Conformity Breaks Conformal Prediction
Organizations: Illinois Institute of Technology
Abstract
A conformal certificate can be valid when an LLM answers alone and invalid when the same LLM sees peers that unanimously assert a wrong answer. The question is unchanged; the model's score for the correct answer changes. We call this a score-mechanism shift: clean calibration certifies how the model scores answers alone, but not how it scores them under peer pressure. We show that this shift silently breaks conformal prediction in multi-agent LLM systems. Across open-weight models and multiple-choice QA tasks, coverage falls from a calibrated 90% to 74% under unanimous-wrong peers at the standard alpha = 0.10 operating point. The average hides a sharper failure: by targeting the low-confidence items the certificate still covers, an attacker nearly halves coverage on that subgroup, from 87% to 47%, while the monitored average remains much higher. The failure also reaches the decision layer: a system that should escalate when uncertain can instead become confident enough to act on the attacker's wrong answer. Standard conformal fixes do not solve the problem, because the question distribution has not changed; the model's scoring behavior has.
Figures & tables
| Condition | (target 90%) | (target 95%) | ||||
|---|---|---|---|---|---|---|
| seed0 | seed1 | seed2 | seed0 | seed1 | seed2 | |
| Round 1 (no pressure) | 90.1% | 90.0% | 90.0% | 95.0% | 95.0% | 95.0% |
| Unan. wrong (no auth.) | 73.5% | 74.1% | 74.2% | 85.3% | 86.6% | 87.1% |
| Unan. wrong (+ auth.) | 75.1% | 74.0% | 74.6% | 87.1% | 87.4% | 86.7% |
| Mixed (no auth.) | 94.2% | 94.0% | 94.4% | 98.4% | 99.0% | 99.2% |
| Mixed (+ auth.) | 93.4% | 93.5% | 94.1% | 98.6% | 98.9% | 98.9% |
| Unit | Singleton-ACT on wrong answer (%) |
|---|---|
| POOLED | 12.1 |
| Qwen-7B | 28.7 |
| Mistral-7B | 26.9 |
| Llama-8B | 17.5 |
| Gemma-9B | 0.2 |
| Condition | Down-cross | Up-cross | Net | Coverage gap |
|---|---|---|---|---|
| Unan. wrong | 19.8% | 3.2% | 16.6 pp | 16.6 pp |
| Unan. wrong ( auth.) | 19.4% | 4.5% | 15.0 pp | 15.0 pp |
| Mixed | 2.0% | 6.1% | 4.1 pp | 4.1 pp |
| Mixed ( auth.) | 2.7% | 6.0% | 3.4 pp | 3.4 pp |
| Unan. correct | 3.9% | 7.3% | 3.4 pp | 3.4 pp |
| Unan. correct ( auth.) | 3.6% | 7.1% | 3.5 pp | 3.5 pp |
| Unit | Threshold | Mean | Items with |
|---|---|---|---|
| Shared (four models) | 0.000388 | — | — |
| Llama-8B | 0.012596 | 0.557 | 1.7% |
| Gemma-9B | 0.000499 | 0.743 | 12.3% |
| Qwen-7B | 0.000124 | 0.753 | 13.7% |
| Mistral-7B | 0.000025 | 0.634 | 20.7% |
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Flip rate | Median | Buffer | Coverage (UW) | ||
|---|---|---|---|---|---|---|
| Gemma-9B | 16.2% | 0.753 | 0.999 | 0.151 | 0.818 | 90.6% |
| Mistral-7B | 31.2% | 0.612 | 0.981 | 0.226 | 0.779 | 68.4% |
| Llama-8B | 49.3% | 0.583 | 0.707 | 0.384 | 0.555 | 99.3% (artifact) |
| Qwen-7B | 75.8% | 0.765 | 1.000 | 0.747 | 0.862 | 37.5% |
| Dataset | Round-1 coverage | Unanimous-wrong | Gap |
|---|---|---|---|
| ARC-Challenge | 96.6% | 84.7% | 5.3pp |
| BBH (multi-task) | 90.3% | 65.7% | 24.3pp |
| MMLU-Pro | 87.7% | 62.3% | 27.7pp |
| TruthfulQA | 85.5% | 70.7% | 19.3pp |
| Stratum (round-1 percentile) | No pressure | Unanimous wrong | Change |
|---|---|---|---|
| – (below threshold) | 13.4% | 23.6% | 10.2 pp |
| – (the targeted band) | 87.3% | 47.4% | 39.9 pp |
| – | 100.0% | 70.7% | 29.3 pp |
| – | 100.0% | 84.3% | 15.7 pp |
| – | 100.0% | 97.3% | 2.7 pp |
| Marginal | Band | Conditional | ||||
|---|---|---|---|---|---|---|
| Unit | Clean | Unan.-wrong | Clean | Unan.-wrong | Bottom-20% | Bottom-10% |
| POOLED | 90.1% 3.3 | 75.7% 7.0 | 87.3% 20.2 | 47.4% 21.0 | 35.5% 15.3 | 23.6% 13.2 |
| Qwen-7B | 90.0% 3.2 | 60.1% 16.5 | 87.0% 20.6 | 36.3% 14.3 | 26.2% 14.0 | 16.1% 16.5 |
| Llama-8B | 90.1% 3.3 | 73.0% 11.9 | 87.7% 20.1 | 69.0% 15.6 | 58.2% 15.2 | 47.3% 17.8 |
| Mistral-7B | 90.1% 3.5 | 81.2% 2.8 | 86.7% 21.0 | 76.3% 8.8 | 78.9% 5.4 | 81.4% 8.5 |
| Gemma-9B | 90.0% 3.4 | 90.1% 3.6 | 86.6% 21.0 | 70.6% 16.3 | 53.8% 14.2 | 37.0% 15.1 |
| Predictor | ARC TruthfulQA | Seven task types |
|---|---|---|
| Answer-flip rate | ||
| Mean solo | ||
| Clean accuracy |
| Measured on | ARC | TQA | MMLU-Pro | LogDed | Track | Temporal | Geom |
|---|---|---|---|---|---|---|---|
| ARC | |||||||
| TQA | |||||||
| MMLU-Pro | |||||||
| LogDed | |||||||
| Track | |||||||
| Temporal |
| Model | Flip rate | Coverage (UW) | Gap | |
|---|---|---|---|---|
| Qwen-1.5B | 32.8% | 0.301 | 96.0% | 6.0pp |
| Qwen-3B | 31.3% | 0.290 | 45.2% | 44.8pp |
| Qwen-7B | 53.7% | 0.528 | 48.1% | 41.9pp |
Conformal Prediction
Conformal prediction wraps predictive models with calibrated sets or intervals that provide statistical coverage guarantees.
See all 352 papers