From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large Language Model-based Multi-Agent Systems (LLM-MAS) are increasingly applied to complex collaborative scenarios. However, their collaborative mechanisms may cause minor inaccuracies to gradually solidify into system-level false consensus through iteration. Such risks are difficult to trace since errors can propagate and amplify through message dependencies. Existing protections often rely on single-agent validation or require modifications to the collaboration architecture, which can weaken effective information flow and may not align with natural collaboration processes in real tasks. To address this, we propose a propagation dynamics model tailored for LLM-MAS that abstracts collaboration as a directed dependency graph and provides an early-stage risk criterion to characterize amplification risk. Through experiments on six mainstream frameworks, we identify three vulnerability classes: cascade amplification, topological sensitivity, and consensus inertia. We further instantiate an attack where injecting just a single atomic error seed leads to widespread failure. In response, we introduce a genealogy-graph-based governance layer, implemented as a message-layer plugin, that suppresses both endogenous and exogenous error amplification without altering the collaboration architecture. Experiments show that this approach prevents final infection in at least 89% of runs across operating modes and significantly mitigates the cascading spread of minor errors.
Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 41 of its 61 references that are in the map. First posted on arXiv 4 Mar 2026.
Builds on
41 of 61 references.
Closest ancestors · 11
Same direction, newest first
- 2025Multi-Agent Framework for Threat Mitigation and Resilience in AI-Based Systems29 Dec
- 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems20 Oct
- 2025Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systems7 Jul
- 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows29 Jun
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun
- 2025SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems30 May
- 2025Security of Internet of Agents: Attacks and Countermeasures12 May
- 2025Multi-Agent Systems Execute Arbitrary Malicious Code15 Mar
- 2025Red-Teaming LLM Multi-Agent Systems via Communication Attacks20 Feb
- 2025AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection17 Feb
- 2024Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection12 Aug
Other references · 30
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,203
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
- 2020DeBERTa: Decoding-enhanced BERT with Disentangled Attentioncited by 2,157
- 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,761
- 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,739
- 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
- 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,348
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,259
18 more
- 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 752
- 2024A Survey on Large Language Models for Code Generationcited by 646
- 2024Understanding the planning of LLM agents: A surveycited by 414
- 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 408
- 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscationcited by 338
- 2023Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agentscited by 329
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 215
- 2025Which Agent Causes Task Failures and When? On Automated Failure Attribution of LLM Multi-Agent Systemscited by 170
- 2025AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challengescited by 167
- 2025SagaLLM: Context Management, Validation, and Transaction Guarantees for Multi-Agent LLM Planningcited by 58
- 2014Epidemic processes in complex networkscited by 57
- 2024Exploration of LLM Multi-Agent Application Implementation Based on LangGraph+CrewAIcited by 35
- 2024Agent AI with LangGraph: A Modular Framework for Enhancing Machine Translation Using Large Language Modelscited by 27
- 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
- 2024Towards Detecting LLMs Hallucination via Markov Chain-based Multi-agent Debate Frameworkcited by 19
- 2025Attack and defense techniques in large language models: A survey and new perspectivescited by 13
- 2026The Orchestration of Multi-Agent Systems: Architectures, Protocols, and Enterprise Adoptioncited by 13
- 2020A Multi-Vocal Review of Security Orchestrationcited by 8
Built on by
Citing papers per year: 2026: 13.
13 papers.
Sort:
By area:
- 2026Delayed Verification Destabilizes Multi-Agent LLM Belief: Instability Thresholds and Optimal Corrector Placementcited by 4
- 2026CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoringcited by 3
- 2026MechMath Agent Team: LLM Driven Agents for Mathematical Researchcited by 3
- 2026Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancycited by 2
- 2026QUIVER: A Formal Framework for Quantifying Perturbation Propagation and Bifurcation in Compound AI Systemscited by 2
- 2026Mitigating Fabrication in Multi-Stage LLM Pipelines for Hiring: An Empirical Evaluation of Prompt Guardrails and Human-in-the-Loop Checkpointscited by 1
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
- 2026Diagnosis-Driven Automatic Repair for Agentic Workflow via Symbolic Inferencecited by 0
- 2026Semantic Register Compression in Multi-Agent LLM Cascadescited by 0
- 2026How Affect Propagates among LLM Agents: Emergent Emotional Contagion in Crowd Simulationcited by 0
- 2026Evidence-State Reliability Under Controlled Degradation: Parser-Validity Divergence in a Multi-Stage LLM Pipelinecited by 0
- 2026Epi-Logic: A Conceptual Framework for Epistemic Runtime Control, Schema Validity Checking, and Controlled Accommodation in Autonomous AI Agentscited by 0
- 2026Maat: Independent Deterministic Contract-Based Governance for Multi-Agent LLM Workflows27 Sep 2026
- 2026Epi-Logic: A Conceptual Framework for Epistemic Runtime Control, Schema Validity Checking, and Controlled Accommodation in Autonomous AI Agents21 Sep 2026
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026Evidence-State Reliability Under Controlled Degradation: Parser-Validity Divergence in a Multi-Stage LLM Pipeline21 Aug 2026
- 2026How Affect Propagates among LLM Agents: Emergent Emotional Contagion in Crowd Simulation27 Jul 2026
- 2026Mitigating Fabrication in Multi-Stage LLM Pipelines for Hiring: An Empirical Evaluation of Prompt Guardrails and Human-in-the-Loop Checkpoints22 Jul 2026
- 2026MechMath Agent Team: LLM Driven Agents for Mathematical Research5 Jul 2026
- 2026Diagnosis-Driven Automatic Repair for Agentic Workflow via Symbolic Inference3 Jul 2026
- 2026Delayed Verification Destabilizes Multi-Agent LLM Belief: Instability Thresholds and Optimal Corrector Placement25 Jun 2026
- 2026CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring19 May 2026
- 2026Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancy13 May 2026
- 2026Semantic Register Compression in Multi-Agent LLM Cascades12 May 2026
- 2026Delayed Verification Destabilizes Multi-Agent LLM Belief: Instability Thresholds and Optimal Corrector Placementcited by 4
- 2026CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoringcited by 3
- 2026MechMath Agent Team: LLM Driven Agents for Mathematical Researchcited by 3
- 2026Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancycited by 2
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
- 2026Diagnosis-Driven Automatic Repair for Agentic Workflow via Symbolic Inferencecited by 0
- 2026Semantic Register Compression in Multi-Agent LLM Cascadescited by 0
- 2026How Affect Propagates among LLM Agents: Emergent Emotional Contagion in Crowd Simulationcited by 0
- 2026Maat: Independent Deterministic Contract-Based Governance for Multi-Agent LLM Workflowscited by 0
- 2026Maat: Independent Deterministic Contract-Based Governance for Multi-Agent LLM Workflows27 Sep 2026
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026How Affect Propagates among LLM Agents: Emergent Emotional Contagion in Crowd Simulation27 Jul 2026
- 2026MechMath Agent Team: LLM Driven Agents for Mathematical Research5 Jul 2026
- 2026Diagnosis-Driven Automatic Repair for Agentic Workflow via Symbolic Inference3 Jul 2026
- 2026Delayed Verification Destabilizes Multi-Agent LLM Belief: Instability Thresholds and Optimal Corrector Placement25 Jun 2026
- 2026CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring19 May 2026
- 2026Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancy13 May 2026
- 2026Semantic Register Compression in Multi-Agent LLM Cascades12 May 2026
- 2026QUIVER: A Formal Framework for Quantifying Perturbation Propagation and Bifurcation in Compound AI Systemscited by 2
- 2026Mitigating Fabrication in Multi-Stage LLM Pipelines for Hiring: An Empirical Evaluation of Prompt Guardrails and Human-in-the-Loop Checkpointscited by 1
- 2026Evidence-State Reliability Under Controlled Degradation: Parser-Validity Divergence in a Multi-Stage LLM Pipelinecited by 0
- 2026Epi-Logic: A Conceptual Framework for Epistemic Runtime Control, Schema Validity Checking, and Controlled Accommodation in Autonomous AI Agentscited by 0
- 2026Epi-Logic: A Conceptual Framework for Epistemic Runtime Control, Schema Validity Checking, and Controlled Accommodation in Autonomous AI Agents21 Sep 2026
- 2026Evidence-State Reliability Under Controlled Degradation: Parser-Validity Divergence in a Multi-Stage LLM Pipeline21 Aug 2026
- 2026Mitigating Fabrication in Multi-Stage LLM Pipelines for Hiring: An Empirical Evaluation of Prompt Guardrails and Human-in-the-Loop Checkpoints22 Jul 2026
- 2026QUIVER: A Formal Framework for Quantifying Perturbation Propagation and Bifurcation in Compound AI Systems11 May 2026
Similar, not cited
Close in wording, no citation either way
- 2025GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling
- 2026Among Us: Measuring and Mitigating Malicious Contributions in Model Collaboration Systems
- 2026MAS-FIRE: Fault Injection and Reliability Evaluation for LLM-Based Multi-Agent Systems
- 2025Beyond Single-Agent Safety: A Taxonomy of Risks in LLM-to-LLM Interactions
- 2026GoAgent: Group-of-Agents Communication Topology Generation for LLM-based Multi-Agent Systems
- 2025Comprehensive Vulnerability Analysis is Necessary for Trustworthy LLM-MAS
- 2024On the Resilience of LLM-Based Multi-Agent Collaboration with Faulty Agents
- 2026More Capable, Less Cooperative? When LLMs Fail At Zero-Cost Collaboration