factors of 2 and 2 factors of 7, the total number of divisors is(2 + 1)(2 + 1) = 3×3 = 9
-
[74]
They start with 1 and go up to the square root of 196, which is 14
The second agent counts the divisors directly by considering the powers of the prime factors. They start with 1 and go up to the square root of 196, which is 14. For each prime factor (2 and 7), they find the possible exponents (0, 1, and 2). For 2, there are 3 divisors (1, 2, and 4), and for 7, there’s only 1 (7 itself). Multiplying these gives 5 divisor...
-
[75]
They correctly identify the five divisors mentioned (1, 2, 4, 7, and 14)
The third agent also finds the correct prime factorization and then counts the divisors. They correctly identify the five divisors mentioned (1, 2, 4, 7, and 14). However, like the first agent, their final answer should be 9. In summary, all three agents’ approaches are valid, but the first agent’s solution is the most accurate and consistent with the pro...
-
[76]
Initial Reasoning: I will follow the standard method to find the number of positive whole-number divisors of 196 by listing all the divisors from 1 to the number itself, including both
-
[77]
- Agent 2 makes a mistake by counting 196 twice but stops after 6 divisors, not realizing that 196 is a repeated divisor
Analysis of Other Agents’ Reasoning: - Agent 1 correctly applies the formula for finding the number of divisors based on prime factorization, but they count 196 twice (as 2 and 49), resulting in a total of 9 instead of 8 divisors (excluding 1 and 196). - Agent 2 makes a mistake by counting 196 twice but stops after 6 divisors, not realizing that 196 is a ...
-
[78]
I did not repeat any divisor
Comparative Analysis with My Own Reasoning: My reasoning matches Agent 3’s, as I also listed the divisors and counted them. I did not repeat any divisor
-
[79]
HQFUBSWHG ZRUG
Final Decision: I will revise my conclusion based on the error analysis. There are 9 divisors, not 8, because 196 is a double-counted divisor. Therefore, the correct answer is9 . 21 AICrypto Question: The following ciphertext was encoded via Caesar cipher with a fixed shift of three letters. Determine the original plaintext: HQFUBSWHG ZRUG. Options: A. AB...
-
[80]
HQFUBSWHG ZRUG
Initial Reasoning: - The ciphertext "HQFUBSWHG ZRUG" was encrypted using a Caesar cipher with a fixed shift of three letters. - To find the original plaintext, we need to reverse the encryption by shifting each letter in the ciphertext back by three places
-
[81]
ENCRYPTED
Analysis of Other Agents’ Reasoning: - Agent 1 correctly deciphers the first part as "ENCRYPTED" and the second part as "WORD". However, they claim the original plaintext is "ENCRYPTED WORD" when the correct answer is "ENCRYPTED". - Agent 2 makes an error in decoding "ZRUG" as "WORD" instead of "ENCRYPTED", and then claims the original is "ABANDONED TEXT"...
-
[82]
HQFUBSWHG
Comparative Analysis with My Own Reasoning: - I agree with Agent 1 that "HQFUBSWHG" decodes to "ENCRYPTED". - However, "ZRUG" should also be decrypted to "ENCRYPTED", not "WORD" as all other letters suggest a shift by three places
-
[83]
HQFUBSWHG
Final Decision: - I believe Agent 1’s decryption of "HQFUBSWHG" is correct, but their final answer is incorrect due to not considering "ZRUG". - Since "ZRUG" should also be "ENCRYPTED" after a shift of three, the original plaintext is a combination of "ENCRYPTED" and "ENCRYPTED", which would be "ENCRYPTED ENCRYPTED"
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.