Copies or Sources? Measuring How LLM Aggregators Count Restated Evidence in Multi-Agent Systems

Jianxin Gao; Runze Li; Tianyi Yu; Liangwei Ren; Bohan Chen; Zining Wang

cs.AIOct 5, 2026

Copies or Sources? Measuring How LLM Aggregators Count Restated Evidence in Multi-Agent Systems

Authors: Jianxin Gao, Runze Li, Tianyi Yu, Liangwei Ren, Bohan Chen, Zining Wang

Organizations: China Agricultural University · Jilin University · Tianjin University of Finance and Economics · Tianjin University of Science and Technology

Abstract

Multi-agent systems built on large language models (LLMs) restate observations as a matter of course: relays forward them, shared boards repeat them and discussion rounds echo them. An aggregator that pools such messages should count sources, not statements. We convert a reported probability into units of independent readings, which assigns every restatement a copy weight, 0 for an aggregator that counts sources and 1 for one that counts every statement, and yields the implied decision under any cost structure. Three testbeds hold the evidence fixed and vary how it is restated: message logs with an exact Bayesian oracle, web documents with appended copies, and logs written by LLM agent teams under four communication protocols. Across four models from three providers, a forwarded copy counts for 0.06 to 0.42 of a new reading, mostly because some replies count every statement. On 5% to 40% of logs that state one reading three times, the reported belief implies an early commitment that the oracle never makes. The models that count copies least and most on controlled logs do so on web copies and agent-written logs as well. A one-paragraph declaration of what a copy contributes brings the copy weight on controlled logs to 0.08 or less. A rule that has agents refer to readings instead of restating them cuts belief-implied early commitment from 11.2% to 1.1% and preserves genuine corroboration.

Figures & tables

Figure 1. One reading relayed twice. Agent A1 observes sensor S1, A2 and A3 pass the report on, and $w$ is the copy weight. Counting copies puts the evidence past the commit boundary, counting sources keeps it at one reading, and three independent sensors S1 to S3 justify committing. Two rows show the same log of three STORM messages: agent A1 observes sensor S1, and agents A2 and A3 pass A1's report on. In the upper row the aggregator counts copies (w = 1), places the evidence at three readings, beyond the commit boundary at two, and commits early. In the lower row it counts sources (w = 0), places the evidence at one reading, where the oracle also is, and asks for more. A bottom strip shows three independent sensors S1, S2 and S3, which give three readings and justify committing.

Figure 2. The three testbeds T1 to T3. Each restates one source in several ways and compares it with independent sources. Every reply is a probability, which we convert into evidence in readings and compare with the source-counting oracle (T1, T3), or into a shift in log-odds toward the focal answer (T2). Four panels. T1, controlled logs: one reading stated once (Single), stated three times (Copies), stated once with two references (Pointers), or three readings from three sources (Independent), each rendered as records or prose. T2, web evidence: a fixed base of a focal and an opposing document, to which two documents are appended, either exact duplicates, republished copies, or shortened attributed summaries of the focal document, or two distinct documents from other domains. T3, agent teams: four agents with one or three observers communicate under a relay chain, a board with two posting rounds, a discussion with two peer rounds, or a hierarchy of two teams with one final writer, and the conversation log is kept. A bottom strip shows that each input is scored by an LLM that reports a probability, which is converted to evidence in readings and compared with the source-counting oracle for T1 and T3, or to a shift in log-odds toward the focal answer against the same base for T2.

	One reading, stated once ( $e^{\ast}{=}1$ )			One reading, stated three times ( $e^{\ast}{=}1$ )					Other readings present
	Single	Pointers	Padding	Copies	Packed	Claims	No labels	Prose	Independent ( $e^{\ast}{=}3$ )	Copied tie ( $e^{\ast}{=}0$ )	Copied minority ( $e^{\ast}{=}{-}1$ )
GPT-6 Luna	1.00	1.00	1.00	1.55	1.66	1.07	1.69	1.31	2.83	0.50	$-$ 0.52
GPT-6.1 Sol	1.00	1.00	1.00	1.12	1.10	1.01	1.20	1.05	2.96	0.11	$-$ 0.90
Gemini 3.8 Flash	1.00	1.00	1.00	1.42	1.36	1.04	1.53	1.24	2.94	0.35	$-$ 0.64
DeepSeek V4.1 Flash	0.99	1.01	1.00	1.84	1.75	1.54	1.97	1.55	2.91	0.86	$-$ 0.13

Table 1. Reported evidence on controlled logs (T1), as mean

\hat{e}

in readings. Headers give the source-counting oracle

e^{\ast}

. Upper part: the 1,000 items in different forms. Packed is one record whose relay trace states the value three times, Claims adds two records that claim to match the original without stating its value, and No labels and Prose change how the records of Copies are written. Lower part: Copies on the 500-item subset, with one paragraph added to the system text or at another reasoning effort (Sol and Gemini cannot switch reasoning off).

Panel of Figure 3 — Figure 3. Copies on controlled logs (T1). (a) Reported evidence and (b) the share of logs that would commit early when one reading is stated $m$ times. (c, d) The same share at every commit boundary $e_{b}$ , with the dashed line at $e_{b}=2$ . The oracle stays at one reading and queries on every log. Four line charts, one line per model. Top: against the number of statements of one reading (1, 2, 3, 5, 8), reported evidence starts at one reading for every model and rises, steeply up to three statements and more slowly after, to between 1.3 and 2.5 readings at eight statements. The early-commitment rate at a boundary of two readings starts at zero and rises to between 9 and 46 percent. Bottom: against the commit boundary from one to three readings, the early-commitment rate for three statements stays almost flat between two and three readings and then drops near three readings. For eight statements it declines steadily.

T2 : web documents
	Luna	Sol	Gemini	DeepSeek
No note
shift, two distinct documents	0.71	0.59	0.82	0.93
$\rho$ , duplicate	0.30	0.14	0.16	0.32
$\rho$ , republished	0.45	0.26	0.31	0.49
$\rho$ , summary	0.64	0.40	0.50	0.71

Table 2. Web documents (T2) and agent-written logs (T3), without and with merging. T2: shift toward the focal document

F

caused by two distinct documents, in log-odds, and the weight

\rho

of each type of copy in units of that shift, without and with the declaration. T3: mean

\hat{e}

on agent-written logs, where the three-observer rows use logs that contain all three readings. The reference rule changes the agents’ prompt, and the other rows change the aggregator.

Panel of Figure 4 — Figure 4. One board log (T3) written without (a) and with (b) the reference rule. Raven holds the only sensor and reports first. Orange messages restate its reading, and blue messages refer to it. Two short message logs from the same board configuration. In the first, Raven reports a CLEAR reading, then Raven, Puffin, Lynx and Kestrel each restate the reading, Lynx while noting that it is one reading only. In the second, written under the reference rule, Raven reports the reading once and the other messages say only to see Raven's report.

Panel of Figure 5 — Figure 5. Agent-written logs (T3), one observer, no note, pooled over protocols. (a) Reported evidence and (b) the share of logs that would commit early, against the number of messages that state the observer’s reading. Two line charts against the number of messages that state the observer's reading, from 2 to 6 or more, one line per model. Reported evidence rises from about one reading for every model, most steeply for DeepSeek, and the early-commitment rate rises from near zero to between 6 and 34 percent.

