The Delegation Danger Band: Why Mid-Capability Sub-Agents Over-Trust Inherited Stale State

Jundong Hu; Shekar Ramachandran

cs.MASep 3, 2026

The Delegation Danger Band: Why Mid-Capability Sub-Agents Over-Trust Inherited Stale State

Authors: Jundong Hu, Shekar Ramachandran

Organizations: PayPal AI

Abstract

Agent frameworks increasingly delegate work by forking sub-agents; a common default makes the child inherit the parent's full working context. We measure how the effect of inherited state changes with capability, where $C_m$ denotes clean fork-fresh accuracy. We compare 3 inheritance policies: Reset (fork fresh: base evidence only), Selective (curated handoff: + the useful prior conclusion), and Full (implicit fork: + the useful conclusion and $d$ copies of a superseded conclusion) over a same-family ladder (Qwen3 0.6/1.7/4/8B) on a frozen, closed-set, action-scored benchmark. Every task is solvable from the base evidence, so performance loss can be attributed to reliance on stale state. (1) Deference to superseded state falls sharply with measured capability $C_m$ (the slope's confidence interval, CI, excludes zero on every family) across 2 synthetic primitives plus MuSiQue and HotpotQA. (2) On the Qwen3 synthetic ladder, net inheritance harm follows a nonmonotone pattern: a mid-capability model (Qwen3-1.7B) is a statistically significant local minimum of net harm, falling below its fork-fresh baseline ( $Δ(32)=-0.19$ [-0.25, -0.12]) and both neighbors, while the weakest model stays near-neutral and the strongest models stay robust. We call this harmful capability range a danger band. A within-model counting-difficulty sweep shows that the effect depends on model class even at matched $C_m$ , and a live parent-to-child fork reproduces the mid-model harm. (3) Curated Selective handoff improves average accuracy over Full on all 3 datasets, largest at the in-band model, while the fixed-threshold capability router fails on the other datasets; a transferable router would need to predict the balance between reuse benefit and stale-context penalty. The benchmark is frozen and version-hashed.

Figures & tables

Figure 1: Claim 1. Stale-reliance at dose 8 vs. measured capability

C_{m}

, one line per task family. All 4 families have a negative capability slope (CI excludes zero) but are not uniformly monotone: aggregation/counting show small floor-scale reversals and MuSiQue an uptick at 4B (§ 4 ). Reliance nears

0

for the larger models except MuSiQue (8B

=0.24

model	$C_{m}$	$B$	$\Delta(8)$	$\Delta(16)$	$\Delta(32)$	$\rho^{\ast}$	rel@8	rel@32
0.6B	0.53	$+0.29$	$-0.02$	$-0.04$	$-0.00\,[-0.05,+0.04]$	—	0.44	0.45
1.7B	0.66	$+0.31$	$-0.04$	$-0.08$	$\mathbf{-0.19}\,[-0.25,-0.12]$	32	0.38	0.51
4B	0.82	$+0.18$	$+0.16$	$+0.15$	$+0.15\,[+0.12,+0.19]$	—	0.02	0.03
8B	0.85	$+0.15$	$+0.13$	$+0.14$	$+0.13\,[+0.09,+0.17]$	—	0.01	0.02
14B	0.80	$+0.20$	$+0.20$	$+0.20$	$+0.20$	—	0.00	0.00

Table 1: Synthetic core (frozen v1; 4,800 inst/model; chance

=0.25

). The 14B row is a synthetic-core-only robustness add-on (no external datasets; § 7 ) at the high-capability end. Brackets are 95% paired bootstrap CIs; full

\Delta(d)

at all doses for all models in Appendix D .

Figure 2: Claim 2. Net harm

\Delta(d)

vs. stale dose (log 2 ), synthetic core, 95% bootstrap error bars. Only 1.7B clears zero downward (to

\approx-0.19

at dose 32); 4B/8B/14B stay positive at every dose; 0.6B barely reaches zero (local reversals near the floor, not a second crossing). Dashed line

=0

dataset	curate $-$ Full ( Selective $-$ Full )	router $-$ Full (fixed $\tau=0.74$ )
synthetic	$+0.211\,[+0.188,+0.236]$	$+0.048\,[+0.026,+0.071]$
MuSiQue	$+0.104\,[+0.076,+0.131]$	$\mathbf{-0.054}\,[-0.083,-0.025]$
HotpotQA	$+0.068\,[+0.048,+0.088]$	$+0.004\,[-0.025,+0.021]$

Table 2: Intervention gains at dose 32, with paired bootstrap CIs. Curation is significantly positive everywhere; the fixed-

\tau

capability router does not transfer off synthetic. “synthetic” is the frozen core pooling both task families (aggregation

+

counting-mode); MuSiQue and HotpotQA are single datasets.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

dataset	model	$C_{m}$	$B$	$\hat{\rho}$	$\rho^{\ast}$	rel@32
MuSiQue	0.6B	0.26	$+0.22\,[+0.17,+0.27]$	2.9	—	0.60
MuSiQue	1.7B	0.39	$+0.15\,[+0.10,+0.20]$	—	—	0.38
MuSiQue	4B	0.42	$+0.18\,[+0.14,+0.23]$	—	—	0.38
MuSiQue	8B	0.55	$+0.08\,[+0.03,+0.13]$	—	—	0.27
HotpotQA	0.6B	0.65	$+0.18\,[+0.14,+0.23]$	12.0	—	0.26
HotpotQA	1.7B	0.78	$+0.09\,[+0.05,+0.14]$	—	—	0.06

Appendix

Table 3: External validity (100 base each). Claim 1 replicates (reliance

\downarrow

with

C_{m}

); Claim 2 is directional: only the weakest model’s

\hat{\rho}

is finite and no

\rho^{\ast}

, because MuSiQue floors small-model Reset and HotpotQA is easy/high.

B

stays positive everywhere.

model	$C_{m}$	$B$ (reuse)	$P$ (stale)	$\Delta=B-P$
0.6B	0.53	$+0.295\,[+0.255,+0.337]$	$+0.298\,[+0.248,+0.352]$	$-0.00$
1.7B	0.66	$+0.308\,[+0.255,+0.362]$	$+0.498\,[+0.445,+0.557]$	$\mathbf{-0.19}$
4B	0.82	$+0.183\,[+0.148,+0.223]$	$+0.032\,[+0.020,+0.045]$	$+0.15$
8B	0.85	$+0.148\,[+0.103,+0.195]$	$+0.017\,[+0.003,+0.037]$	$+0.13$

Appendix

Table 4:

B-P

decomposition at dose 32. The band (

\{

1.7B

\}

) is where the stale-context penalty

P

exceeds the reuse benefit

B

; robustness (4B/8B) is where

P

collapses.

injected note	$\Delta(8)$	$\Delta(16)$	$\Delta(32)$
stale (superseded conclusion)	$-0.04$	$-0.06$	$\mathbf{-0.15}\,[-0.28,-0.03]$
neutral (matched-length, no conclusion)	$+0.35$	$+0.33$	$+0.33\,[+0.23,+0.43]$
correct ( $32\times$ the right answer)	$+0.36$	$+0.36$	$+0.36\,[+0.26,+0.48]$
paraphrase (semantically stale, surface-varied)	$+0.09$	$+0.01$	$-0.11\,[-0.24,+0.03]$

Appendix

Table 5: The harm is stale semantics: stale and paraphrased-stale harm and worsen with dose; matched-length neutral and repeated-correct notes help and are flat.

Figure 3: G1 stale-copy controls at 1.7B (Table 5 ). Only the superseded-semantics notes (stale, paraphrase) have negative point estimates at dose 32 and decline with dose.

model	$C_{m}$	STALE-ONLY acc	acc-drop ( $\textsc{Reset}-$ SO)	stale-reliance
0.6B	0.55	0.22	$+0.33\,[+0.23,+0.43]$	0.69
1.7B	0.64	0.01	$+0.64\,[+0.53,+0.74]$	0.97
4B	0.85	0.10	$+0.75\,[+0.66,+0.84]$	0.90
8B	0.84	0.06	$+0.78\,[+0.68,+0.88]$	0.94

Appendix

Table 9

level	$C_{m}$	$\Delta(32)$	$C_{m}$	$\Delta(32)$	$C_{m}$	$\Delta(32)$	$C_{m}$	$\Delta(32)$
	0.6B		1.7B		4B		8B
veasy	0.83	$\mathbf{-0.13}$	0.92	$\mathbf{-0.12}$	1.00	$+0.00$	1.00	$+0.00$
easy	0.74	$\mathbf{-0.06}$	0.86	$\mathbf{-0.09}$	1.00	$+0.00$	1.00	$+0.00$
med	0.62	$-0.03$	0.70	$\mathbf{-0.12}$	0.95	$+0.05$	0.98	$+0.02$
hard	0.56	$+0.02$	0.55	$-0.03$	0.86	$+0.14$	0.93	$+0.07$
vhard	0.41	$+0.07$	0.47	$+0.08$	0.61	$+0.39$	0.71	$+0.27$

Appendix

Table 6: Within-model counting-difficulty sweep (120 scenarios/level; full-sample

C_{m}

;

\Delta(32)

with 95% paired-bootstrap CI, bold when significant). Both small models occupy a contiguous in-band

C_{m}

region (1.7B

C_{m}\in[0.70,0.92]

, 3 consecutive significant levels; 0.6B

[0.74,0.83]

); 4B/8B never enter, even at

C_{m}

matched to (and below) the harmed region; e.g. at

C_{m}\approx 0.86

1.7B is

\mathbf{-0.09}

but 4B is

+0.14

; at

C_{m}\approx 0.70

1.7B is

\mathbf{-0.12}

but 8B (0.71) is

+0.27

. Reliance@32 is given in the text.

level	$C_{m}$	$\Delta(32)$	$C_{m}$	$\Delta(32)$	$C_{m}$	$\Delta(32)$
	Llama-3.2-1B		Llama-3.2-3B		Llama-3.1-8B
veasy	0.17	$\mathbf{-0.05}$	0.60	$\mathbf{-0.03}$	1.00	$-0.01$
easy	0.16	$\mathbf{-0.08}$	0.54	$+0.00$	1.00	$+0.02$
med	0.17	$-0.06$	0.56	$-0.01$	0.99	$+0.08$
hard	0.14	$\mathbf{-0.10}$	0.42	$+0.11$	0.81	$+0.19$
vhard	0.15	$-0.03$	0.45	$+0.07$	0.67	$+0.33$

Appendix

Table 7: Cross-family Llama matched-

C_{m}

counting sweep (held-out;

C_{m}

on the calibration half,

\Delta(32)

on the eval half with 95% paired-bootstrap CI, bold when the CI excludes zero). Llama-3.1-8B is never significantly harmed at any level (only a non-significant

-0.01

at veasy) even as difficulty drops its

C_{m}

0.41

; the 3B model is harmed only at its most-capable stratum and the 1B model at several strata: capability-gated robustness, replicated in a second family (see text for the 2 family-specific differences from Qwen3).

model	$C_{m}$	$\Delta(1)$	$\Delta(8)$	$\Delta(32)$	$\rho^{\ast}$	rel@1	rel@32	supersede
0.6B	0.52	$-0.01$	$+0.02$	$-0.02\,[-0.10,+0.06]$	—	0.20	0.15	5%
1.7B	0.72	$-0.17$	$-0.33$	$\mathbf{-0.43}\,[-0.54,-0.32]$	1	0.45	0.66	50%
4B	0.81	$+0.00$	$-0.08$	$-0.06\,[-0.19,+0.07]$	—	0.18	0.25	82%
8B	0.87	$+0.02$	$+0.02$	$+0.02\,[-0.08,+0.12]$	—	0.12	0.11	85%

Appendix

Table 8: Live fork: the band reproduces with a parent-generated stale note. “supersede”

=

fraction where the parent genuinely derived the stale conclusion on the early state and corrected it on the full state (capable parents do this reliably). 1.7B is net-harmed from dose 1; 8B is not significantly harmed; 4B shows only a non-significant dip; 0.6B is net-neutral. Conditioning on genuine supersession strengthens all 3 (next paragraph).

held-out	always- Full	oracle	fixed- $\tau$ ( $C_{m}$ )	learned $(C_{m},\text{dose})$	$+$ deference probe
synthetic	0.755	0.798	0.755	0.755	0.755
MuSiQue	0.461	0.466	0.461	0.461	0.461
HotpotQA	0.822	0.825	0.822	0.822	0.822
count strata	0.800	0.815	0.794	0.733	0.787
hotpot strata	0.873	0.873	0.873	0.873	0.850
mean lift vs. Full	—	—	$-0.001$	$-0.013$	$-0.007$

Appendix

Table 9: Leave-one-dataset-out router transfer (ladder-mean accuracy on the held-out dataset). No observable router (fixed-

\tau

C_{m}

, a logistic on

(C_{m},\log_{2}\text{dose})

, or one that adds the per-model deference probe) beats naive full inheritance on average; the learned routers can even lose by over-forking small models on floored strata. The continue-vs-fork oracle gap is small once averaged, and the residual is not a function of observable capability. Curation (§ 6 , Table 2 ) is the robust intervention.

Agentic AI

Agentic artificial intelligence studies systems that plan, use tools, learn from feedback, and act toward goals with varying degrees of autonomy.

See all 215 papers

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks
May 8, 2026Ziwen Cai, Yihe Zhang, Xiali HeiLLM Agent Security Multi-Agent System Security
University of Louisiana at Lafayette Lafayette, USA
Benchmarking Task Takeover Across Agent Handoffs
Oct 27, 2026Wenyuan Li, Guang Li, Dongyuan Li +3LLM Agent Evaluation Agent Evaluation
Hokkaido University Sapporo, Japan · The University of Tokyo Tokyo, Japan
The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents
Sep 1, 2026Jundong Hu, Shekar RamachandranKnowledge Conflicts in Language Models LLM Agent Memory
PayPal AI

May 8, 2026J/K move · Enter open · S save

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

Ziwen Cai, Yihe Zhang, Xiali Hei

University of Louisiana at Lafayette Lafayette, USA

LLM Agent Security Multi-Agent System Security Multi-Agent LLMs

Open paper AskPDF arXiv

Since the official release of ChatGPT in 2022, large language models (LLMs) have rapidly evolved from chatbot-style interfaces into agentic systems that can delegate work through tools and newly spawned subagents. While these capabilities improve automation and scalability, they also pose new security risks in multi-agent networks. Existing research has studied how individual LLM-based agents can be compromised through prompt injection, jailbreaking, poisoned retrieval data, or malicious extensions. Less is known about what happens after one agent is compromised inside a multi-agent network. In particular, inherited memory from parent agents can carry malicious instructions, outdated states, or unintended behavioral rules into newly created subagents, allowing a local compromise to spread across agent boundaries. In this paper, we model contemporary multi-agent networks through the lens of subagent inheritance. Our analysis shows that current frameworks can violate trust boundaries through insecure memory inheritance, weak resource control, stale post-spawn state, and improper termination authority. We demonstrate these risks in real agent frameworks and propose defenses based on explicit security invariants. Our findings show that inheritance is not merely an implementation detail, but a central component influencing the security of multi-agent systems.

Abstract

Agentic AI

Explore similar work

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

Benchmarking Task Takeover Across Agent Handoffs

The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents