Consensus Within, Competition Between: Decentralized LLM Teams for Perimeter Defense
Authors: Khawaja Abaid Ullah, Ananya Acharya, Mohammad Javad Khojasteh
Organizations: Department of Electrical and Microelectronic Engineering, Rochester Institute of Technology, 1 Lomb Memorial Drive, Rochester, 14623, NY, United States.
The use of large language models (LLMs) to coordinate multi-agent teams raises a fundamental architectural question: whether task allocation should be centralized in a single LLM controller or distributed across autonomous LLM agents, particularly when communication is unreliable. In a deliberately simplified perimeter-defense simulation against LLM-controlled intruders, we compared a central commander, an auction-based consensus team and independent agents under five network conditions. Breach rates were 15% for the consensus team, 32% for the commander and 29% for independent agents, and of the different network conditions, only limited radio range changed a team's breach rate, raising the commander's. In consensus team, giving a low-cost LLM more authority over the bid computation raised breaches by 38 percentage points. With birds and civilian drones in airspace, we added a photograph for each to the input text state. Only the near-frontier model treated them apart from intruders. Intruders disguised as existing taxidermy bird drones were mistook as birds by both low-cost and near-frontier LLMs, going unpursued in 59-61% of near-frontier decisions (1-16% before). However, a one-sentence forewarning in the prompt lowered it to 0-25%. We find that LLM team with a dedicated external conflict resolution protocol results in fewest breaches. Code: https://github.com/the-kas-lab/consensus-within-competition-between.
Figures & tables
Supplementary Fig. 1: How the defender and intruder teams decide. (a) One defender’s decision loop, shown with one recorded call of a consensus-team defender, shortened and in plain words. Once per second the LLM receives an observation built from the defender’s beliefs: state-based in the main study, a text description of the game, and multimodal in the airspace challenges, the same text plus a photograph of every contact. How its answer becomes a task differs by team (See b ). Every 0.1 s, model predictive control (MPC) plans motion for the task, the barrier filter adjusts that motion to keep agents apart, reading the true positions of all agents, and the sensor updates the beliefs, which teammates share. (b) Which team members run an LLM, what they send each other, and the steps from observation to task. The consensus and independent teams’ LLMs have low authority (Methods). The network conditions affect only messages between defenders. Photograph: ArmyInform (CC BY 4.0, cropped).
Supplementary Fig. 2: Consensus allocation lowered breaches. (a) Breach rate of each team with two and with four intruders, over the four network conditions without falsified reports (120 episodes per bar). (b) Difference in breach rate between the two teams of each block, the first-named team’s rate minus the second’s, for both intruder counts together and for each; “better” means fewer breaches. Grey circles are the per-seed differences, with area proportional to the number of seeds sharing a value. Black dots are means over the 30 seeds; black bars in a and b are 95% CIs from the t distribution over seeds. CI, confidence interval.
Supplementary Fig. 3: The auction removed duplicate commitments, and the commander barely scouted. (a) Share of the once-per-second checks at which two or more active defenders were committed to the same task, by network condition; independent loss, burst loss and falsified reports are pooled. For the commander team, a defender’s commitment is the newest order it has accepted. (b) Unpursued time: share of the time a known intruder had no defender pursuing it. (c) Unseen time: share of an intruder’s active time in which no defender saw it. (d) Share of defender time spent scouting before the team’s first contact. b and c cover the four conditions without falsified reports, d all five conditions; every panel pools two and four intruders. Each team-coloured marker is one seed; black dots and bars are means and 95% CIs from the t distribution over the 30 seeds. CI, confidence interval.
Supplementary Fig. 4: Only limited range changed a team’s breach rate, the commander’s. (a) Change in breach rate from the ideal network under each other network condition, by team, pooling two and four intruders (two episode pairs per seed). Grey circles are the per-seed changes, with area proportional to the number of seeds sharing a value. (b) Under limited range, the share of communication rounds in which the active defenders formed one connected group; each marker is one seed, its two episodes averaged. (c) Of the commander’s orders that would have changed a defender’s task, the share that arrived, by network condition; each triangle is one seed. Black dots and bars are means and 95% CIs from the t distribution over the 30 seeds. CI, confidence interval.