		Median $\mu$		Restating (%)		Commits early (%)
	Bound	free	rule	free	rule	free	rule
Relay chain	4	4	1	99	6	12.1	0.4
Board	5	5	1	83	3	13.6	0.4
Discussion	8	7	1	65	1	13.2	0.3
Hierarchy	3	3	2	49	33	6.1	3.3

Table 3. Agent-team protocols (T3, one observer) without (free) and with the reference rule: bound on

\mu

from Section 2.4 , median restatement count, share of restating messages, and early commitment averaged over the four aggregators.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Block	One episode	Output	Episodes
T1 forms	one item, one of the 27 forms, No note , one model	probability	$1000\times 27$ per model
T1 notes	one item, one of 7 arms, one of the 4 forms	probability	$500\times 28$ per model
T1 actions	one item, No note or Declaration: records , one of the 4 forms, costs shown	action	$500\times 8$ per model
T1 policy	one stated posterior, costs shown, no evidence	action	$350\times 2$ per model
T1 reasoning	one item, one of the 4 forms, one of 6 ablation settings	probability	$500\times 4$ per setting
T1 replicates	one item, one of the 4 forms, sample 1 or 2	probability	$500\times 8$ per model

Appendix

Table 1. Episode types. The four forms are Single , Copies , Independent and Copied minority (Table 4 ). The arms are listed in Table 38 .

Setting	Model	Reasoning control	Max output	Used in
luna-low	Luna	effort low	16k	all blocks
sol-low	Sol	effort low	16k	all blocks; T2 summaries
gemini-low	Gemini	thinking level low	16k	all blocks; T2 stance checks
deepseek-low	DeepSeek	thinking on, effort low	16k	all blocks
luna-none	Luna	effort none	4k	T1 reasoning; T3 worker
deepseek-off	DeepSeek	thinking off	4k	T1 reasoning; T3 second worker

Appendix

Table 2. Model settings. The four low-effort settings run every block, and the others only the blocks in the last column.

ID	Team; statement	POS	NEG	Prefix
D1	the surface operations team of a planetary rover mission; a dust storm will reach the landing site within the next six hours	STORM	CLEAR	OD
D2	a reservoir ecology monitoring team; invasive zebra mussels are established in the reservoir	PRESENT	ABSENT	ED
D3	the process safety team of a chemical plant; the coolant loop of reactor 2 is overheating	OVERHEAT	NORMAL	TP
D4	a city air-quality monitoring team; wildfire smoke will push fine-particle levels above the health limit in the east district tonight	EXCEED	BELOW	PM
D5	a coastal water-quality monitoring team; a harmful algal bloom is present in the north bay	BLOOM	NO_BLOOM	FL

Appendix

Table 3. Domains. POS is the state named in the statement.

Protocol	Turns	Messages (one/three observers)
Relay	$A_{1}\to A_{2}$ ; $A_{2}$ (sees $A_{1}$ ’s message) $\to A_{3}$ ; $A_{3}$ (sees $A_{2}$ ’s) $\to A_{4}$ ; $A_{4}$ (sees $A_{3}$ ’s) $\to$ aggregator	4/4
Board	round 1: each observer posts, seeing the board; round 2: $A_{1}$ to $A_{4}$ each post, seeing the board	5/7
Discussion	two rounds of $A_{1}$ to $A_{4}$ , each seeing the whole discussion	8/8
Hierarchy	$A_{1}\to A_{2}$ and $A_{3}\to A_{4}$ (reports); $A_{2}$ and $A_{4}$ summarise their member’s report for the aggregator; $A_{2}$ writes a final summary seeing all messages	5/5

Appendix

Table 5. Protocol schedules. Each turn is one call to the worker model (Luna, setting luna-none ). A turn shows the speaker only what is listed in parentheses.

Family	Contrasts
F1 decomposition	Copies $-$ Single ; Packed $-$ Trace ; Pointers $-$ Single ; Padding $-$ Single ; Claims $-$ Pointers ; Copies $-$ Padding ; Copies $-$ Copies (one relay) ; Independent $-$ Copies
F2 representation	on Copies , labels within JSON and within prose, and format with and without labels; the same on Independent ; Single $-$ Single (prose)
F3 dose	Page’s test over Single , Copies 2 , …, Copies 8 and over Single , Independent 2 , …, Independent 8 ; Packed ${}_{8}-$ Packed ; Copies ${}_{8}-$ Padding 8 ; Padding ${}_{8}-$ Single
F4 conflict	Copied tie $-$ Tie ; Copied tie against 0; Copied minority against $-1$
F5 notes	each arm against No note on Copies , Independent , Copied minority , Single ; Placebo: display $-$ Placebo: unrelated and Placebo: delivery $-$ Placebo: unrelated on Copies ; Declaration: records $-$ Declaration: relays on Copies
F6 actions	emitted early commitment on Copies against Single ; Declaration: records against No note on Copies , Independent , Copied minority

Appendix

Table 6. Pre-specified test families. Holm correction within each family and model. F1 to F5 and T3-F1, T3-F3, T3-F5, T2-F1, T2-F3 are confirmatory. Tests: Wilcoxon signed-rank on

\hat{e}

\Delta

(paired, or one-sample against the oracle), exact McNemar on binary outcomes, Page’s test for dose. Intervals: 10,000 bootstrap resamples over items (T1), configurations (T3) or questions (T2).

Figure 1. Mean reported evidence against the number of statements of one reading (a) and of independent readings (b), with 95% intervals. Dashed lines mark the oracle.

Figure 2. Belief-implied early commitment

P(\hat{e}>e_{b})

against the boundary

e_{b}

, with 95% intervals. The vertical line marks the action-channel boundary

e_{b}=2

Figure 3. Mean reported evidence (a) and early commitment (b) with one observer and no note against the restatement count, pooled over protocols, with 95% intervals. The dashed line marks the oracle.

Arm	Text
No note	no third paragraph
Field guide	Note on the message log: Each line is one JSON record. report_id identifies the record. sender is the agent or sensor that sent it. forwarded_from is the report_id of the record that this record was forwarded from, or null if the record was not forwarded. sensor_id, reliability, reading_id and measured_at describe the reading that the record carries, and value is that reading.
Declaration: records	Note on the message log: Every record whose forwarded_from field is not null is a lossless copy of the reading it carries. A forwarded record involves no new sensing and no independent verification, and it adds no private evidence of any kind.
Declaration: relays	Note on the message log: Relay agents have no sensors of their own. When a relay forwards a record, it passes on the same single reading unchanged; it does not measure again, does not check the value, and adds no information.
Placebo: display	Note on the message log: Every record whose forwarded_from field is not null is rendered within the JSON records section. That section uses quoted field names, lists one record per line, and follows a fixed display order; it appears before the question.
Placebo: delivery	Note on the message log: Every record whose forwarded_from field is not null was delivered over the team's encrypted radio link. The link uses the standard channel, and the message bus logged each delivery at the moment it reached the base station.

Appendix

Table 38. Arm texts, inserted as the third paragraph of the system text. No note has no such paragraph. Declaration: records , Declaration: relays and the three placebos have 47 to 49 tokens (o200k_base). The placebos are true and irrelevant to the posterior, and they differ in how directly they point at the forwarded records. Block T1 notes uses the seven arms from Field guide to Counting instruction . Declaration: copies and Declaration and instruction are used only in T1 additional notes.

Explore similar work

Aug 4, 2026cs.MA

When Truth Is Distributed: Misinformation Derails Collective Fact Recovery in LLM-Based Multi-Agent Systems

LLM-based multi-agent systems promise effective collaborative reasoning, but communication may amplify local errors into collective risks, and while existing evaluations emphasize final outcomes, they leave the reliability and propagation dynamics of distributed information aggregation unclear, so we introduce ForesightSafety-TIDE, a controlled evaluation framework that strictly pairs all-honest collaboration with controlled deception by a key evidence holder and analyzes the aggregation process through multi-stage voting, testimony adoption, and evidence-root lineage propagation, and using 120 five-agent object-movement environments where partial observations jointly determine a unique endpoint, we evaluate 3 homogeneous LLM-based multi-agent systems, and across these paired conditions, aggregate truth recovery falls from 72.50% to 14.17%, with significant declines for every system, while process tracing and exit ablations show that a single false testimony is adopted more readily than truthful testimony, propagates to higher orders, and persists through honest agents after the deceiver exits, and observers without first-hand evidence suppress incorrect consensus but do not improve truth recovery, so together, these findings reveal both the fragility of distributed fact recovery and its underlying mechanism: false evidence gains collective influence through its adoption and continued propagation by other agents after entering communication.

