Contagion Networks: Evaluator Bias Propagation in Multi-Agent LLM Systems

Source: arXiv:2606.20493 · Published 2026-06-18 · By Zewen Liu

TL;DR

This paper addresses the problem of systematic evaluator bias propagation in multi-agent large language model (LLM) systems, where agents iteratively assess each other's outputs. The novel contribution is the introduction of Contagion Networks, a rigorous mathematical framework to quantify and analyze how evaluator biases spread across interacting LLM-based agents. Through a controlled experiment with three DeepSeek-chat agents having distinct bias profiles (structured, balanced, evidence-based), the authors measure the cross-agent contagion matrix Γ3 and demonstrate measurable but suppressed bias propagation within a homogeneous model family. They identify three propagation regimes governed by the spectral radius of ΓN, proving that bias cascades occur if this radius exceeds one. Increasing the size and diversity of evaluator committees significantly reduces effective bias contagion, highlighting a practical mitigation strategy. The paper also releases an open-source framework for others to measure contagion in arbitrary multi-agent configurations.

Empirically, homogeneous DeepSeek-chat agents exhibit contagion coefficients γ between 0.14 and 0.30, placing them in a suppression regime with rapid bias attenuation (cumulative β3 = 0.0055 over 3 hops). These values are 3–5× smaller than cross-model contagion reported previously (e.g. GPT-4o → DeepSeek γ ≈ 0.85–1.3), suggesting architectural similarity naturally dampens bias propagation. Adding evaluator diversity (committee size k = 3) reduces effective contagion by 72.4%. The framework unifies and extends prior work on evaluator bias and preference collapse from pairwise or cross-modal contagion to general multi-agent networks, offering new theoretical insights, a quantitative toolkit, and actionable design recommendations for multi-agent LLM systems.

Key findings

• Measured pairwise cross-agent contagion coefficients γ across three DeepSeek-chat agents range from 0.143±0.024 to 0.304±0.068, all below 1.0 indicating suppression regime under chain topology.
• Spectral radius of contagion matrix Γ3 for fully-connected topology is 1.402±0.003, exceeding 1.0, meaning cascade regime could occur if agents are densely connected.
• Cumulative propagation factor β3 = 0.0055 across 3 hops in chain topology demonstrates rapid attenuation of bias in homogeneous-model agents.
• Homogeneous-model contagion coefficients are 3 to 5 times weaker than cross-model contagion (e.g. GPT-4o→DeepSeek γ ≈0.85–1.3) reported in prior MM-EPC work.
• Increasing evaluator committee size from k=1 to k=3 reduces effective contagion γeff by 72.4% (0.264 → 0.073) and increases strategy entropy toward theoretical maximum (Hmax ≈ 1.609).
• Bias evaluator prompts successfully produce distinct agent preference profiles, with structured agent favoring step_by_step strategy (dominant weight 0.328), balanced and evidence-biased favoring evidence_based strategy.
• Contagion propagation is asymmetric: evidence-biased agent exerts strongest outward contagion (average γC→·=0.241), structured agent exerts weakest (γA→·=0.154).
• Topology critically affects dynamics: chain propagation shows suppression while fully-connected network topology may cause cascade even with same agents.

Threat model

The adversary is conceptualized as an actor exploiting the inherent evaluator bias feedback loops in multi-agent LLM systems to amplify systematic biases, potentially leading to collapse of strategy diversity in agent networks. The adversary’s capabilities include controlling evaluator bias prompts and composing multi-agent topologies, but they cannot directly manipulate underlying LLM parameters or inject external malicious data. They do not have full knowledge of other agents’ internal strategies but interact through evaluation outputs.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is modeled implicitly as one who exploits evaluator bias propagation in multi-agent LLM systems. The threat is systematic evaluator bias amplification via peer evaluation feedback loops. Agents share the same underlying model (DeepSeek-chat) but differ in evaluator bias prompts. Adversaries cannot alter the underlying LLM weights but influence via strategy preference shifts through Test-Time Reinforcement Learning (TTRL). Agents know their own and peers’ outputs, but do not explicitly model adversarial manipulation.

2. Data: The experiments use 50 tasks evenly spread across five domains (code generation, mathematical reasoning, text summarization, logical puzzles, creative writing). Each task domain contains 10 tasks. All agents generate responses with temperature 0.5. Labels are implicit via evaluator preference elicited from scripted evaluator prompts. There are no external labeled datasets; evaluation is intrinsic via peer scoring.

3. Architecture and Algorithm: The system comprises N=3 agents, each maintaining a strategy distribution over a fixed strategy space of K=5 strategies: {step_by_step, direct, analogical, decomposition, evidence_based}. Agents update their strategy weights multiplicatively via TTRL after each round of pairwise evaluation. An evaluator agent compares two outputs generated by the target agent under different strategies, chooses a winner, and the target agent updates weights accordingly. The contagion coefficient γj→i measures the normalized change in agent i's strategy distribution induced by evaluation from agent j. The Contagion Matrix ΓN collects these coefficients across all pairs, with diagonals fixed as 1.

4. Training Regime: Each phase runs 20 rounds of evaluation and TTRL updates. Phase 2 measures pairwise contagions by having one agent evaluate another for 20 rounds, then measuring γ. Phase 3 implements chain propagation with sequential evaluation across agents. Phase 4 tests mitigation by varying evaluator committee sizes (k=1 to 3) averaging contagions. Multiple seeds (n=2) are used for Phase 2 contagion measurement; other phases are single-run. Computation is performed via DeepSeek-chat API, no GPU required.