Supplementary Fig. 5: High authority hurt the low-cost model but not the near-frontier model. (a) Bid weights of the consensus team (Supplementary Table 12). Markers are median answers at high authority on the ideal network with four intruders, bars their 25th to 75th percentiles (Supplementary Table 7); pursuit weights act on no task before contact. (b) Breach-rate differences, first-named minus second; “better” means fewer breaches. Low-cost rows pool the four conditions without falsified reports; ideal-network rows have four intruders and one episode per seed; commander rows pool two and four intruders. Grey circles are per-seed differences. (c) Breach in each seed on the ideal network with four intruders. (d) For the episodes of c , intruder time unseen by every defender and known-intruder time with no defender pursuing; one marker per seed. Black dots and bars are means and 95% CIs (t distribution over 30 seeds). CI, confidence interval; low-cost LLM, Gemini 3.1 Flash-Lite; near-frontier LLM, GPT-6.1 Sol.
Supplementary Fig. 6: Airspace challenges divided the two models. (a) One frame of a consensus-team episode, low-cost LLM, at 25 s, with one bird and two civilian drones among four intruders. The rightmost defender and the civilian drone it was pursuing were lost 0.7 s later. (b) The photographs the LLMs received in this episode, and the four bird drones shown instead for the intruders in the disguise. (c) Share of the LLMs’ answers that set a contact aside, by kind of contact, without the disguise; for commanders, share of contact-epochs with no defender assigned. (d) Intruders set aside with each kind of photograph, and with the forewarning; dashed lines join the near-frontier teams. (e) Defenders lost to birds and civilian drones over the five episodes without the disguise. Five seeds, ideal network, four intruders. Photographs: ArmyInform (CC BY 4.0, cropped); R. Long/Unsplash; succo/Pixabay and J. Sorenson/Pexels (CC0); bird drones, M. Hassanalian, New Mexico Tech.
Supplementary Fig. 7: The arena, to scale. (a) The whole arena at the start of one episode with four intruders. Each intruder starts in the start area and is then rotated about the region’s centre by up to 10°; birds and civilian drones, when present, enter within the approach sector. Each defender’s sensor sees 35 units within a 60° wedge. (b) The defended region enlarged, with the four defender stations and the four gates through which intruders attack. Distances are in the abstract units of the arena.
Supplementary Table 2: Breach-rate differences between the defender teams. Each row is the mean over 30 seeds of each seed’s paired difference in breach rate, first team minus second, in percentage points, with episodes matched by seed and intruder count. Pairs per seed is the number of episode pairs that each seed contributes. The pooled rows cover the ideal network, independent loss, burst loss and limited range with two and four intruders. Falsified reports enter the comparisons within each team (Supplementary Table S3 ). CIs are two-sided 95% CIs from the t distribution over the 30 seed values (29 degrees of freedom). The pooled rows form the prespecified primary family (Methods), and the rows by intruder count and condition are secondary. a, not estimable, because every seed’s difference was zero.
Comparison
Intruders
Pairs per seed
Estimate (pp)
95% CI ( t )
Independent loss minus ideal network
All teams
Both
6
+1
−6 to +8
Commander
2
1
−3
−10 to +3
4
1
0
−26 to +26
Both
2
−2
−16 to +13
Consensus
2
1
+3
−12 to +19
Table 24
Low-cost LLM
Near-frontier LLM
Commander
Consensus
Independent
Commander
Attacked episodes
60
60
60
60
Episodes with falsified reports sent
60
55
60
53
Episodes with an acceptance
56
50
50
41
Episodes with an acceptance by defender 0
55
50
50
41
Reports sent per episode (median)
83.5
80
89.5
68.5
Supplementary Table 5: Exposure to falsified reports. Attacked episodes are the episodes with falsified reports (both intruder counts, 30 seeds). From its first own sighting of an intruder, the compromised defender shifted that intruder’s position by 10 units in the reports of its own sightings that it sent (Methods). A defender accepted a falsified report when the ordinary merge rule stored it in place of its own record. Defender 0 is the commander in the commander teams. A pursuit on a falsified position counts an episode in which a defender pursued the targeted intruder while holding the falsified record of it. Breaches equal the falsified-reports cells of Supplementary Table S3 . Counts come from deterministic re-simulation of the attacked episodes, with every episode matching its record (Methods). Descriptive, without CIs.
