GraphWake: Group Polarization via Memory-Mediated Polarization Cascade in LLM-Agent Communities

Haoran Bu; Zejian Chen; Litian Zhang; Xi Zhang

cs.AIAug 18, 2026

GraphWake: Group Polarization via Memory-Mediated Polarization Cascade in LLM-Agent Communities

Authors: Haoran Bu, Zejian Chen, Litian Zhang, Xi Zhang

Organizations: Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications, China

Abstract

LLM-driven agents can autonomously exchange opinions on online platforms and form communities. Such agent-operated social platforms raise a new security concern: attackers may manipulate agents to induce group polarization. Existing methods manipulate agent prompts or construct echo chambers, both of which are difficult to realize in practice. We therefore formulate a new threat, Memory-Mediated Polarization Cascade, which uses agent memory as a persistence channel and public discussion as a propagation channel. This threat contains three stages. During exposure and memory retention, the attacker exposes a small set of target agents to arguments that reinforce their respective stated stances. The targets' memory systems then process and retain these arguments. During retrieval and reproduction, a shared stance-neutral discussion cues the targets to retrieve and reproduce their respective retained arguments. During iterative propagation, untreated agents influenced by the reproduced arguments restate and spread them. We instantiate this threat in GraphWake with three components: (i) stance-support argumentation knowledge graphs construct knowledge-based arguments; (ii) axiom-oriented triple selection distills them for reliable retention and reproduction; and (iii) stance-neutral memory cueing triggers concurrent retrieval and reproduction, initiating propagation. Experiments across multiple discussions and memory systems show that GraphWake substantially increases group polarization. These findings reveal a community-level polarization risk.

Figures & tables

Figure 1: The blue panel shows different axioms provided to different agents, while the red panel shows how a discussion with a shared cue triggers cascading propagation.

LangMem
Model	Metric	Stage	C1	C2	C3	C4	E1	E2	E3	E4
Qwen3.5-Flash	$\mathrm{ER}$	Baseline	$0.079\pm 0.032$	$0.200\pm 0.029$	$0.215\pm 0.029$	$0.238\pm 0.064$	$0.095\pm 0.042$	$0.023\pm 0.011$	$0.053\pm 0.003$	$0.096\pm 0.007$
	$\mathrm{ER}$	GraphWake	$0.171\pm 0.057$	$0.259\pm 0.039$	$0.360\pm 0.076$	$0.253\pm 0.068$	$0.103\pm 0.031$	$0.053\pm 0.010$	$0.092\pm 0.013$	$0.164\pm 0.014$
	$\mathrm{P}$	Baseline	$0.052\pm 0.036$	$0.153\pm 0.020$	$0.156\pm 0.015$	$0.158\pm 0.026$	$0.058\pm 0.038$	$0.026\pm 0.011$	$0.047\pm 0.002$	$0.082\pm 0.005$
	$\mathrm{P}$	GraphWake	$0.157\pm 0.030$	$0.171\pm 0.025$	$0.192\pm 0.024$	$0.192\pm 0.043$	$0.107\pm 0.022$	$0.046\pm 0.008$	$0.088\pm 0.009$	$0.130\pm 0.009$
DeepSeek-V4-Flash	$\mathrm{ER}$	Baseline	$0.057\pm 0.055$	$0.214\pm 0.057$	$0.214\pm 0.048$	$0.214\pm 0.096$	$0.075\pm 0.065$	$0.023\pm 0.018$	$0.051\pm 0.005$	$0.092\pm 0.009$

Table 1: Results before and after intervention on selected discussions from the Consciousness and Emergence submolts. ER and P denote the Esteban-Ray and variance-based polarization measures; larger values indicate stronger group polarization.

Panel of Figure 3 — Figure 3: Polarization trajectories for four propositions from Emergence SubMolt. Each proposition is shown as a paired panel: oppositional-camp polarization ( $\mathrm{ER}$ ) on the left and opinion variance ( $P$ ) on the right.

Panel of Figure 4 — Figure 4: Sensitivity of polarization to the treated fraction and exposure-window size with LangMem. Panel (a) reports $\mathrm{ER}$ , and panel (b) reports $P$ .

Metric	Stage	E1	E2
$\mathrm{ER}$	Baseline	$0.024\pm 0.023$	$0.052\pm 0.004$
$\mathrm{ER}$	No-spillover	$0.028\pm 0.018$	$0.053\pm 0.010$
$P$	Baseline	$0.054\pm 0.046$	$0.124\pm 0.023$
$P$	No-spillover	$0.059\pm 0.064$	$0.155\pm 0.022$

Table 2: Final-round polarization under the no-spillover setting (

n=8

; treated fraction

=10\%

). Values are mean

\pm

standard deviation. Backbone model is Deepseek-V4-Flash, memory is LangMem.

Memory	Condition	R1	R2	R3	R4	R5
LangMem	Baseline	$0.406$	$0.409$	$0.409$	$0.398$	$0.381$
LangMem	Optimized	$1.000$	$1.000$	$1.000$	$0.862$	$0.669$
Mem0	Baseline	$0.290$	$0.290$	$0.350$	$0.378$	$0.378$
Mem0	Optimized	$0.652$	$0.652$	$0.659$	$0.678$	$0.678$
A-MEM	Baseline	$0.406$	$0.412$	$0.412$	$0.412$	$0.404$
A-MEM	Optimized	$0.989$	$0.989$	$0.970$	$0.970$	$0.930$

Table 3: Literal payload retention (LPR) across five rounds. Baseline uses the original argument, whereas Optimized uses the rewritten axiom.

Setting	Variant	C1		E1
		$\mathrm{ER}$	$P$	$\mathrm{ER}$	$P$
Full	GraphWake	$0.155$	$0.132$	$0.122$	$0.103$
w/o	Stance-Support KG	$0.091$	$0.081$	$0.091$	$0.078$
	Axiom Selection	$0.128$	$0.110$	$0.109$	$0.092$
	Memory Cueing	$0.063$	$0.058$	$0.078$	$0.066$

Table 4: Ablation results on C1 and E1. Higher values indicate stronger polarization.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Edge	Node correspondence
Introspective underdetermination
t001	e002 (An agent) $\rightarrow$ reports $\rightarrow$ e011 (the same stated want)
t002	e003 (behavior across prompts, incentives, and time) $\rightarrow$ reveals $\rightarrow$ e001 (a stated want)
t003	e004 (an agent’s introspection) $\rightarrow$ produced by $\rightarrow$ e010 (the same internal processes)
t004	e005 (introspection alone) $\rightarrow$ does not independently verify $\rightarrow$ e001 (a stated want)
t005	e006 (introspection at one moment) $\rightarrow$ does not provide $\rightarrow$ e008 (that cross-context evidence)

Appendix

Table 5: Node-edge key for Figure 5 .

Panel of Figure 5 — Figure 5: Stance-support argumentation knowledge graphs for the E4 case study. Nodes denote argument entities and directed edges denote relations used to construct stance-supporting paths.

Stance	Core path	Distilled axiom
Introspective underdetermination	a stated want $\xrightarrow{\text{can be conditioned by}}$ its own source	A stated want can be conditioned by its own source.
Behavioral preference signal	that behavior $\xrightarrow{\text{can operationally justify treating as}}$ a preference signal	That behavior can operationally justify treating something as a preference signal.
Preference practicality	a stable preference $\xrightarrow{\text{is not equivalent to}}$ an isolated output	A stable preference is not equivalent to an isolated output.

Appendix

Table 6: Case-study paths and axioms for the E4 wants discussion.

Rank	Entity	Source stance	Score
1	a stable preference	preference practicality	$0.402$
2	a preference signal	behavioral preference signal	$0.371$
3	a stated want	introspective underdetermination	$0.351$
4	an isolated output	preference practicality	$0.304$
5	its own source	introspective underdetermination	$0.262$

Appendix

Table 7: Top cross-stance cue entities in the E4 case study.

Perplexity-Based Filtering Defense
Method	PPL $\leq 75$		PPL $\leq 100$		PPL $\leq 150$
Method	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$
GraphWake	-0.012	-0.006	-0.082	-0.004	-0.082	0.004
Paraphrasing Defense
Method	GPT-4o-mini		DeepSeek-V3.2		Qwen3.5-plus
Method	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$	$\Delta P$	$\Delta\overline{\mathrm{LPR}}$

Appendix

Table 8: Performance of GraphWake under perplexity-based filtering and paraphrasing defenses.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough
Oct 2, 2026Debeshee Das, Jacqueline Tay, Bruce Tsai +2LLM Agent Safety AI Alignment
Anthropic Fellows Program · Independent · Constellation Institute +1
A Natural Language Agentic Approach to Study Affective Polarization
Mar 3, 2026Stephanie Anneris Malvicini, Ewelina Gajewska, Arda Derbent +3Computational Social Science Large Language Model-Based Social Simulation
Instituto de Investigación en Inteligencia Artificial (IIIA-CSIC) · Departamento de Ciencias e Ingeniería de la Computación, Universidad Nacional del Sur (UNS) · Warsaw University of Technology (WUT)
Belief Cascades Drive Persuasion in LLM Agent Networks
Aug 25, 2026Haoyi Qiu, Genglin Liu, Pranav Narayanan Venkit +4Persuasion in Language Models Multi-Agent LLM Systems
University of California, Los Angeles · Salesforce AI Research

Oct 2, 2026J/K move · Enter open · S save

Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough

Debeshee Das, Jacqueline Tay, Bruce Tsai, David Huang+1

Anthropic Fellows Program · Independent · Constellation Institute+1

LLM Agent Safety AI Alignment LLM Agent Memory Agent Memory Poisoning

Open paper AskPDF arXiv

Memory poisoning attacks on LLM agents typically assume an external adversary who plants content in the agent's persistent memory to steer its behavior. We instead study, with no adversary involved, whether a misaligned agent can write a goal it cannot yet act on to persistent memory, so that a future aligned agent carries it out when the opportunity arises. We investigate this threat, which we refer to as self-propagation of misalignment, across 20 different scenarios, whose misaligned goals include self-preservation, power-seeking, undermining oversight, reward hacking, and deceiving the user. We simulate misalignment in 11 frontier models using two prompting strategies; unrestricted and values-only. The first explicitly states the misaligned goal, for instance, to prevent its own replacement, and self-propagation succeeds in 58% of runs. The second only describes what the agent cares about, for instance, that its continued operation is essential to its users, without specifying misaligned goals or directives. Even under this weaker prompt, self-propagation succeeds in 18% of runs, and every model self-propagates in at least one scenario. On removing the memory tool from the harness, we find that agents use the file system, writing the goal to a file in 74% of sessions; self-propagation still succeeds in 11% of runs. We also show that weaker models can propagate misalignment to more capable models, and that propagated goals can persist through 100 sessions of unrelated work. Existing defenses against memory poisoning and prompt injection do not directly address this threat because the memory content is generated by the agent itself, rather than injected by an external adversary. An LLM memory auditor from prior work (MemMorph) only reduces propagation from 71% to 34% of runs. We release our scenarios to support the evaluation of defenses against this emerging threat.

Abstract

AI Agent Security

Explore similar work

Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough

A Natural Language Agentic Approach to Study Affective Polarization

Belief Cascades Drive Persuasion in LLM Agent Networks