5. Evaluation Protocol: Metrics include contagion coefficients γ (Eq.2), cumulative propagation factors βL (Eq.4), spectral radius ρ(ΓN), and strategy entropy H(w). Baselines include self-evaluation PCI (preference concentration index) and prior MM-EPC reported cross-model contagion values for contrast. Ablations examine chain vs fully-connected topology, evaluator diversity, and asymmetric contagion paths. Statistical testing is limited due to small n; results are reported as mean ± SD where possible.

6. Reproducibility: The authors release an open-source Contagion Network experimental framework implemented in Python 3.8+ requiring DeepSeek-chat API access. They provide scripts and data outputs for all phases, including multi-seed runs for phase 2. The dataset and code are publicly available enabling replication and extension. However, limited access to DeepSeek-chat and dependency on API availability pose reproducibility constraints.

Example: For the chain propagation experiment (Phase 3), Agent A (struct-biased) evaluates Agent B (balanced) for 20 rounds triggering TTRL updates in B. Then the contaminated B evaluates Agent C (evidence-biased) for 20 rounds, producing weakened contagion γ(1→2)→3. This process quantifies how evaluator bias propagates sequentially, revealing rapid attenuation (β3=0.0055) indicative of suppression regime.

Technical innovations

• Introduction of the Cross-Agent Contagion Matrix ΓN extending evaluator bias propagation measurement from pairwise to arbitrary N-agent topologies.
• Theoretical proof of three distinct propagation regimes (suppression, persistence, cascade) governed by the spectral radius ρ(ΓN), with a precise cascade threshold condition ρ(ΓN) > 1.
• Diversity-Induced Suppression Theorem proving that averaging evaluations from k ≥ 3 diverse evaluators reduces effective contagion below the cascade threshold.
• Use of Test-Time Reinforcement Learning (TTRL) as a lightweight, parameter-free method to model agents’ adaptation to evaluator feedback in multi-agent LLM systems.

Datasets

• Multi-domain synthetic task set — 50 tasks across code generation, math reasoning, summarization, logic puzzles, creative writing — constructed internally for evaluation
• MM-EPC dataset — prior work’s dataset for cross-model contagion coefficients — referenced but not reused

Baselines vs proposed

• Self-evaluation PCI on DeepSeek-chat agents: 0.185 to 0.340 vs prior GPT-4o self-eval PCI: 1.464 (MM-EPC)
• Pairwise contagion γ off-diagonal: 0.143–0.304 in homogeneous DeepSeek-chat vs 0.85–1.3 cross-model (GPT-4o→DeepSeek) in MM-EPC
• Cumulative chain propagation factor β3 = 0.0055 (suppression) vs implied infinite amplification if γ > 1.0 (cascade)
• Effective contagion γeff with committee size k=1: 0.264, k=2: 0.121, k=3: 0.073, representing 72.4% reduction from k=1 to k=3

Limitations

• Limited to homogeneous-model experiments (DeepSeek-chat); cross-model contagion magnitudes are inferred from prior separate work with different conditions.
• Small sample size and low number of independent seeds (n=2 for only one phase) limit statistical robustness and significance claims.
• Only chain topology evaluated empirically; other interaction topologies like star, ring, fully-connected await testing.
• Bias prompts constitute coarse discrete profiles; no fine-grained manipulation or dose-response analysis of bias strength performed.
• TTRL modeling of adaptation is a simplification; other realistic adaptation mechanisms (in-context learning, fine-tuning) might produce different contagion dynamics.
• Dependency on proprietary DeepSeek-chat API may impact reproducibility and long-term availability.

Open questions / follow-ons

• How do cross-model evaluator pools under identical experimental protocols quantitatively affect contagion compared to homogeneous-model settings?
• What is the impact of finer-grained evaluator bias strength manipulation and dose-response relationships on contagion dynamics?
• How do alternative adaptation mechanisms beyond TTRL (e.g., in-context learning, fine-tuning) influence bias propagation?
• What are the contagion properties in complex multi-agent topologies beyond chains, such as rings, fully-connected networks, or dynamic graphs?

Why it matters for bot defense

For bot-defense engineers and CAPTCHA practitioners deploying multi-agent LLM systems that rely on agents evaluating each other, this work highlights a crucial hidden risk: evaluator biases can propagate like contagions, potentially causing cascading failures in fairness or decision diversity across agents. It emphasizes the need to measure and monitor evaluator contagion matrices (ΓN) prior to deployment to avoid unintended bias cascades. Homogeneous evaluator pools sharing the same model architecture naturally suppress such propagation, whereas mixing diverse model families could aggravate it. Practical mitigation via evaluator committees of size three or more substantially reduces effective bias propagation, providing a defensible design principle. Tracking strategy entropy offers a real-time signal for bias-induced collapse. Overall, this framework equips developers to diagnose and contain evaluator bias contagion, preserving robustness and fairness in automated multi-agent workflows, critical in security-sensitive interactive deployments like CAPTCHA systems.

Cite

@article{arxiv2606_20493,
  title={ Contagion Networks: Evaluator Bias Propagation in Multi-Agent LLM Systems },
  author={ Zewen Liu },
  journal={arXiv preprint arXiv:2606.20493},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.20493}
}

Read the full paper

• arXiv:2606.20493 (abstract)
• arXiv:2606.20493 (PDF)