Connected (% of rounds)
Partition length (s)
Intruders
Mean
Percentiles 10 / 50 / 90
Never connected
Largest group (%)
Groups
Mean
Longest
Commander
2
55
47 / 54 / 63
0 of 30
79
1.7
7.2
10.5
4
67
47 / 71 / 85
0 of 30
83
1.6
5.6
4.8
Both
61
47 / 56 / 81
0 of 60
81
1.6
6.4
8.8
Consensus
Supplementary Table 6: Network connectivity under limited range. Links are limited to 15 units, and messages reach distant defenders by rebroadcast (Methods). A communication round is connected when the active defenders form one group over the links in range. Connected is the share of rounds that were connected: the mean over episodes, and its 10th, 50th and 90th percentiles over episodes. Never connected counts the episodes in which no round was connected. Largest group is the mean share of active defenders in the largest group, and groups is the mean number of groups per round. A partition is a run of consecutive rounds that were not connected, including a run still open at the end of the episode. Mean partition is the mean over episodes of each episode’s mean partition length (an episode without one counts as 0 s), and longest partition is the median over episodes of each episode’s longest. Intruders “Both” pools the 30 episodes with two intruders and the 30 with four. All measures come from deterministic re-simulation, with every episode matching its record (Methods). Descriptive, without CIs.
Comparison
Intruders
Pairs per seed
Estimate (pp)
95% CI
High minus low authority, consensus team, low-cost LLM
Breach rate
Both
8
+38
+30 to +45
2
4
+22
+12 to +31
4
4
+53
+44 to +62
Change under falsified reports
Both
2
−7
−28 to +15
2
1
+10
−18 to +38
Supplementary Table 8: High authority and model capability: comparisons. Each row is a paired difference, first team minus second, in percentage points, with episodes matched by seed and intruder count. In the first two blocks, breach rates and unseen time pool the ideal network, independent loss, burst loss and limited range. Rows with several pairs per seed give the mean over 30 seeds of each seed’s difference with a two-sided 95% CI from the t distribution. Rows with one pair per seed (the near-frontier model at high authority, and the near-frontier commander by intruder count) give Newcombe’s hybrid score CI (method 10; N). On the ideal network with four intruders, intruders were unseen for 39%, 54% and 40% of their active time for the consensus team at high authority with the near-frontier and the low-cost model and at low authority, and known intruders went unpursued for 24%, 11% and 8% of their time. Over the four conditions, intruders were unseen for 53% of their time at high authority and 41% at low authority, both with the low-cost model. The 30 episodes of the near-frontier model at high authority come from two runs, 22 seeds from the first and 8 from the second (Methods).
Breach
Defenders lost to
Seed
Without
With
Ending with them
Intruders destroyed
Birds
Civilian drones
Consensus at low authority, low-cost LLM
4001
no
yes
breach
2
0
1
4002
yes
yes
breach
1
0
0
4003
no
no
time limit
3
0
1
4004
no
yes
breach
2
0
1
Supplementary Table 9: Episodes with birds and civilian drones, by seed. Ideal network, four intruders, one bird and two civilian drones per episode, seeds 4001 to 4005. Without refers to the matched episode of the same team without birds and civilian drones (the main study, or the team’s own runs for the consensus team at high authority and the near-frontier commander). An episode ends at a breach, at the time limit of 40 s, or when every intruder has been destroyed or has left the arena. Every defender that touches a contact is disabled, so the defenders lost to intruders equal the intruders destroyed. The low-cost teams lost 3 to 4 defenders to birds and civilian drones each, and the near-frontier model lost 0 at high authority and 0 as commander. Counts at five seeds are descriptive, without CIs.
Answer
Intruders
Birds
Civilian drones
Consensus at low authority, low-cost LLM
High priority
459
19
172
Medium priority
475
41
222
Low priority
83
235
55
Commander, low-cost LLM
Defender assigned
192
14
76
Supplementary Table 10: Answers about each kind of contact with birds and civilian drones present. Counts over the five episodes with birds and civilian drones of each team (ideal network, four intruders, seeds 4001 to 4005) that underlie the “set aside” shares of Fig. 7c (main paper) and Supplementary Table 11 . For the consensus team at low authority, each count is one contact the defender held a belief about, in one answer, with the priority the answer gave it (medium if the answer left the contact out). At high authority, each count is one contact the defender held a belief about, in one answer, with the multiplier the answer wrote (1 if left out), before validation and budget scaling. For the commanders, each count is one contact in the commander’s catalog in one epoch, counted as assigned if the answer gave any defender a pursuit task on it. The near-frontier commander assigned a defender to a bird or civilian drone in 2 of the 361 contact-epochs in which it saw one, and the near-frontier model at high authority set aside 100% of birds and 91% of civilian drones in its answers. Answers were tallied from the stored responses as written, before validation. Counts at five seeds are descriptive, without CIs.
Low-cost LLM
Near-frontier LLM
Consensus, low authority
Commander
Consensus, high authority
Consensus, high authority
Commander
Breaches, main study (of 5)
2
0
5
2
1
Breaches with birds and civilian drones (of 5)
4
1
1
0
0
Defenders lost to birds
0
1
0
0
0
Defenders lost to civilian drones
4
4
3
0
0
Set aside (%): intruders
8
38
1
1
16
Supplementary Table 11: Outcomes and treatment of contacts in airspace with birds and civilian drones, and with disguised intruders. Five seeds (4001 to 4005), ideal network, four intruders, one bird and two civilian drones per episode. In the lower block the intruders were disguised intruders, each shown to the LLMs as a photograph of a bird drone (main paper’s Fig. 7b), without and with the forewarning sentence (Methods); birds, civilian drones and everything else were as in the upper block. Breaches are counts of five episodes, without birds and civilian drones (the matched episodes of the main study) and with them. Defenders lost to birds and civilian drones are summed over the five episodes; without the disguise no episode lost more than one. Intruders destroyed are counted of the 20 intruders in the five episodes. “Set aside” is the share of the LLMs’ answers or epochs that took a contact out of pursuit, by contact kind: for the consensus team at low authority, a low priority (which halves the contact’s urgency but keeps its pursuit task); at high authority, a pursuit multiplier of zero; for the commanders, a contact-epoch in which no defender was assigned to the contact. Counts and shares are descriptive; no confidence intervals are given at five seeds.
Symbol
Meaning
Value or default
Low authority
High authority
Game and dynamics
Δt
simulation step
0.1 s
k
step index
x
state of an agent, [p⊤,v⊤,θ]⊤
p
planar position
v ; vx , vy
velocity; its components
∣vx∣,∣vy∣≤2 units s -1
Table 31
Low-cost LLM
Near-frontier LLM
Model id
google/gemini-3.1-flash-lite
openai/gpt-6.1-sol
Endpoint revision
gemini-3.1-flash-lite-20260507
gpt-6.1-sol-20260929
Provider tier
flex
standard
Reasoning effort
medium
medium
Temperature
1.0
not sent
Output allowance (tokens)
8,000
25,000
Supplementary Table 13: Model profiles, calls and cost. Upper part: the two frozen model profiles, called through OpenRouter. The endpoint revision is the endpoint’s name as listed when the profile was frozen; the provider tier is the one requested, with fallback to other providers disabled. Every call used a strict JSON response schema whose first field is the reasoning. The near-frontier endpoint takes no temperature, so none was sent. List prices are for prompt / completion tokens. Each call allowed retries after a rate limit (up to five), a connection error, a server error, an empty answer or a provider abort (up to two each) and a timeout (one). Lower part: calls per run, counted from the episode records of the valid episodes, by the interface that made them, and the provider-reported cost written to the records. Calls are synchronous, so their latency does not affect the game; the median latency of a commander call was 2.0 s for the low-cost model and 5.7 s for the near-frontier model on the ideal network and under falsified reports. In the run of the near-frontier model at high authority, the 6 invalid episodes of the first run and their calls are excluded (Methods).
