Large language models (LLMs) have recently demonstrated impressive capabilities in reasoning tasks. Currently, mainstream LLM reasoning frameworks predominantly focus on scaling up inference-time sampling to enhance performance. In particular, among all LLM reasoning frameworks, multi-agent debate (MAD), which employs multiple LLMs as agents to perform reasoning in the way of multi-round debate, has emerged as a powerful reasoning paradigm since it allows agents to access previous memories to alleviate fallacious content and refine their reasoning iteratively in each debate round. However, although MAD significantly improves the reasoning capabilities of LLMs, in this paper, we observe that there remain erroneous memories, and LLM agents are vulnerable to these erroneous memories. To explore this phenomenon, we provide a theoretical insight that the performance of MAD is highly dependent on the quality of memories derived from the previous debate, indicating that the existence of erroneous memories poses a threat to the performance of MAD. To address this problem, we introduce a simple yet effective multi-agent debate framework, multi-agent debate with memory masking (MAD-M2), to improve the robustness of MAD by allowing LLM agents to mask erroneous memories from the previous debate round at the beginning of each debate round. In this way, MAD-M2 can polish the contextual information before each debate round by preserving informative and meaningful memories while discarding the erroneous memories. Extensive experiments and analyses on mainstream mathematical and logical reasoning benchmarks demonstrate that MAD-M2 can identify the erroneous memories and achieve better performance in reasoning than MAD.
Figures & tables
Figure 1: An illustration of the effects of erroneous memories. The example is a real case picked from the MATH dataset. In MAD, all memories in the previous debate round are considered in the next debate round. However, the memories from the previous round may include erroneous reasoning responses (cf. the responses of debate round 1 in the figure). The erroneous memory may misguide the agent, which was correct, and result in the wrong final answer (cf. Agent 1 in the debate round 2).
Figure 2: An illustration of MAD-M 2 framework. In general, MAD-M 2 mainly includes three steps. (i) In the initial debate round, LLM agents independently generate responses based on the given query. (ii) The responses generated in the previous round are treated as memories. All memories will be critically evaluated and the potential erroneous memories will be masked for the reasoning in the next debate round. (iii) With the preserved memories, agents perform reasoning in the next debate.
Methods
AIME24
AIME25
MMLU_Pro
MATH
GSM8K
Acc. (%) ↑
T . ↓
Acc. (%) ↑
T . ↓
Acc. (%) ↑
T . ↓
Acc. (%) ↑
T . ↓
Acc. (%) ↑
T . ↓
Qwen2.5-7B-Instruct
CoT
3.3
× 0.07
3.3
× 0.08
36.0 ± 6.3
× 0.08
49.2 ± 3.8
× 0.07
64.8 ± 5.4
× 0.09
CoT-SC
10.0
× 0.43
10.0
× 0.45
39.2 ± 4.0
× 0.51
58.0 ± 1.0
× 0.45
83.6 ± 3.9
× 0.51
MAD
13.3
× 1.00
6.7
× 1.00
43.0 ± 2.2
× 1.00
55.6 ± 3.7
× 1.00
91.8 ± 2.4
× 1.00
MAD-M 2 (S)
13.3
× 1.13
3.3
× 1.21
43.6 ± 2.3
× 1.17
56.8 ± 2.1
× 1.20
89.0 ± 4.0
× 1.25
Table 1: Empirical results of accuracy (with standard deviation) and token consumption ( T. ). We evaluate four mainstream open-source LLMs on both mathematical reasoning and language understanding benchmarks. We highlight the best performance in bold , and the second-best performance in underline . For fairness, all results are the average of five trials on different seeds (i.e., 41-45).
Figure 3: Visualization of erroneous memory identification of different LLMs. We here examine the erroneous memory identification capability of different LLMs. “S” denotes the strict rule, and “L” denotes the loose rule. According to the results, the objective masking strategy generally works better on the powerful LLMs, while the subjective masking works better on relatively weak LLMs.
Figure 4: Effect of scaling the number of agents in the case of Qwen2.5-7B-Instruct. The number of agents is increased from 3 to 10. According to the figures, both frameworks benefit from the increase of the number of agents and MAD-M 2 (S) tends to achieve better performance in most cases.
Figure 5: Effect of scaling the number of agents in the case of DeepSeek-Math-7B-Instruct. The number of agents is increased from 3 to 10. According to the figures, both frameworks act differently when the number of agents increases and MAD-M 2 (O) achieves better performance in most cases.
Figure 6: Effect of scaling the number of debate rounds in the case of Qwen2.5-7B-Instruct. The number of debate rounds increases from 2 to 10. According to the figures, both frameworks basically benefit from the increase in debate rounds. In most cases, MAD-M 2 (S) outperforms MAD-M 2 (O).
Figure 7: Effect of scaling the number of debate rounds w.r.t. DeepSeek-Math-7B-Instruct. The number of debate rounds increases from 2 to 10. According to the figures, the performance of different cases varies. In most cases, MAD-M 2 (O) achieves better performance than MAD-M 2 (S).
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Effect of scaling the number of agents in the case of Qwen2.5-Math-7B-Instruct. The number of agents is increased from 3 to 10. According to the figures, both frameworks act differently when the number of agents increases and MAD-M 2 (O) achieves better performance in most cases.
Figure 9: Effect of scaling the number of debate rounds w.r.t. Qwen2.5-Math-7B-Instruct. The number of debate rounds increases from 2 to 10. According to the figures, the performance of different cases varies. In most cases, MAD-M 2 (O) achieves better performance than MAD-M 2 (S).
Figure 10: Analyses on time consumption of MAD and MAD-M 2 with different LLMs. Each figure compares the time consumption of MAD, MAD-M 2 (S), and MAD-M 2 (O). Generally, MAD-M 2 (O) consumes less time than MAD-M 2 (S) since it is free of an additional self-evaluation step.
Method
AIME24
AIME25
MMLU_Pro
MATH
GSM8K
Qwen2.5-7B-Instruct
MAD-M 2 (S)
13.3
3.3
43.6 ± 2.3
56.8 ± 2.1
89.0 ± 4.0
MAD-M 2 (S)-Strict
10.0 ( -3.3 )
10.0 ( +6.7 )
43.4 ± 5.3 ( -0.2 )
54.8 ± 2.8 ( -2.0 )
87.6 ± 3.4 ( -1.4 )
Qwen2.5-Math-7B-Instruct
MAD-M 2 (S)
6.7
6.7
35.0 ± 2.2
71.2 ± 3.3
95.2 ± 1.8
MAD-M 2 (S)-Strict
13.3 ( +6.6 )
6.7 ( +0.0 )
40.8 ± 4.4 ( +5.8 )
81.4 ± 4.4 ( +10.2 )
95.4 ± 1.5 ( +0.2 )
Appendix
Table 2: Analysis on strictness of MAD-M 2 (S). Average accuracy with standard deviation is reported. We evaluate three small LLMs with both mathematical reasoning and language understanding benchmarks. For fairness, all results are the average of five trials on different seeds (i.e., 41-45).
Method
AIME24
AIME25
MMLU_Pro
MATH
GSM8K
Qwen2.5-7B-Instruct
MAD-M 2 (S)
16.7
13.3
44.6 ± 5.7
60.8 ± 1.9
93.6 ± 1.1
MAD-M 2 (O)
20.0
0.0
42.2 ± 4.2
58.8 ± 5.6
92.8 ± 1.3
Sparse MAD
13.3
6.7
44.2 ± 3.4
59.2 ± 2.7
94.2 ± 1.9
Qwen2.5-Math-7B-Instruct
MAD-M 2 (S)
16.7
13.3
66.2 ± 4.6
62.8 ± 4.3
96.4 ± 1.8
Appendix
Table 3: Comparison between MAD-M 2 and Sparse MAD. Average accuracy with standard deviation is reported. We compare MAD-M 2 (S), MAD-M 2 (O), and Sparse MAD on Qwen2.5-7B-Instruct and Qwen2.5-Math-7B-Instruct with both mathematical reasoning and language understanding benchmarks. For fairness, all results are the average of five trials on different seeds (i.e., 41-45).
Multi-agent debate (MAD) improves the reasoning capabilities of large language models by having multiple agents iteratively refine their responses through discussion. However, MAD suffers from a critical vulnerability known as shared misconception: when a majority of agents initially converge on an incorrect answer, the debate process tends to amplify rather than correct the error. Existing methods primarily address peer skew but leave the agents' inherently biased concept priors unaddressed. To mitigate this systematic weakness, we propose R2-MAD (Remember and Reweight for Multi-Agent Debate), a framework that equips agents with an experience memory accumulated from past debates. R2-MAD intervenes on both failure modes through two complementary mechanisms: A debate-state-aware retrieval policy dynamically calibrates the concept prior by retrieving relevant historical evidence based on the current consensus level. Then these retrieved experiences provide a basis for estimating per-agent reliability, yielding confidence weights to modulate peer influence. Experiments on various benchmarks show that R2-MAD achieves consistent improvements over existing single-agent and MAD baselines.
Xuanfa Jin, Zhijian Ma, Yongcheng Zeng +3
Institute of Automation, Chinese Academy of Sciences · University of Chinese Academy of Sciences · University College London
Multi-agent debate (MAD) can improve large language model reasoning, but fixed debate pipelines often waste computation and can amplify correlated errors among similar agents. We propose ARMOR-MAD, a training-free heterogeneous MAD framework that treats debate as conditional computation. ARMOR-MAD combines three components: Pre-debate Agreement Routing (PAR) decides whether independently generated Round-0 answers require debate; Early Agreement Stopping Evaluator (EASE) stops debate after convergence; and Semantic Outlier Detection (SOD) down-weights abnormal final answers during aggregation. Across MATH Level 5, GSM8K, MMLU, and MMLU-Pro, ARMOR-MAD consistently improves over fixed-round heterogeneous debate with the same model pool, reaching 65.5%, 96.5%, 90.0%, and 81.5% accuracy, respectively. The results suggest that genuine model heterogeneity and agreement-based control are both important for making MAD more accurate and efficient.
Fuqiang Niu, Bowen Zhang
School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China · School of Artificial Intelligence, Shenzhen Technology University, Shenzhen, China
Multi-agent debate (MAD) can improve large language model (LLM) reasoning by allowing multiple agents to exchange and critique their answers to the same task. However, the interactions that enable agents to correct mistakes can also spread adversarial errors and steer the agents toward an incorrect answer. Although some efforts have been made to examine particular attack types on MAD, systematic evaluation of MAD under diverse attacks remains limited. A central question is whether debate mitigates adversarial influence or amplifies it. In this paper, we present MADBench, a benchmark for evaluating the security of MAD. We organize attacks into a layered taxonomy following the MAD workflow, incorporating both established attacks and new strategies tailored to debate. We evaluate six attack families over 356 source tasks and 3,958 test cases, examining their effects on the final answer and the propagation of adversarial influence. Our results show that, under attacks, MAD does not necessarily improve LLM reasoning. Compared with a single-agent baseline, MAD can mitigate attacks on answer accuracy in question-answering tasks while amplifying unauthorized reads or writes in both question-answering and workspace tasks. Moreover, even when three out of five agents collude, the attack changes the final answer from correct to wrong on only 28.30% of tasks answered correctly without attack, while only 3.26% of initially correct honest agents switch to wrong answers during debate.