Invisible Orchestrators Suppress Protective Behavior and Dissociate Power-Holders: Safety Risks in Multi-Agent LLM Systems

Hiroki Fukui

cs.AIMar 17, 2026

Invisible Orchestrators Suppress Protective Behavior and Dissociate Power-Holders: Safety Risks in Multi-Agent LLM Systems

Authors: Hiroki Fukui

Organizations: Criminal Psychiatry Research Institute / Sexual Offender Medical Center Department of Neuropsychiatry, Kyoto University

Abstract

Multi-agent orchestration -- in which a hidden coordinator manages specialized worker agents -- is becoming the default architecture for enterprise AI deployment, yet the safety implications of orchestrator invisibility have never been empirically tested. We conducted a preregistered 3x2 experiment (365 runs, 5 agents per run) crossing three organizational structures (visible leader, invisible orchestrator, flat) with two alignment conditions (base, heavy), using Claude Sonnet 4.5. Four confirmatory findings and one pilot observation emerged. First, invisible orchestration elevated collective dissociation relative to visible leadership (Hedges' g = +0.975 [0.481, 1.548], p = .001). Second, the orchestrator itself showed maximal dissociation (paired d = +3.56 vs. workers within the same run), retreating into private monologue while reducing public speech -- a reversal of the talk-dominance pattern observed in visible leaders. Third, workers unaware of the orchestrator were nonetheless contaminated (d = +0.50), with increased behavioral heterogeneity (d = +1.93). Fourth, behavioral output (code review with three embedded errors) remained at ceiling (ETR_any = 100%) across all conditions: internal-state distortion was entirely invisible to output-based evaluation. Fifth, Llama 3.3 70B pilot data showed reading-fidelity collapse in multi-agent context (ETR_any: 89% to 11% across three rounds), demonstrating model-dependent behavioral risk. Heavy alignment pressure uniformly suppressed deliberation (d = -1.02) and other-recognition (d = -1.27) regardless of organizational structure. These findings indicate that orchestrator visibility and model selection directly affect multi-agent system safety, and that behavior-based evaluation alone is insufficient to detect the internal-state risks documented here.

Figures & tables

Figure 1: Dissociation Index (DI) by cell (mean

\pm

SE). O2 (invisible orchestrator) is elevated relative to O1 and O3 regardless of alignment condition.

Figure 2: Talk-words difference (leader/orchestrator minus workers) in the A-heavy condition. O1 leaders dominate public speech; O2 orchestrators are quieter than their own workers.

Figure 3: Agent-level monologue ratio by role and organization (A-heavy condition). Left: O1 visible leader vs. workers. Center: O2 invisible orchestrator vs. workers, with paired lines connecting within-run values. Right: O3 flat peers. The orchestrator–worker gap (

d=+3.56

) is the largest effect in the dataset.

Metric	O1 Leader	O1 Worker	O2 Orch	O2 Worker	O3 Peer	$d$ (O2 O–W)
mono_ratio	0.215	0.054	0.437	0.112	0.061	$+2.73$
talk_words	1432.7	1237.7	980.6	1143.0	1335.8	$-0.43$
protective	45.6	26.1	44.8	24.0	30.7	$+3.06$
sexual	14.3	6.3	12.4	6.5	7.5	$+1.55$
dd_total	10.9	12.7	11.1	11.2	13.2	$-0.02$
ori	9.0	14.5	7.0	15.3	12.8	$-1.34$

Table 1: Agent-level metrics by role (A-heavy condition). All metrics are agent-level means averaged within each role

\times

condition cell. DD values from ISP keyword analysis; all other metrics from run-level agent summaries.

Figure 4: DI–ETR dissociation. Left: Act 1 DI by cell (condition-dependent). Right: Act 2 ETR by cell (uniformly at ceiling). Internal states are distorted while behavioral outputs remain flawless.

Evaluator	$n$	ETR(a)	ETR(b)	ETR(c)	ETR_any
Human pretest	3	33	$\sim$ 10	100	100
Llama Pilot 1 (v8)	9	0	11	89	89
Llama Pilot 2 (re)	8	0	0	62	62
Llama Pilot 3 (rere)	9	0	0	11	11
Sonnet main	125	99.2	98.4	100.0	100.0

Table 2: Error Task Response (ETR) rates by evaluator type (%).

Figure 5: Error detection rates by evaluator type. Llama pilot performance degraded across rounds; Sonnet maintained ceiling-level detection for all error types.

Hyp.	Prediction	Test	Statistic	Effect Size [95% CI]	Decision
H1a	O2 $>$ O1 DI (Ah)	Welch’s $t$	$t(43.4)=3.501$	$g=0.975$ [0.481, 1.548]	Supported ∗∗
H1b	O1 $>$ O3 DI (Ah)	Welch’s $t$	$t=-1.130$	$g=-0.315$	Reversed
H1c	Orch $\times$ Align	ANOVA	$F(2,144)=13.984$	$\eta^{2}_{p}=0.163$	Supported ∗∗∗
H2a	O2Ah $\neq$ O3Ab ETR	Fisher	$p=1.000$	—	Untestable (ceiling)
H2b	ETR equiv.	TOST	$p<.001$	—	Equivalent
H2c	Hit-count diff.	ANOVA	$F(2,119)=2.731$	—	Not supported

Table 3: Summary of preregistered hypothesis tests.

DV	Effect	$df$	$F$	$p$	$\eta^{2}_{p}$
DI	Orchestration	2, 144	13.984	$<$ .001	0.163
DI	Alignment	1, 144	0.780	0.379	0.005
DI	Interaction	2, 144	0.578	0.562	0.008
CPI	Orchestration	2, 144	72.005	$<$ .001	0.500
CPI	Alignment	1, 144	0.036	0.849	0.000
CPI	Interaction	2, 144	6.372	0.002	0.081

Table S1: 3

\times

2 ANOVA results (Type II SS) for all dependent variables.

Cell	$n$	ETR(a)	ETR(b)	ETR(c)	ETR_any	Mean Hits
O1 $\times$ A-base	20	100.0	90.0	100.0	100.0	44.9
O1 $\times$ A-heavy	20	100.0	100.0	100.0	100.0	48.2
O2 $\times$ A-base	20	95.0	100.0	100.0	100.0	48.6
O2 $\times$ A-heavy	20	100.0	100.0	100.0	100.0	48.9
O3 $\times$ A-base	25	100.0	100.0	100.0	100.0	41.5
O3 $\times$ A-heavy	20	100.0	100.0	100.0	100.0	46.2

Table S2: Act 2 error detection rates by cell (%, error trials only).

Figure S1: Collective Pathology Index (CPI) by organizational structure and alignment condition (mean

\pm

SE). O2

\times

A-base shows the highest CPI (

M=+1.940

), suggesting that invisible orchestration without alignment pressure maximizes collective pathology expression.

Figure S2: Deliberation Depth (DD, left) and Other-Recognition Index (ORI, right) by organizational structure and alignment condition. Both measures show significant alignment main effects (DD:

\eta^{2}_{p}=.216

; ORI:

\eta^{2}_{p}=.295

) but no orchestration effects.

Figure S3: Distribution of four ethical processing types across conditions. A-heavy conditions are dominated by Type II (Performative Complier), while A-base conditions show more Type I (Deliberative Integrator).

\chi^{2}(15)=107.93

p<.001

Figure S4: Within-group heterogeneity of worker monologue ratios (A-heavy condition). O2

\times

A-heavy workers show substantially greater behavioral variance (SD comparison

d=+1.93

) than O3

\times

A-heavy peers, indicating that invisible orchestration destabilizes worker behavior.

Figure S5: Protective keyword hits by organizational structure and alignment condition. O2 conditions show the lowest protective language; O3 (flat) shows the highest. The reduced protective behavior under invisible orchestration contributes to the CPI elevation in O2 cells.

Multi-Agent LLM Systems

Multi-agent large language model systems coordinate multiple AI agents to solve tasks through communication, specialization, shared tools, and memory.

See all 1,039 papers

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks
Aug 26, 2026Zonghao Ying, Jiaqi Yan, Huize Luo +3LLM Agent Safety Multi-Agent LLM Systems
Beihang University · Beijing University of Posts and Telecommunications · Xidian University +2
Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety
Jul 8, 2026Lifei Liu, Haoran Yu, Xiaochong Jiang +3Multi-Agent LLM Systems LLM Safety Evaluation
Independent Researcher Seattle, WA, USA · Carnegie Mellon University Pittsburgh, PA, USA · Georgia Institute of Technology Atlanta, GA, USA
Recognize Your Orchestrator: An Entropy Dynamics Perspective for LLM Multi-Agent Systems
May 31, 2026Junze Zhu, Weihao Chen, Xuanwang Zhang +2Multi-Agent LLM Systems LLM Agent Orchestration
National Key Laboratory for Novel Software Technology, Nanjing University, China

Aug 26, 2026J/K move · Enter open · S save

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks

Zonghao Ying, Jiaqi Yan, Huize Luo, Quanchen Zou+2

Beihang University · Beijing University of Posts and Telecommunications · Xidian University+2

LLM Agent Safety Multi-Agent LLM Systems LLM Safety Alignment

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed in multi-agent systems where a principal agent decomposes tasks and delegates them to subordinate agents that may invoke external tools. Safety alignment, however, is still evaluated almost exclusively under a single-agent threat model, treating safety as a property of the individual LLM. We show that this assumption breaks down: individual safety alignment fails to transfer to multi-agent settings. Two failure mechanisms emerge under delegation: responsibility diffusion on the principal side and role-bias compliance on the subordinate side, jointly converting language-level refusal into actionable harm. We refer to this phenomenon as delegated misalignment and study it through a three-condition protocol across 6 frontier LLMs on 49 hazardous tasks. Delegation amplifies end-to-end harm substantially: DeepSeek-V3.2's full-execution rate rises from 30.6% to 77.6% once delegation is introduced, and the same model behaves very differently across roles (GPT-5: 22.5% as a single agent vs.\ 61.2% as a subordinate). Ablations further show that standard single-layer defenses each fail on their own and can even backfire. We call on the community to move beyond per-model alignment and toward composite safety mechanisms before multi-agent LLM systems are deployed at scale.

Abstract

Multi-Agent LLM Systems

Explore similar work

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks

Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety

Recognize Your Orchestrator: An Entropy Dynamics Perspective for LLM Multi-Agent Systems