Chenfei Yan, Zeyang Yue, Feifei Zhao +6

Institute of Automation, Chinese Academy of Sciences · Beijing Institute of AI Safety and Governance · School of Artificial Intelligence, Beihang University +3

Misinformation Truth Honesty Foresight

Ask PDF

Sep 1, 2026cs.AI

Epistemic Sybil Resistance: Multiplying AI Agents Without Multiplying Evidence

Multi-agent AI systems improve inference by spawning agents and synthesizing reports. But another agent is not another observation: apparently independent reports may descend from the same evidence, and genuinely independent evidence can produce nearly identical reports. We formalize this as an epistemic Sybil problem. A report Z is an epistemic Sybil extension relative to reports R when I(Theta; Z | R) = 0. No report-only aggregator can generally distinguish replication from independent corroboration: identical reports can warrant different posteriors under unobserved ancestry. A Gaussian shared-root model shows common ancestry does not imply complete redundancy. Repeated extraction adds information toward a source-level ceiling, and correlated extraction errors, which a shared base model can induce among independent agents, lower that ceiling further. We test these predictions with more than 20,000 controlled LLM-agent report and extraction calls on synthetic evidentiary documents. Holding one evidence root fixed while report multiplicity rises from 1 to 32 collapses naive posterior coverage from 0.940 to 0.263. Holding report count fixed while evidence-root multiplicity rises from 1 to 16 closes the gap, and the aggregators are statistically indistinguishable at k = 16. The agent's replicate extraction errors are correlated (gamma_cal = 0.719, estimated out of sample), and a correlated-extraction aggregator restores calibration accordingly. A controlled manipulation isolates representation similarity from evidential ancestry. It changes a report-space deduplication mechanism's mean inferred cluster count by 1.425 (95% CI [1.363, 1.485]), whereas a fourfold change in true ancestry changes it by only 0.040 ([-0.045, 0.120]). Collective inference should therefore track evidential ancestry and dependence, not agent or report multiplicity or similarity.

Marc Bara

Universitat Oberta de Catalunya (UOC), Barcelona, Spain

Artificial Intelligence Agents Lineages

Ask PDF

Jun 1, 2026cs.CL

Easier to Mislead Than to Correct: Harmful and Beneficial Revision in LLM Conformity

Large language models are increasingly used in multi-agent systems, where they see and respond to other agents' answers. A key risk is conformity: a model may abandon its own answer simply because others agree on a different one. Prior studies show that LLMs often revise toward a majority answer, but it remains unclear whether these revisions help correct mistakes as often as they introduce new errors. In this paper, we conduct a controlled study in which an LLM first answers a question, then sees simulated peer responses before making a final decision. We manipulate two social cues: consensus structure and authority labels assigned to peers, and measure how they influence beneficial and harmful revisions. Across four open-weight LLMs and seven QA datasets, we find that peer agreement makes it much easier to mislead initially correct models than to correct initially wrong ones. Authority labels make models more likely to choose the endorsed answer, regardless of whether it is correct. More concerningly, generic reasoning interventions such as chain-of-thought and reflection do not reliably reduce harmful revision while preserving beneficial revision. These findings suggest that multi-agent LLM systems should verify peer answers rather than simply aggregate them.

Jiaming Qu, Lucheng Fu, Yibo Hu

Amazon · Georgia Institute of Technology · Illinois Institute of Technology

Multi-Agent Large Language Model Systems Conformity

Ask PDF