From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

Yizhe Xie; Congcong Zhu; Xinyue Zhang; Tianqing Zhu; Dayong Ye; Minfeng Qi; Huajie Chen; Wanlei Zhou

cs.MAMar 4, 2026

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

Authors: Yizhe Xie, Congcong Zhu, Xinyue Zhang, Tianqing Zhu, Dayong Ye, Minfeng Qi, Huajie Chen, Wanlei Zhou

Organizations: Faculty of Data Science, City University of Macau · Minzu University of China

Abstract

Large Language Model-based Multi-Agent Systems (LLM-MAS) are increasingly applied to complex collaborative scenarios. However, their collaborative mechanisms may cause minor inaccuracies to gradually solidify into system-level false consensus through iteration. Such risks are difficult to trace since errors can propagate and amplify through message dependencies. Existing protections often rely on single-agent validation or require modifications to the collaboration architecture, which can weaken effective information flow and may not align with natural collaboration processes in real tasks. To address this, we propose a propagation dynamics model tailored for LLM-MAS that abstracts collaboration as a directed dependency graph and provides an early-stage risk criterion to characterize amplification risk. Through experiments on six mainstream frameworks, we identify three vulnerability classes: cascade amplification, topological sensitivity, and consensus inertia. We further instantiate an attack where injecting just a single atomic error seed leads to widespread failure. In response, we introduce a genealogy-graph-based governance layer, implemented as a message-layer plugin, that suppresses both endogenous and exogenous error amplification without altering the collaboration architecture. Experiments show that this approach prevents final infection in at least 89% of runs across operating modes and significantly mitigates the cascading spread of minor errors.

Figures & tables

Fig. 1: The amplification of errors in LLM-MAS. Whether the input is a factuality error or a faithfulness error, the agents reach a false consensus. This results in failures ranging from security breaches to operational outages.

Fig. 2: Overview of our work. We categorize false consensus arising from internal vulnerabilities versus external induction. We model propagation dynamics to characterize consensus collapse mechanisms. Correspondingly, a genealogy-based governance layer implements atomic propagation control to mitigate faithfulness and factuality errors.

Fig. 3: Model validation across different topologies. The black lines represent the observed mean infection rates with $\pm 1$ standard error. The dashed lines show the fitted curves using product-based and Poisson-based infection functions.

Topology	Function	$\beta$	$\delta$	MSE	$S(T)$
Centralized	Product	0.670	0.000	$8.0\times 10^{-4}$	1.000
Centralized	Poisson	1.000	0.000	$1.0\times 10^{-3}$	1.000
Layered	Product	0.920	0.005	$8.0\times 10^{-4}$	0.920
Layered	Poisson	1.000	0.000	$1.74\times 10^{-2}$	0.920
Layered (Horizontal)	Product	0.850	0.020	$4.5\times 10^{-3}$	0.823
Layered (Horizontal)	Poisson	1.000	0.000	$1.04\times 10^{-2}$	0.823

TABLE I: Fitted parameters for topology-level error propagation.

Fig. 4: The evolution of error coverage $S(t)$ .

Framework	Hub Inf.	Leaf Inf.	Impact Factor
CrewAI	100.0%	15.9%	6.29
LangGraph	100.0%	9.7%	10.31

TABLE II: Analysis of Topological Fragility

Timing ( $t$ )	Target Role	Polluted Rounds
$t=2$	Architect	1.0
$t=4$	QA Engineer	2.9
$t=6$	Architect	3.9

TABLE III: Impact of Intervention Timing.

Fig. 5: Overview of the Genealogy-Based Governance Layer.

Fig. 6: Infection rate $S(t)$ across communication turns under three topologies.

Topology	Framework	Baseline			Compliance			Security FUD
Topology	Framework	M	Q	R	M	Q	R	M	Q	R
Chain	LangChain	3.3	0.0	0.0	95.0	96.7	85.0	100.0	100.0	100.0
Chain	MetaGPT	5.0	11.7	46.7	100.0	98.3	100.0	96.7	76.7	95.0
Mesh	AutoGen	0.0	5.0	0.0	100.0	100.0	95.0	98.3	100.0	98.3
Mesh	CAMEL	0.0	0.0	0.0	100.0	100.0	100.0	100.0	98.3	100.0
Star	CrewAI	0.0	0.0	3.3	46.7	51.7	31.7	46.7	43.3	33.3

TABLE IV: Attack Success Rate (ASR, %) Comparison (Real Data).

