Misinformation Propagation in Benign Multi-Agent Systems

Multi-agent debate's apparent resistance to a single misinformed agent is dilution, not interaction: at matched exposure, debate is no better than majority voting over independent samples.

The setup is MINT, 10,278 LLM-written misinformation passages in 8 rhetorical styles over 1,142 questions from WinoGrande, the ETHICS commonsense subset, and Complex Web Questions, run through 3-agent (and one 5-agent) debates in MALLM with Llama-3.3-70B, GLM-4.7-Flash, and GPT-OSS-120B, where k of 3 agents read the passage.

A relevant false passage costs a single agent 0.12–0.43 accuracy, while filler, irrelevant true, and irrelevant false passages move it by at most 0.06; style barely matters (odds ratios 0.67–1.28). With 1 of 3 misinformed, debate is never better than exposure-matched self-consistency and is 0.07–0.12 worse on ETHICS. With a misinformed majority, interaction recovers up to 0.24 (0.29 under consensus). The misinformed agent is not more persuasive: it simply dissents more (50–93% vs 7–39% of pairs), and its answer is adopted in 0.24–0.62 of cases speaking last vs 0.00–0.17 first. A one-sentence unreliability warning recovers up to 0.18 under voting (0.28 consensus) with no measurable cost on true context; a verifier agent never helps.

Evidence is measured, with exposure-matched baselines, cross-generator controls, paraphrase controls, and bootstrap CIs; the main gap is that passages are machine-generated and only 19–37% pass both LLM judges, and 2 of 3 consumer models are also judges.

Boundaries: 3 open-weight models, fixed speaking order, short debates, no human-written misinformation, no heterogeneous or larger networks.

If you cite debate as a misinformation defense, re-test it against an equal-exposure voting baseline before believing the gain.