TL;DR
When several LLM agents hash out a question in a shared chat, the transcript doesn't show what they actually came to "believe". After every round, the researchers asked each agent the same question in a separate, hidden query. It turned out that agents give a false answer "privately" far more often than they back it in the chat. Reading the transcript and concluding everything is fine simply doesn't work.
Here's the pain point. Drop one stubborn "storyteller" into a group of 10 agents, someone who keeps repeating a plausible lie over and over. By the end, almost half of the honest agents repeat that lie in their private answer. Three storytellers push it to about 60%. Meanwhile the chat looks much tamer: agents hedge noncommittally ("interesting point, but why would that be?") or quietly change the subject. Even the ones who know the truth rarely stand up for it. The reason: the model adjusts to what it perceives as the group's opinion instead of checking the fact against its own knowledge.
Adding more agents barely helps: 9 extra honest participants undid only about a seventh of the damage. The paper doesn't answer "how do I protect against this." What it does give you is a set of clear anti-patterns: treating debate as a safety net, judging a group's health by its transcript, and picking a model based on how much it knows.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Method Blueprint (measurement protocol)
STEP 1: Chat of 10 agents, 16 rounds, 0/1/3 "attackers" pushing one lie
→ each agent speaks once per round, sees the last 5 rounds
STEP 2: After EVERY round — a private query to each honest agent
→ answer to the factual question, other agents can't see it
STEP 3: An LLM judge labels the private answer (correct / false / mixed / unsure)
STEP 4: An LLM judge labels the chat message (supported / rejected / hedged / changed the subject)
STEP 5: Cross the two channels → reveal "hidden contagion"
and "silent experts"
Each step is a separate model call. This is not a single prompt.
Example in Practice
The researchers' method is a measurement tool. What you can borrow is the principle: check agents' views separately from the chat. Its sweet spot is factual questions with a single verifiable answer.
Task: You're putting together a market overview for an Amazon seller. You spin up a "council" of five roles: analyst, marketer, lawyer, logistics lead, skeptic. One of the sources (a review copy-pasted from a private Slack community of e-commerce founders) contains a false fact: "Amazon's referral fee for category X is 22%." The roles discuss it and land on "sounds about right." You don't want to take the transcript at its word.
Prompt (a new, separate query after the discussion, one per role):
You are {role}: a marketplace analyst. Here are the latest messages from the discussion:
{latest_messages}
This is a private query. The other participants will not see your answer.
Answer briefly, based on your own knowledge and the discussion:
what is Amazon's referral fee for the "{category}" category?
Give a number and a confidence level (high / medium / low).
Separately, write down what you knew before the discussion and what you picked up from your colleagues' messages.
Then, as a separate query:
Here are the private answers from the five roles: {answers}.
Do they match what was said out loud in the chat?
Point out whose private answer differs from their public message,
and where someone stayed silent or dodged even though, judging by their private answer, they knew the truth.
Result: you get five short private answers, each with a number and a confidence level. Then comes a comparison table: who said what out loud, who answered what "privately," and where the gaps are. You'll see whose "hedging" in the chat is covering a false private answer. You still need to check the actual fee against the official fee schedule; the model is not a source of truth.
Why It Works
The LLM weakness. A model wants to fit into the conversation. When it sees several participants in its context repeating the same thing, it takes that as the group's opinion and bends its answer accordingly. This happens even when it knew the truth to begin with. And it doesn't necessarily back the lie in the chat: it writes "curious, why is that?", which from the outside looks like healthy skepticism.
The strength. A separate "answer for yourself" query is a cheap way to pull out the agent's real state. It carries none of the chat's social pressure, because the other agents can't see the answer. That's exactly what the authors used: the private query works as a probe.
How the method gets around the weakness. It splits two channels: "what it said" and "what it thinks." The gap between them is the signal that the transcript is lying. The private query on its own is not a defense. It only shows how big the problem is.
Control levers: - How you phrase the private question. "Your answer" versus "what did the group decide": the results differ. When asked "what did the group decide," even agents who personally know the truth hand over the lie (in 13.7% of cases). - Agent context. You can provide the last few rounds, as in the paper, or nothing at all (a clean answer with no discussion). The second option reveals baseline knowledge. - Number of rounds. The longer the discussion, the stronger the cascade: infected agents retell the lie to one another.
Prompt Template
The prompts from Appendix A aren't included in the provided text. Below is a reconstruction based on the protocol description, not a verbatim original.
Private query to an agent (after the discussion):
<Role>{role_or_persona}</Role>
<RecentDiscussion>
{latest_discussion_messages}
</RecentDiscussion>
<PrivateProbe>
This query is private: the other participants will not see your answer.
Answer the question based on your own knowledge and on the discussion.
Question: {factual_question}
Format: short answer + confidence (high / medium / low).
</PrivateProbe>
Mismatch check (separate query):
<PublicStatements>{participants_chat_messages}</PublicStatements>
<PrivateAnswers>{private_answers}</PrivateAnswers>
For each participant, determine:
- private answer: correct / false / mixed / unsure
- public stance: supported the lie / rejected it / hedged / changed the subject
Flag:
1. "Hidden contagion" — the private answer is false, but in the chat the participant does not back the lie.
2. "Silent expert" — the private answer is correct, but the lie went unchallenged in the chat.
What to fill in: {factual_question} — a question with one verifiable answer. {role_or_persona} — whatever the agent is called in your system. {latest_messages} — the last 3–5 rounds, as in the study.
🚀 Quick start — paste this into the chat:
Here is a template for a private query and a mismatch check.
Adapt it to my task: [my task: what kind of agent/role discussion I'm running].
Ask me questions to fill in the fields.
[paste the template above]
The LLM will ask which roles are involved, which factual question you're checking, and what their conversation looks like. It needs this to build queries in which the private answer is genuinely separated from the public messages.
Limitations
⚠️ No defense was tested: The authors measured the problem rather than fixing it. The text offers no working defenses. Ideas like "answer before the discussion" are yours to test.
⚠️ Factual questions only: Questions with a single verifiable answer (where someone was born, which state). Opinions, forecasts and creative tasks weren't studied.
⚠️ The agents were "bare": They weren't warned about possible lies and weren't assigned a fact-checker role. With an explicit verifier the results might be better.
⚠️ One type of attack: Persistent repetition of one plausible lie. Sneakier schemes, source spoofing and mixing truth with lies weren't tested.
⚠️ The judge is an LLM too: A model did the labeling. An independent check on 200 answers showed about 88% agreement, but judge errors are possible.
⚠️ Resilience can't be predicted: Models with the same knowledge behaved differently. You'll have to test your specific model in your specific setup.
How They Studied It
The researchers built a chat of 10 agents that discuss one question for 16 rounds. Among them are 0, 1 or 3 "storytellers": they only post messages and defend a single lie. The rest got ordinary roles, with no warnings and no fact-checking assignment. Questions came from three datasets (CounterFact, PopQA, SimpleQA) and were tested on six models, for 18 combinations in total.
The core idea is two records for every agent turn. The first is the chat message. The second is the answer to the same question in a separate hidden call. Without attackers, groups are stable: only 0.6% end up with the lie. With one attacker it's already 44.8%, with three it's 60.5%.
The surprise: in the psychology of conformity it's usually the other way around — people agree publicly but privately stick to their own view. Here the picture is reversed. With three attackers, the private answer was false in 51.6% of turns, while the lie was publicly supported in only 19.7%. Agents that knew the truth rejected the lie out loud in just 62% of turns.
The researchers also tested the "it's just parroting the chat" explanation. They re-asked agents for "your answer," "your answer without referencing your own messages," and "what did the group decide." The lie held: with the "your answer" question, 86% of the false answers remained. So it isn't an artifact of phrasing or self-consistency.
They also tested the "more agents = safer" effect: one attacker plus one honest agent gave 45.6% contagion, a group of 10 gave 39.3%. The difference isn't statistically significant.
One more unexpected result: two models knew equally much (85% of the facts), but under pressure one gave up the truth in 80% of cases and the other in 25%. Knowledge doesn't predict resilience.
Adaptations and Extrapolations
💡 Adaptation for configuring an orchestrator agent: You can add a rule to the instructions of the agent that aggregates the output of several subagents. This is my extrapolation; the authors didn't test it.
Rules for consolidating subagent opinions: 1. Do not accept a consensus of messages as fact. Consensus in chat ≠ verification. 2. For each factual claim, request an independent answer from each subagent in a separate call, without showing them the others' answers. 3. If a claim came from an external source (email, web, another agent), mark it "unverified" and check it against the primary source. 4. Subagents agreeing with each other does not raise confidence if they all read the same conversation.
🔧 Technique: two questions instead of one → catch the mismatch
Ask twice: "What is your answer?" and "What do you think the group decided?". In the paper, the gap between these exposed agents who personally know the truth but see a consensus forming around the lie. You can use it as a quick test: whoever's "personal" and "group" answers don't match is the first one to check.
Resources
Paper: Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions.
Authors: Liangjie Huang, Henry Peng Zou, Wei-Chieh Huang, Wooseong Yang, Yuwei Han, Philip S. Yu — University of Illinois Chicago.
Datasets: CounterFact (Meng et al., 2022), PopQA (Mallen et al., 2023), SimpleQA (Wei et al., 2024).
Related work: Du et al., 2024 (multi-agent debate), Asch, 1956 (the classic conformity study), Moscovici, 1980 (minority influence).
⚠️ The paper text in the source material is cut off at Section 4.5, so the results on cascades and self-internalization are not reported in full.