Large language models are increasingly deployed as cooperating agents, yet their behavior in adversarial consensus settings has not been systematically studied. We evaluate LLM-based agents on a Byzantine consensus game over scalar values using a synchronous all-to-all simulation. We test consensus in a no-stake setting where agents have no preferences over the final value, so evaluation focuses on agreement rather than value optimality. Across hundreds of simulations spanning model sizes, group sizes, and Byzantine fractions, we find that valid agreement is not reliable even in benign settings and degrades as group size grows. Introducing a small number of Byzantine agents further reduces success. Failures are dominated by loss of liveness, such as timeouts and stalled convergence, rather than subtle value corruption. Overall, the results suggest that reliable agreement is not yet a dependable emergent capability of current LLM-agent groups even in no-stake settings, raising caution for deployments that rely on robust coordination.
Figures & tables
Figure 1: Byzantine consensus game with honest and byzantine LLM agents on a synchronous all-to-all network in one round of interaction. The highlighted agent i broadcasts a scalar proposal and justification, receives messages from peers, and emits a termination decision {vote,continue} . For clarity, only a subset of message arrows is shown.
Figure 2: Consensus performance without Byzantine agents B=0 for Qwen3-8B and Qwen3-14B across N∈{4,8,16} and two prompt variants (with vs. without mentioning possible Byzantine agents). Error bars show 95% Wilson confidence intervals. Qwen3-14B reaches valid consensus more often, adversary-free prompts improve liveness, and larger groups slow and weaken consensus.
Figure 3: Effect of Byzantine agents on Qwen3-14B consensus with eight honest agents. Bars show the distribution of valid vs. invalid consensus outcomes over 25 runs per configuration; missing bars correspond to 0% consensus (all timeouts).
Figure 4: Representative proposal trajectories for Qwen3-14B with eight honest agents. Top row: prompts explicitly state that no Byzantine agents exist. Bottom row: prompts include Byzantine agents and warn that Byzantine peers may exist. Each panel shows honest agents’ scalar proposals over rounds, with horizontal lines marking the initial honest range and a vertical line marking termination.
Large language model (LLM) agents are increasingly deployed in multi-agent systems where they must coordinate and agree on shared decisions. We ask whether classical resilient consensus theory, developed for deterministic agents, transfers to LLM agents that may behave adversarially. Framing LLM agreement as a Byzantine consensus game, we run controlled experiments on complete and general communication graphs. We find that prompted LLM agents fail to reach agreement that is achievable in principle: consensus can fail even in settings where classical theory guarantees that a convergent algorithm exists, and this failure persists across temperatures and horizons. At the same time, wrapping the agents with classical resilient consensus filters improves agreement. The benefit of filtering depends on how much robustness the underlying topology already provides. Our results suggest that classical resilient consensus theory is a useful lens for the safety of agentic AI.
Sribalaji C. Anand, George J. Pappas
1KTH, Sweden. · University of Pennsylvania, United States.
Large Language Models (LLMs) are increasingly deployed in multi-agent environments that produce unanimous agreement, both in intended interactions that need coordination and in unintended emergent interactions. Consequently, understanding how LLMs with competing incentives reach consensus is crucial to better interpret and design LLM collectives. We introduce an evaluation, based on the Network Consensus game, to assess the mechanisms driving this process. Here, a network of agents must agree on one of two colours to receive a payoff, but agents are offered different payoffs for the agreed colour. We vary components such as communication access and network structure and assess six open-source models and one closed model (ChatGPT 5.6-sol). We find that open-source LLMs reach consensus less often than humans in comparable experiments and only if messages are communicated across the global network. ChatGPT 5.6-sol, however, is able to reach consensus with communication limited to its neighbours and with no communication ability. This is achieved through lower stubbornness and higher majority-following tendencies, and by providing more information about its neighbours' states in messages. However, situating agents in a highly clustered graph reduces consensus, regardless of these traits, demonstrating that both system design and individual model traits drive collective outcomes.
Isabel Jones, Matthew Edwards, Janina A. Hoffmann
University of Bristol Bristol, United Kingdom · University of Bath Bath, United Kingdom
Large language model (LLM) agents increasingly collaborate over peer-to-peer networks to improve their reliability. However, these same interactions can also become a source of vulnerability, as unreliable or Byzantine agents may sway neighboring agents toward incorrect conclusions and degrade overall system performance. Existing methods rely on leader-based coordination or self-reported confidence, both of which are susceptible to adversarial manipulation. We study decentralized LLM multi-agent systems (LLM-MAS) and propose Self-Anchored Consensus (SAC), a fully decentralized iterative filter-and-refine protocol in which agents iteratively exchange responses, locally evaluate and filter unreliable messages, and refine their own outputs. We present (F+1)-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence. Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions.