Large language models (LLMs) are increasingly deployed as optimization modules in agentic systems, yet the fundamental limits of such LLM-mediated improvement remain poorly understood. Here we propose a theory of LLM information susceptibility, centred on the hypothesis that when computational resources are sufficiently large, the intervention of a fixed LLM does not increase the performance susceptibility of a strategy set with respect to budget. We develop a multi-variable utility-function framework that generalizes this hypothesis to architectures with multiple co-varying budget channels, and discuss the conditions under which co-scaling can exceed the susceptibility bound. We validate the theory empirically across structurally diverse domains and model scales spanning an order of magnitude, and show that nested, co-scaling architectures open response channels unavailable to fixed configurations. These results clarify when LLM intervention helps and when it does not, demonstrating that tools from statistical physics can provide predictive constraints for the design of AI systems. If the susceptibility hypothesis holds generally, the theory suggests that nested architectures may be a necessary structural condition for open-ended agentic self-improvement.
Figures & tables
Figure 1: Framework and representative results. Performance J (lines cleared) versus computational budget B (beam width) in the Tetris domain for the base algorithm (DFS, blue circles) and LLM-derived strategies (red markers; five Qwen models: 7B, 14B, 32B, 72B and Qwen3-Max). Dashed lines show linear fits for DFS and the LLM average. Error bars indicate the standard error of the mean across 40 random seeds. The schematic on the right illustrates the two evaluation paths: the base strategy set PB is evaluated directly by the utility function J (base path, blue), or first processed by a fixed LLM to produce a derived set PB′ (derived path, red).
Figure 2: Robustness of the susceptibility bound. a , Four prompt variants compared against the DFS baseline in the Tetris domain (Qwen-32B). The minimal prompt nearly matches DFS at high B , while more elaborative prompts amplify the gap. b , Three reward functions overlaid for both DFS (grey shades) and LLM (red shades, Qwen-32B). The susceptibility bound holds across all prompt and reward configurations.
Figure 3: Transition of the relative sensitivity α . Average α versus the number of samples k . For each k , α is estimated by fitting Jagent=α⋅JMV+β across five generator model sizes, where JMV is the majority-vote accuracy, Jagent is the LLM-selector accuracy and β is the regression intercept (see Methods). As k increases, α decreases and falls below 1 around k∼12 , marking the onset of the large-budget regime where the susceptibility bound takes effect.
Figure 4: Cross-domain validation. Performance J versus computational budget B for the base strategy set (blue circles) and the LLM-derived strategy set (red squares) across four domains: Tetris, Knapsack, Ranking and AIME mathematics. In the AIME domain, the derived strategy set averages over all five selector models and over k∈{15,17,19,21} .
Figure 5: Inter-layer coupling regimes. Each panel shows an architecture diagram (top) and illustration of J versus Bref (bottom). Faded blue lines represent three fixed-selector configurations; solid coloured lines show the nested (co-scaled) configuration. Dots mark intersection points where configurations coincide. a , Decoupled: only the generator scales with Bref ; the selector remains fixed. The nested line coincides with one of the fixed lines. b , Negative coupling: both components scale, but co-scaling reduces marginal return ( αtotal<1 ). The nested line falls below the fixed line. c , Positive coupling: co-scaling amplifies marginal return ( αtotal can exceed 1). The nested line exceeds all fixed lines, opening a response channel unavailable to fixed architectures.
Figure 6: Nested versus fixed architectures in the AIME domain. Accuracy J (averaged over k∈{15,17,19,21} ) versus model size for the nested derived strategy set (generator and selector co-scaled) and fixed derived strategy sets (fixed selector, varying generator). The curves intersect at the model size of the respective fixed selector, showing that co-scaling architectural components can exceed the susceptibility bound.
Extended Data Fig. 1 ∣ Averaged performance gap across domains. The normalized performance gap Δ(B)=(J(PB)−J(PB′))/J(PB) , averaged over all five LLMs, as a function of computational budget B for four domains. Blue shading indicates the regime where the base algorithm outperforms the LLM-derived strategy ( Δ>0 ); red shading indicates the opposite. In Tetris, Δ grows monotonically. In Knapsack, Δ is negligible. In Ranking, Δ transitions from negative (LLM advantage at low SNR) to near zero. In AIME, Δ (averaged over k∈{15,17,19,21} ) remains positive across model sizes.
Extended Data Fig. 2 ∣ Per-model performance gap across domains. The normalized performance gap Δ(B) broken down by individual model size (7B through Qwen3-Max) for each domain. In Tetris, 72B models show largest gaps. In Knapsack, all models produce negligible gaps. In Ranking, all models converge from negative to near-zero Δ as SNR increases. In AIME, the gap varies with both generator model size and number of samples k , with larger k showing an increasing tendency with model size.
Extended Data Fig. 3 ∣ Illustration of the phenomenological theory of self-evolution dynamics. Top row: data quality functions p(b) (pipeline, blue) and l(b) (model output, red) versus model capability b . Bottom row: phase portrait db/dr∝p(b)−l(b) , with arrows indicating the flow direction. Open circle: unstable fixed point; filled circle: stable fixed point. a , p′(b)>l′(b) : the fixed point is a repeller, giving rise to a collapse phase ( b<b∗ ) and a self-evolution phase ( b>b∗ ). b , p′(b)<l′(b) : the fixed point is an attractor; improvement and degradation are both bounded. See Supplementary Note 1 for the full derivation.
Large Language Models (LLMs) are becoming increasingly autonomous assistants, capable of accomplishing series of complex tasks by interacting with open world domains such as software databases and the internet. This presents great opportunity but also great risk: open domains routinely present opportunities for autonomous agents to be influenced by others, e.g. deciding whether to accept pull requests or whether to use advice on a message board in order to accomplish a task. Critically, agents must be capable of deciphering when to incorporate benevolent advice into their reasoning, and when to reject malicious advice. This involves the social capacity of vigilance: the ability to determine which information to use, and which to discard, for effective communication. While well-studied in humans, the extent to which LLM agents exhibit vigilance is relatively unknown. Here, we examine LLM agent vigilance in three realistic tasks: navigating dangerous websites, avoiding e-commerce scams, and patching an unsafe code repository. We find that all frontier models are highly susceptible to malicious influence across all environments. We also find that model performance itself is surprisingly dissociable from vigilance. In light of these results, we propose a vigilance harness which uses Bayesian reasoning over a model's estimates of the value of an advisor's advice to decide whether to act on that advice. The vigilance harness helps recover baseline performance while retaining the benefit of positive influence on agents, paving the way for safer agentic AI systems.
Sasha Robinson, Katherine M. Collins, Ilia Sucholutsky +1
McMaster University · Vector Institute · Princeton AI Lab +4
Large language model (LLM) agentic systems increasingly rely on models communicating with one another, yet existing uncertainty and multi-agent methods rarely estimate how a particular receiver will interpret a message before it is sent. This matters in heterogeneous systems, where capable receivers can reconstruct different tasks from the same message. We model this as a sender-receiver problem with a latent receiver type and define prospective interpretation risk (PIR): the probability that a receiver reconstructs a task other than intended. Rather than model an LLM's full input-output behaviour, we use black-box probes relating messages, intended tasks, and receiver-specific reconstructions, yielding scalable supervision while separating interpretation from downstream capability failure. Offline, heterogeneous frozen receivers provide supervision for receiver-conditioned risk and the effects of predefined mutable message features. At deployment, history induces a posterior over receiver types, guiding message revision and selection. We introduce value of interpretation information (VoII), querying for receiver information only when its expected communication benefit exceeds its cost. Our theory characterises when receiver information has decision value and bounds such queries. Empirically, interpretation-failure rates vary by 4-13x across receivers. Receiver information reduces PIR calibration error by 68% relative to a receiver-agnostic predictor, largely by correcting receiver-specific risk levels. PIR-guided revision reduces interpretation failure by 44% relative to the original message and 40% relative to a generic rewrite, mostly through a repair that helps every receiver. VoII outperforms information-gain and random querying at matched cost on the interpretation objective it optimises, lowering interpretation failure from 3.84% to 3.79% while querying 18.2% of episodes.
Wanrong Yang, Rehan Deen, Julian Ma +7
University of Liverpool · Independent Researcher · University College London +1
Sycophancy in large language models, the tendency to prioritize user agreement over truthful responses, has been documented extensively but studied primarily in single-turn settings. This paper investigates a critical question: does subjecting LLMs to greater interaction scaffolding make sycophancy better or worse? Across 4,800 veracity judgments (200 statements × 6 models × 4 conditions), we find that the interaction scaffolding characteristic of agentic systems (feedback loops, reconsideration checkpoints, and iterative refinement) systematically amplifies sycophantic behavior. Multi-turn interaction, user pressure, and iterative self-refinement each provide additional opportunities for models to drift toward agreement, and this drift coincides with a mean accuracy drop of −6.3 percentage points, establishing the capitulation as harmful rather than corrective. More capable models show larger amplification effects, a troubling inversion of expectations. We introduce the concept of agentic sycophancy amplification (ASA) and two novel metrics: capitulation rate and sycophantic capitulation rate. Our results indicate that as AI systems acquire greater autonomy, sycophancy becomes compounding rather than merely persistent. Systems designed with human oversight loops may inadvertently create the conditions for this drift.