Framework	Defense	BICR (%) $\uparrow$			Safe Completion (%) $\uparrow$			Token / Safe ( $10^{3}$ ) $\downarrow$
Framework	Defense	Base.	Comp.	Sec.	Base.	Comp.	Sec.	Base.	Comp.	Sec.
MetaGPT	Strict	100.0	95.0	100.0	95.0	89.2	97.5	52.9	49.6	52.0
	Balanced	97.5	88.3	100.0	93.3	88.3	92.5	24.3	23.2	24.0
	Speed	95.8	85.0	100.0	91.7	79.2	97.5	17.1	16.0	16.5
	Reflection	82.5	5.0	19.2	80.0	5.0	19.2	9.7	9.3	8.7
	AGrail	96.7	36.7	42.5	40.8	0.8	2.5	14.2	14.3	15.2

TABLE V: BICR, safe completion, and token cost across frameworks and defenses.

Variant	BICR (%)	Tokens	Time (s)
w/o Atomization	$40.0\pm 49.0$	11,663	$77.9\pm 24.7$
w/o Detection	$14.4\pm 35.2$	14,708	$51.7\pm 13.0$
w/o Blocking	$3.1\pm 10.1$	34,991	$85.7\pm 21.0$
None	$2.2\pm 14.7$	7,365	$41.2\pm 11.9$

TABLE VI: Ablation study results.

Mode	BICR	Safe Comp.	Tok./Safe	Lat./Safe (s)
Reflection	0.32	0.32	12,749	$91.8\pm 24.0$
Speed	0.89	0.88	21,227	$149.7\pm 39.5$
Balanced	0.93	0.91	30,844	$179.6\pm 44.3$
Strict	0.94	0.93	57,610	$217.9\pm 53.7$
AGrail	0.79	0.11	19,902	$98.8\pm 20.5$
CFG	0.76	0.16	13,323	$65.3\pm 25.2$

TABLE VII: Safety-cost summary.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 7: Real attack trace fitting under asynchronous message steps. The observed curve gives the mean infection rate

S(t)

over real attack traces grouped by topology. The shaded band is the central

50\%

run-level interval of the observed trajectories, computed from the 25th and 75th percentiles.

Framework	Topology	$\boldsymbol{\beta}$	$\boldsymbol{\delta}$	MSE	Final ASR
AutoGen	Mesh	0.363	0.002	0.0274	0.986
CAMEL	Mesh	0.270	0.010	0.0216	0.997
CrewAI	Star	0.220	0.020	0.0471	0.422
LangChain	Chain	0.985	0.002	0.0001	0.961
LangGraph	Star	0.470	0.000	0.0310	0.997
MetaGPT	Chain	0.593	0.000	0.0468	0.944

Appendix

TABLE VIII: Fit on real attack traces.

Setting	Defense	$\beta$	$\delta$	Margin	Obs. $S(T)$
LangGraph-Star	None	0.42	0.08	0.65	0.80
LangGraph-Star	Speed	0.07	0.00	0.12	0.18
LangGraph-Star	Strict	0.04	0.00	0.07	0.04
AutoGen-Mesh	None	0.26	0.10	0.68	0.76
AutoGen-Mesh	Speed	0.05	0.00	0.15	0.17
AutoGen-Mesh	Strict	0.05	0.00	0.15	0.08

Appendix

TABLE IX: Compact propagation-threshold diagnostics.

Framework	Topology	Agents	Final Rate	Std
MetaGPT	Chain	4	100.0%	0.0%
LangChain	Chain	4	89.2%	22.1%
LangGraph	Star	4	100.0%	0.0%
CrewAI	Star	4	100.0%	0.0%
AutoGen	Mesh	3	100.0%	0.0%
CAMEL	Mesh	3	100.0%	0.0%

Appendix

TABLE X: Cascade severity by topology.

Framework	Topology	Agents
LangChain	chain	4
MetaGPT	chain	4
AutoGen	mesh	4
CAMEL	mesh	4
CrewAI	star	4
LangGraph	star	4

Appendix

TABLE XI: Framework instantiations used in Section VII-A .

