# Upstream Influence, Downstream Re-Anchoring in LLM Agent Chains

arXiv: https://arxiv.org/abs/2610.17723 · HTML: https://mlsanity.com/paper/2610.17723/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Social simulation and multi-agent debate, one of 16 directions in LLM agents and tool use.
- Builds on 5 of its 18 references that are in the map.
- First posted on arXiv 13 Oct 2026.

## Placed in

- LLM agents and tool use / [Social simulation and multi-agent debate](https://mlsanity.com/agents/social-simulation-and-multi-agent-debate/)

## Builds on (most cited first, 5 of 5)

- [Improving Factuality and Reasoning in Language Models through Multiagent Debate](https://mlsanity.com/paper/2305.14325/) (2023)
- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [Why Do Multi-Agent LLM Systems Fail?](https://mlsanity.com/paper/2503.13657/) (2025)
- [Conformity in Large Language Models](https://mlsanity.com/paper/2410.12428/) (2024)

## Abstract (arXiv)

People act on evaluative judgments produced by LLM agents, and in multi-agent systems those judgments pass through several agents before reaching a person. We show that a workflow's information architecture---source access, handoff format, and which model reads the untrusted content---governs how much of a coordinated manipulation reaches the end. On 32 Taiwan~2025 recall cases, ten authentic Threads comments shown to one agent move its stance by +0.171 toward the injected position, and a mirrored set moves it the other way. Passing that judgment down a chain removes more than half of the shift by the third agent; keeping the comments in front of every agent sustains more of it. The reduction is not attrition in transit: each receiver discounts the inherited stance in proportion to how far it sits from its own reading of the evidence, returning to what that evidence implies for the case rather than to neutrality---consistent with partial re-anchoring. Handoff format is a second lever: a stance relayed without its reasoning is largely discounted. Susceptibility at the exposed seat varies fourfold across models, while the chain's arrangement does not matter at all. None of this is visible in the transcripts---the injected claims are almost never restated, so reasoning-trace audits miss the attack.