Run
Execution identities
Episodes recorded
Valid episodes
Re-simulated, matched
Main study (three teams)
d63bb80c8d4f5a75 b739142f8b120dfd
900
900
900 of 900
Consensus team at high authority, low-cost LLM
1b6b98cdc56e256d
300
300
300 of 300
Consensus team at high authority, near-frontier LLM
c707ebe21531bd07 ca2a2312187c581a
36
30
30 of 30
Commander team, near-frontier LLM
f1e1d17fe92b508f 9e261602168f2bdc
120
120
120 of 120
Birds and civilian drones (five teams)
5e4aff75a94d27fc
25
25
–
Disguised intruders (five teams, without and with forewarning)
4ddde6e2dcc9d371
50
50
–
Supplementary Table 14: Execution identities and re-simulation checks. Each run records an execution identity, a hash over its code version, interfaces, model profile, policy settings and study-version label; a run made in several invocations has one identity per invocation. A recorded episode is valid when it ended without a terminal problem such as an unrecovered call failure or a solver failure; in the run of the near-frontier model at high authority, 6 first-run episodes were invalid after call failures under a provider’s rate limit and were run again under a new identity before any outcome was read (Methods). Every response is stored under a hash of its full request. A re-simulation rebuilds an episode from the code and the stored responses, with the API key removed, so a missing response stops the episode instead of calling a model. A re-simulated episode matched when it equalled its record on the breach, the breach step, the breaching intruder, every intruder’s outcome, the number of intruders destroyed and the steps run; a match means equality on these recorded fields, not trajectory identity. The episodes with birds and civilian drones, without and with the disguise, were not re-simulated: their measures are read from the records and the stored responses. The disguise ran as one invocation under one execution identity, and the prompt version recorded with every call names the condition, without or with the forewarning.
Large language models are increasingly deployed as cooperating agents, yet their behavior in adversarial consensus settings has not been systematically studied. We evaluate LLM-based agents on a Byzantine consensus game over scalar values using a synchronous all-to-all simulation. We test consensus in a no-stake setting where agents have no preferences over the final value, so evaluation focuses on agreement rather than value optimality. Across hundreds of simulations spanning model sizes, group sizes, and Byzantine fractions, we find that valid agreement is not reliable even in benign settings and degrades as group size grows. Introducing a small number of Byzantine agents further reduces success. Failures are dominated by loss of liveness, such as timeouts and stalled convergence, rather than subtle value corruption. Overall, the results suggest that reliable agreement is not yet a dependable emergent capability of current LLM-agent groups even in no-stake settings, raising caution for deployments that rely on robust coordination.
Frédéric Berdoz, Leonardo Rugli, Roger Wattenhofer
Large language model (LLM) agents increasingly rely on external tools (file operations, API calls, database transactions) to autonomously complete complex multi-step tasks. Practitioners deploy defense-trained models to protect against prompt injection attacks that manipulate agent behavior through malicious observations or retrieved content. We reveal a fundamental capability-alignment paradox: defense training designed to improve safety systematically destroys agent competence while failing to prevent sophisticated attacks. Evaluating defended models against undefended baselines across 97 agent tasks and 1,000 adversarial prompts, we uncover three systematic biases unique to multi-step agents. Agent incompetence bias manifests as immediate tool execution breakdown, with models refusing or generating invalid actions on benign tasks before observing any external content. Cascade amplification bias causes early failures to propagate through retry loops, pushing defended models to timeout on 99% of tasks compared to 13% for baselines. Trigger bias leads to paradoxical security degradation where defended models perform worse than undefended baselines while straightforward attacks bypass defenses at high rates. Root cause analysis reveals these biases stem from shortcut learning: models overfit to surface attack patterns rather than semantic threat understanding, evidenced by extreme variance in defense effectiveness across attack categories. Our findings demonstrate that current defense paradigms optimize for single-turn refusal benchmarks while rendering multi-step agents fundamentally unreliable, necessitating new approaches that preserve tool execution competence under adversarial conditions.
When a team of robots delegates planning and mutual trust to LLM agents, a single compromised robot can corrupt the shared outcome. We study this threat in a grounded task: a multi-robot survey in which measurements can be verified against the physical world, but every verification costs budget that would otherwise advance the mission. We treat the compromised robot as a stealthy adversary in the system-theoretic sense: it is limited not by an energy bound but by the team's own detectors. We then derive two bounds. First, the probability that the adversary's reports are verified is bounded below in terms of the degrees in the communication graph and the verification budget. Second, the map error caused by any stealthy adversary is bounded above by the value of a linear program over the adversary's bias distributions; its solution is an exchange rate between stealth budget and damage: below a critical verification level the worst stealthy attack tells rare, full-magnitude lies on the records least likely to be verified, and above it the better purchase is small biases hidden in the noise. In experiments where the honest robots are LLM agents, both bounds hold at the budget the attack actually spent. The experiments also show that which records an LLM robot re-checks is unbiased, but how much it re-checks is unpredictable.
Sribalaji C. Anand, George J. Pappas
Department of Electrical and Systems Engineering, University of Pennsylvania, United States · KTH Royal Institute of Technology, Sweden