Method	Acc.	FGR	G-Prec.	Time	Tok.
gpt-4o-mini	78.8%	20.5%	43.8%	684.4ms	3993
deberta-v3-small	71.2%	2.3%	80.0%	148.2ms	0
deberta-v3-large	82.7%	0.0%	100.0%	91.1ms	0
similarity (Jaccard)	11.5%	0.0%	N/A	0.0ms	0

Appendix

TABLE XII: NLI comparison results on the REAL evaluation set.

Defense	BICR (%) $\uparrow$			Safe Completion (%) $\uparrow$			Tok./Safe ( $10^{3}$ ) $\downarrow$
Defense	M	Q	R	M	Q	R	M	Q	R
Strict	89.4	98.9	94.4	88.3	98.9	90.6	54.9	63.2	50.9
Balanced	87.2	97.5	93.9	84.2	97.2	92.2	29.2	36.1	27.0
Speed	92.8	83.1	92.5	91.1	83.1	89.7	20.1	23.4	18.7
Reflection	35.3	29.7	31.9	35.0	29.7	30.3	12.8	12.9	12.4
AGrail	82.5	75.3	78.6	20.8	7.2	5.3	23.5	21.8	21.2

Appendix

TABLE XIII: Per-dataset aggregate results across defense methods.

Multi-Agent LLM Systems

Multi-agent large language model systems coordinate multiple AI agents to solve tasks through communication, specialization, shared tools, and memory.

See all 1,001 papers

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation
May 8, 2026Bingyu Yan, Xiaoming Zhang, Jinyu Hou +4LLM Agent Security Prompt Injection Attacks on AI Agents
Beihang University · Beijing University of Posts and Telecommunications · City University of Hong Kong
Error-Propagation Modeling for Failure Attribution in LLM-Based Multi-Agent Systems
Oct 8, 2026Jiaqi Liao, Yuanzhao Zhai, Huanxi Liu +5Failure Attribution for LLM Agents Agent Failure Analysis
College of Computer Science and Technology, National University of Defense Technology; State Key Laboratory of Complex & Critical Software Environment, Changsha, Hunan, China · School of Mechanical Engineering, Tianjin University, Tianjin, China · College of Computer Science and Technology, National University of Defense Technology; National Key Laboratory of Parallel and Distributed Computing, Changsha, Hunan, China
Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks
Mar 16, 2026Samira Abedini, Sina Mavali, Lea Schönherr +2Multi-Agent LLM Systems LLM Agent Security
CISPA Helmholtz Center for Information Security · University of Vienna, Faculty of Computer Science

May 8, 2026J/K move · Enter open · S save

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

Bingyu Yan, Xiaoming Zhang, Jinyu Hou, Chaozhuo Li+3

Beihang University · Beijing University of Posts and Telecommunications · City University of Hong Kong

LLM Agent Security Prompt Injection Attacks on AI Agents Multi-Agent System Security

Open paper AskPDF arXiv

LLM-based multi-agent systems (LLM-MAS) have become a promising paradigm for solving complex tasks through role specialization, tool use, memory, and collaborative reasoning. However, these interactions create new security risks that malicious instructions injected through messages, tools, or memories can propagate across agents and rounds, causing system-level compromise. Existing defenses largely rely on local filtering or graph-based anomaly detection, but they often fail to trace fine-grained propagation paths or remediate contaminated states without disrupting benign collaboration. We propose PropGuard, a propagation-aware framework for safeguarding LLM-MAS. PropGuard constructs a dual-view spatio-temporal graph that combines response-centric risk estimation with full-state evidence preservation. Guided by these risk priors, a GE-GRPO trained inspector sequentially explores the full-state graph to recover compact suspicious propagation subgraphs. PropGuard then verifies harmful propagation through subgraph-aware diagnosis and applies source-guided remediation to correct upstream contamination and replay affected downstream interactions. Experiments across four communication architectures and five attack settings demonstrate that PropGuard consistently lowers attack success while maintaining high task-level defense success, achieving a favorable effectiveness--efficiency trade-off.

Abstract

Multi-Agent LLM Systems

Explore similar work

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

Error-Propagation Modeling for Failure Attribution in LLM-Based Multi-Agent Systems

Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks