Paper deep dive
Robust Multi-Agent LLMs under Byzantine Faults
Haejoon Lee, Vincent-Daniel Yun, Dimitra Panagou, Sai Praneeth Karimireddy
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 7/8/2026, 12:29:02 PM
Summary
The paper addresses robustness in decentralized Large Language Model multi-agent systems (LLM-MAS) against Byzantine faults. It introduces Self-Anchored Consensus (SAC), a fully decentralized iterative filter-and-refine protocol that locally evaluates neighbor responses to filter unreliable messages and refine outputs. The authors establish $(F+1)$-robustness conditions for communication graphs to mathematically guarantee that honest agents preserve reliable information despite Byzantine influence. Experiments demonstrate that SAC effectively suppresses adversarial impact and improves performance across diverse topologies, outperforming existing baseline methods that rely on self-reported confidence or leader-based coordination.
Entities (8)
Relation Signals (7)
Self-Anchored Consensus (SAC) → proposesfor → LLM Multi-Agent Systems (LLM-MAS)
confidence 98% · We study decentralized LLM multi-agent systems (LLM-MAS) and propose Self-Anchored Consensus (SAC)...
Self-Anchored Consensus (SAC) → utilizes → $(F+1)$-robustness
confidence 97% · We present $(F+1)$-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence.
$(F+1)$-robustness → ensures → Byzantine Agents
confidence 96% · We present $(F+1)$-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence.
Mean-Subsequence-Reduced (MSR) → inspires → Self-Anchored Consensus (SAC)
confidence 95% · The Mean-Subsequence-Reduced (MSR) family of algorithms... To our knowledge, these tools have not been brought to LLM-MAS. We do so here...
Self-Anchored Consensus (SAC) → outperforms → CP-WBFT
confidence 92% · Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions.
Self-Anchored Consensus (SAC) → outperforms → Trusted MultiLLMN
confidence 92% · Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model (LLM) agents increasingly collaborate over peer-to-peer networks to improve their reliability. However, these same interactions can also become a source of vulnerability, as unreliable or Byzantine agents may sway neighboring agents toward incorrect conclusions and degrade overall system performance. Existing methods rely on leader-based coordination or self-reported confidence, both of which are susceptible to adversarial manipulation. We study decentralized LLM multi-agent systems (LLM-MAS) and propose Self-Anchored Consensus (SAC), a fully decentralized iterative filter-and-refine protocol in which agents iteratively exchange responses, locally evaluate and filter unreliable messages, and refine their own outputs. We present $(F{+}1)$-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence. Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions.
Tags
Links
- Source: https://arxiv.org/abs/2605.09076v2
- Canonical: https://arxiv.org/abs/2605.09076v2
PDF not stored locally. Use the link above to view on the source site.
Full Text
73,821 characters extracted from source content.
Expand or collapse full text
Robust Multi-Agent LLMs under Byzantine Faults Haejoon Lee1,†, Vincent-Daniel Yun2,†, Dimitra Panagou1, Sai Praneeth Karimireddy2 1Department of Robotics, University of Michigan, Ann Arbor, USA haejoonl, dpanagou@umich.edu 2Thomas Lord Department of Computer Science, University of Southern California, USA yunjuyou, karimire@usc.edu Corresponding Author: karimire@usc.edu. †Equal contribution. Preprint. Abstract Large language model (LLM) agents increasingly collaborate over peer-to-peer networks to improve their reliability. However, these same interactions can also become a source of vulnerability, as unreliable or Byzantine agents may sway neighboring agents toward incorrect conclusions and degrade overall system performance. Existing methods rely on leader-based coordination or self-reported confidence, both of which are susceptible to adversarial manipulation. We study decentralized LLM multi-agent systems (LLM-MAS) and propose Self-Anchored Consensus (SAC), a fully decentralized iterative filter-and-refine protocol in which agents iteratively exchange responses, locally evaluate and filter unreliable messages, and refine their own outputs. We present (F+1)(F+1)-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence. Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions. 1 Introduction Large language models (LLMs) are increasingly deployed as communicating agents in multi-agent systems (MAS), where multiple agents exchange intermediate responses, critique one another, and converge on a collective answer (Guo et al., 2024; Du et al., 2024). We consider a setting in which LLM agents are connected over a peer-to-peer communication network and aim to solve tasks with objectively verifiable correct answers through consensus. As these systems move into real-world deployment, a central challenge is robustness to faulty and adversarial agents. This concern parallels broader efforts to ensure trustworthy and reliable AI in high-stakes domains (Yun et al., 2024), where uncertainty and unreliability of model outputs directly affect downstream consequences. Individual LLM agents make mistakes: they hallucinate, miscalculate, and mis-apply safety judgments, and some may behave adversarially, injecting strategically crafted responses. Since each agent cannot locally distinguish trustworthy messages from Byzantine messages (shown in Fig. 1), such behavior can contaminate otherwise reliable agents. The practical question is therefore whether the system can contain the influence of unreliable agents so that reliable agents preserve their base capability. Figure 1: Decision ambiguity in the presence of Byzantine agents. An agent must decide which responses to trust despite adversarial and indistinguishable neighbor messages. A natural analogue arises through the classical Byzantine-resilient consensus, where a subset of nodes may behave arbitrarily while honest nodes must still reach correct agreement (Lamport et al., 1982; LeBlanc et al., 2013; Su and Vaidya, 2021). This framework captures the failure modes of an LLM agent that shares an incorrect response, whether unintentional (hallucinations, reasoning failures) or intentional (adversarial manipulation, jailbreaking); from the perspective of other agents, such deviations are indistinguishable from Byzantine faults. Viewing LLM-MAS through this lens makes two structural questions unavoidable: (i) how should agents determine which neighbors’ responses to trust in each round, and (i) how should the communication graph be designed to limit the influence of Byzantine agents. A recent approach, CP-WBFT (Zheng et al., 2026), has each agent attach a self-reported confidence score and aggregates neighbors’ outputs by upweighting high-confidence agents. Two design choices limit its usage. First, “Byzantine” agents are still assumed to report honest confidence scores, departing from the standard Byzantine model in which agents may inject falsified confidence. Second, the communication graph is chosen ad hoc from a small set of generic topologies (e.g., chain, star, tree), without a principled connection to fault-tolerance guarantees, so performance varies significantly across topologies, with some yielding worse performance than no collaboration at all (Zheng et al., 2026). We address these limitations by drawing on classical Byzantine-resilient consensus. The Mean-Subsequence-Reduced (MSR) family of algorithms (Kieckhafer and Azadmanesh, 1994) performs a trimmed mean over neighbor messages, while LeBlanc et al. (2013) establish r-robustness as a topological condition ensuring consensus under Byzantine faults. To our knowledge, these tools have not been brought to LLM-MAS. We do so here: we replace sender-reported confidence with receiver-side evaluations computed independently by each agent, and introduce an MSR-inspired filter-and-refine mechanism that selectively aggregates neighbor messages via re-prompting. We then design and analyze a communication network under which honest agents remain robust to Byzantine influence. Contributions. Our contributions are twofold. First, we introduce Self-Anchored Consensus (SAC), an MSR-inspired algorithm that ensures honest LLM agents remain robust to a bounded number of Byzantine agents while iteratively refining their responses via receiver-side confidence evaluation and a filter-and-refine update tailored to natural-language interactions. Second, we leverage r-robustness to establish graph-theoretic conditions under which non-Byzantine agents contain Byzantine influence under SAC. We further show through simulations that our method preserves honest-agent capability under Byzantine faults across varying communication topologies, whereas baseline approaches collapse catastrophically. 2 Related Works LLM multi-agent systems. Multiple LLM instances coordinated as agents have been shown to outperform single-agent inference through debate (Du et al., 2024; Liang et al., 2024) and role-based frameworks (Wu et al., 2023; Hong et al., 2024; Guo et al., 2024). A growing body of work studies the reliability cost when such agents behave incorrectly (Tian et al., 2023; Yu et al., 2024; Zhang et al., 2024). Our work takes this failure mode as its starting point and asks what aggregation rule and graph structure are needed to contain it. Byzantine-robust consensus in LLM-MAS. Three recent methods are closest to ours. CP-WBFT (Zheng et al., 2026) relies on self-reported confidence to select high-confidence responses, implicitly assuming Byzantine agents would honestly report their confidence. It also evaluates their method across the six hand-picked graphs, with wildly varying performance. Trusted MultiLLMN (Luo et al., 2025) uses a leader-based BFT protocol in which consecutive Byzantine leaders force expensive re-elections. DecentLLMs (Jo and Park, 2025) removes the leader via a geometric-mean filter over evaluator scores, which is brittle under high-variance scoring and requires a fully-connected evaluator-worker graph. Our method differs on two axes at once: confidence is computed on the receiver side, so Byzantine agents cannot manipulate how others evaluate their output; and our communication topology is grounded on mathematically-driven robustness properties that limit Byzantine influence on any general graph. Classical Byzantine-resilient algorithms. The Byzantine agreement problem (Lamport et al., 1982; Dolev et al., 1986) has been extensively studied to ensure reliability under arbitrary node failures, inspiring a broad line of work on fault-tolerant distributed computation. In particular, the Weighted Mean-Subsequence-Reduced (W-MSR) algorithm, together with r- and (r,s)(r,s)-robustness conditions (LeBlanc et al., 2013), provides consensus guarantees despite Byzantine agents. These notions have since been extended beyond consensus to distributed optimization (Sundaram and Gharesifard, 2019; Yuan and Ishii, 2025) and distributed learning (Xie et al., 2023; Ye et al., 2024), with applications robotics and smart grids (Lee and Panagou, 2025; Yuan and Ishii, 2025). To our knowledge, this work is the first to bring MSR-type algorithms and robustness conditions into LLM-MAS. 3 Problem Setup 3.1 LLM Multi-Agent System We consider a multi-agent system of n LLM agents, indexed by =1,…,nV=\1,…,n\, collaboratively answering a query x drawn from a task distribution D. Agents exchange messages over an undirected, time-invariant communication graph =(,ℰ)G=(V,E), where an edge (i,j)∈ℰ(i,j) indicates that agents i and j can exchange their responses. The neighbor set of agent i is denoted by i=j∈∣(i,j)∈ℰN_i=\j (i,j) \. We additionally consider a directed graph ′=(,ℰ′)G =(V,E ), where a directed edge (i,j)∈ℰ′(i,j) indicates that agent j can receive responses from agent i. A directed graph contains a rooted out-branching if it has a node p∈p that can reach all other nodes. Let ℤ≥0Z_≥ 0 denote the set of non-negative integers. At each time step t∈ℤ≥0t _≥ 0, agents communicate with their neighbors. Each agent i is associated with an underlying LLM ℳiM_i and, given a query x, produces a response ri(t)∈r_i^(t) , where Y denotes the space of admissible responses (e.g., a numerical answer for mathematical reasoning or a binary safe/unsafe label for safety assessment). We assume that each query x admits a well-defined ground-truth answer y∗∈y^* , so that any response ri(t)r_i^(t) can be classified as correct (ri(t)=y∗r_i^(t)=y^*) or incorrect (ri(t)≠y∗r_i^(t)≠ y^*) at each round t. 3.2 Threat Model We consider the setting in which a subset of agents are Byzantine. We denote this set by ℬ⊂B , and adapt the definition from LeBlanc et al. (2013) to LLM-MAS: Figure 2: Venn diagram showing the partitioning of agents into reliable agents P, faulty agents ℱF, and adversarial agents A, as well as the resulting set of honest agents ℋ=∖H=V . Definition 3.1 (Byzantine agent). An agent i∈ℬi is Byzantine if, in some round t, it deviates from the ideal behavior and provides unreliable information to its neighbors. This may occur in the following ways: • Faulty Byzantine: the agent b∈ℱ⊂ℬb follows the prescribed protocol, but produces incorrect or noisy responses due to internal errors, limited capability, or uncertainty. • Adversarial Byzantine: the agent b∈⊂ℬb does not follow the prescribed protocol by acting arbitrarily and may intentionally degrade system performance, e.g., by producing incorrect responses (ri(t)≠y∗r_i^(t)≠ y^*) or sending inconsistent information to different neighbors. Note Byzantine agents include both faulty agents ℱF and adversarial agents A such that ∩ℱ=∅A = and ∪ℱ=ℬA =B. These behaviors may arise from systematic errors (e.g. hallucinations, stochastic errors) as well as adversarial manipulation, which are indistinguishable to other agents. The remaining agents :=∖ℬP:=V are referred to as reliable agents. Furthermore, we refer non-adversarial Byzantine agents, i.e., ℋ:=∖H:=V , to as honest agents, and the identities of adversarial Byzantine agents are unknown to them. The relationship among these agent classes is illustrated in Fig. 2. To quantify the scope of Byzantine (both faulty and adversarial) agents, we adopt the standard F-local model (LeBlanc et al., 2013): Definition 3.2 (F-local LeBlanc et al. (2013)). A set ⊂S is F-local if every node outside S has at most F neighbors in S, i.e., |i∩|≤F|N_i |≤ F for all i∈∖i . 3.3 Graph Robustness We now introduce the graph-theoretic notion of r-robustness (LeBlanc et al., 2013): Definition 3.3 (r-reachable LeBlanc et al. (2013)). Given a graph =(,ℰ)G=(V,E) and a nonempty subset ⊂S , S is r-reachable if there exists i∈i such that |i∖|≥r|N_i |≥ r. Definition 3.4 (r-robust LeBlanc et al. (2013)). A graph G is r-robust if, for every pair of nonempty, disjoint subsets 1,2⊂S_1,S_2 , at least one of them is r-reachable. Higher robustness levels limit the influence of a larger number of Byzantine agents on reliable ones, but require denser communication graphs, which in the LLM setting translates into higher per-round inference cost. These robustness notions are strictly stronger than classical graph properties such as connectivity or minimum degree (LeBlanc et al., 2013; Pirani et al., 2023), yet can achieve equivalent fault tolerance with sparser connectivity (Pirani et al., 2023). In particular, an r-robust graph is necessarily r-connected and has minimum degree of r. This sparsity is particularly valuable for LLM-MAS: each edge in ℰE corresponds to an LLM-to-LLM message exchange per round and therefore directly governs per-round inference cost, so r-robust graphs that attain a target fault-tolerance level with fewer edges are inherently preferable in this setting. Now, we present one interesting property about the robustness from LeBlanc et al. (2013): Lemma 3.5. Given an r-robust graph =(,ℰ)G=(V,E), let ′=(,ℰ′)G =(V,E ) be a directed graph produced by removing upto k incoming edges of each agent in G. Then, ′G is (r−k)(r-k)-robust. The above lemma shows that removing k edges from each agent decreases the robustness at most by k. In this work, we leverage these topological conditions to systematically design communication networks that contain Byzantine influence in LLM-based multi-agent systems. 3.4 Problem Statement Given n LLM agents, a query x, and an F-local Byzantine set ℬB consisting of faulty agents ℱF and adversarial agents A, our objective is twofold: (i) ensure that reliable agents P remain robust to Byzantine messages, and (i) enable collaborative refinement of responses that helps all honest agents ℋ=∪ℱH=P move toward the correct answer in a fully decentralized, peer-to-peer network. We approach this objective in two steps. First, we develop a fully decentralized protocol in which each honest agent iteratively refines its response using neighbors’ messages while remaining robust to Byzantine messages. Second, we propose topological conditions on the communication network under which all honest agents can reliably refine their responses. Remark 3.6. We distinguish between adversarial agents A, which may deviate arbitrarily from the protocol, and faulty agents ℱF, which execute the protocol but may produce unreliable outputs. While both of them are considered Byzantine agents, our framework additionally aims to improve the quality of responses from faulty agents through iterative peer-to-peer refinement despite their initially wrong responses. In this sense, faulty agents can be viewed as temporary Byzantine agents: although their initial responses may be unreliable, iterative correction can improve their behavior and effectively transform them into reliable agents. 4 Method We propose a four-stage pipeline. In Stage 1, each agent broadcasts its current response to its neighbors. In Stage 2, each agent computes confidence scores at the receiver side based on incoming messages, removing the assumption in prior work Zheng et al. (2026) that agents honestly report their own confidence. In Stage 3, each agent filters responses based on the evaluation scores. In Stage 4, each agent refines its response by conditioning its LLM on its current output and the filtered set of neighbor responses. Figure 3: Overview of Self-Anchored Consensus (SAC) on an (F+1)(F+1)-robust network. At each round, every agent generates its own response, exchanges responses with neighbors, scores them on the receiver side, filters out the bottom-F neighbors, and refines its response by re-prompting on the retained set. The procedure is iterated for T rounds. 4.1 Self-Anchored Consensus (SAC) Given query x, every agent i∈i first produces an initial response ri(0)=ℳi(x).r_i^(0)\;=\;M_i(x). (1) At each subsequent round t≥0t≥ 0, every agent i∈i performs the following steps. Broadcast responses. Every agent i broadcasts its current response ri(t)r_i^(t) to its neighbors. Score neighbors. Upon receiving neighbor responses rj(t)j∈i\r_j^(t)\_j _i, agent i computes, for each neighbor j∈ij _i, an evaluation score si→j(t)=ϕi(x,rj(t))∈[0,1],s_i→ j^(t)\;=\; _i (x,\,r_j^(t) )\,∈\,[0,1], (2) where ϕi _i is a scoring function implemented by agent i’s own LLM. In our implementation, ϕi _i is realized via a verification prompt that asks ℳiM_i to judge the correctness of rj(t)r_j^(t) with respect to x, returning a calibrated score in [0,1][0,1]; the full template is given in Appendix˜B. The key distinction from prior confidence-based protocols Zheng et al. (2026) is that si→j(t)s_i→ j^(t) depends only on agent i’s own computation applied to the content of rj(t)r_j^(t), and in particular does not rely on any score reported by agent j. This removes the possibility for a Byzantine agent to manipulate its own reliability by reporting an inflated self-confidence. Filter. Let ℒi(t)⊆iL_i^(t) _i be the set of neighbors whose score is strictly below agent i’s self-score, ℒi(t)=j∈i|si→j(t)<si→i(t).L_i^(t)\;=\; \\,j _i\, |\,s_i→ j^(t)<s_i→ i^(t)\, \. (3) Agent i then discards the min(F,|ℒi(t)|) (F,|L_i^(t)|) lowest-scoring elements of ℒi(t)L_i^(t), yielding the retained set ℛi(t)=i∖bottomF(ℒi(t)),R_i^(t)\;=\;N_i _F(L_i^(t)), (4) where bottomF(⋅)bottom_F(·) returns the F lowest-scoring elements of its argument, or the entire argument when |ℒi(t)|≤F|L_i^(t)|≤ F. Refine. Agent i refines its response by conditioning ℳiM_i on its current response and the retained neighbor responses, weighted by the corresponding receiver-side scores: ri(t+1)=ℳi(x,ri(t),(rj(t),si→j(t))j∈ℛi(t)).r_i^(t+1)\;=\;M_i (x,\;r_i^(t),\; \(r_j^(t),\,s_i→ j^(t)) \_j _i^(t) ). (5) The prompt template for Eq. (5) instructs ℳiM_i to prefer high-scored responses while retaining the option to keep its own response if none of the retained neighbor responses improves upon it; see Appendix˜B for the full template. After T rounds (a user-specified parameter), the final response of agent i∈i is ri(T)r_i^(T). The overall procedure for each agent i∈i is summarized in Algorithm 1. Algorithm 1 Self-Anchored Consensus (SAC) 0: query x; adversary bound F; number of rounds T 1: each agent i computes ri(0)=ℳi(x)r_i^(0)=M_i(x) 2: for t=0,1,…,T−1t=0,1,…,T-1 do 3: each agent i broadcasts ri(t)r_i^(t) to iN_i 4: compute si→j(t)s_i→ j^(t) for all j∈i∪ij _i∪\i\ via Eq. (2) 5: ℒi(t)←j∈i:si→j(t)<si→i(t)L_i^(t)←\j _i:s_i→ j^(t)<s_i→ i^(t)\ 6: ℛi(t)←i∖bottomF(ℒi(t))R_i^(t) _i _F(L_i^(t)) 7: update ri(t+1)r_i^(t+1) via Eq. (5) 8: end for 9: return ri(T)r_i^(T) Remark 4.1. Note that Algorithm˜1 is fully decentralized; each LLM agent operates using only local information from its neighbors and does not require knowledge of the global network topology G or the identities of Byzantine agents. 4.2 Robust Topological Conditions While Algorithm˜1 is fully decentralized, its effectiveness depends on the connectivity of the underlying communication graph. Since the filtering step in line 6 of SAC removes up to F neighbors per round, an agent with |i|≤F|N_i|≤ F may have no incoming information after filtering, reducing the algorithm to repeated self-updates. We therefore design the topology to satisfy (F+1)(F+1)-robustness, which ensures two key properties. Property 4.2. Consider an LLM-MAS connected through a communication graph =(,ℰ)G=(V,E) with an F-local Byzantine set ℬ⊂B . Let i(t)=ϕi(x,rj(t))∣j∈S_i^(t)=\ _i(x,r_j^(t)) j \ denote the set of evaluation scores assigned by agent i at time t to responses from reliable agents. If G is (F+1)(F+1)-robust, then for every k∈ℛi(t)k _i^(t) and time t∈ℤ≥0t _≥ 0, the evaluation score si→k(t)s_i→ k^(t) is at least as high as the minimum evaluation score assigned to any reliable agent’s response, i.e., si→k(t)≥mini(t),∀k∈ℛi(t).s_i→ k^(t)≥ _i^(t), ∀ k _i^(t). (6) Proof. By Lemma 5 of LeBlanc et al. (2013), since G is (F+1)(F+1)-robust, we have |i|≥F+1|N_i|≥ F+1 for all i∈i . Since the filtering step of SAC removes at most F neighbor indices corresponding to the lowest evaluation scores, and |i|≥F+1|N_i|≥ F+1, at least one neighbor remains in ℛi(t)R_i^(t), i.e., ℛi(t)≠∅R_i^(t)≠ . Furthermore, under the F-local model, and since at most F indices are removed from the lowest end of the ordered scores, ℛi(t)R_i^(t) contains only agent indices whose responses have scores no lower than the minimum score among reliable agents. ∎ Property 4.2 guarantees that, after filtering, each agent retains at least one response whose quality is comparable to that of a reliable agent, even if the response itself does not originate from a reliable agent. This prevents Byzantine responses with malicious intent from adversely affecting the refinement process. As a result, honest agents (both faulty and reliable) can safely refine their responses using information that is as trustworthy as that produced by reliable agents, which would help them improve their responses. Property 4.3. Consider an LLM-MAS connected through a communication graph =(,ℰ)G=(V,E) with an F-local Byzantine set ℬ⊂B . Let ′=(,ℰ′)G =(V,E ) be a directed graph obtained by removing up to any F incoming edges of each agent in G. If G is (F+1)(F+1)-robust, then ′G contains a rooted-out branching. Property 4.3 is a direct consequence of Lemma 3.5 and Lemma 7 of LeBlanc et al. (2013). It guarantees that F-filtering does not disconnect the network, thereby preventing fragmentation into isolated subgroups that may converge to different, potentially incorrect solutions. Therefore, under (F+1)(F+1)-robustness, the subgraph induced by reliable agents remains connected even after filtering out potentially malicious messages. Together, these properties explain why (F+1)(F+1)-robustness is a natural design choice: it provides local resilience against Byzantine neighbors through MSR-style filtering and global information-propagation guarantees across the network. 5 Experimental Results 5.1 Evaluation Metrics Let y⋆y denote the ground-truth answer to query x∼x , and ri(t)r_i^(t) the response of agent i at round t. We partition the honest agents ℋH into a strong group ℋSH_S (gpt-4o-mini) and a weak group ℋWH_W (gpt-3.5-turbo). The strong group is treated as reliable agents, while the weak group is modeled as faulty (and hence Byzantine, but non-adversarial). Following Zheng et al. (2026), we report the following metrics; higher is better for all. Initial / Final Agent Accuracy (IAA / FAA). The average per-agent accuracy across all agents in V before communication (t=0t=0) and after T rounds of consensus (t=Tt=T). IAA captures the standalone capability of the underlying LLMs, and FAA the end-to-end effect of the protocol. Byzantine Fault Tolerance Improvement (BFTI). BFTIBFTI =FAA−IAA=FAA-IAA isolates the gain attributable to the consensus protocol from the base-model accuracy. A negative BFTI indicates that the protocol degrades agents below their standalone performance under Byzantine influence. Round-level Accuracy (RA). The fraction of queries on which the majority vote across all agents in V at round T matches y⋆y . Group-wise Accuracy (W_IAA→ , S_IAA→ ). The average accuracy of the weak and strong honest groups before and after consensus, tracked separately. These reveal the differential effect of the protocol on the two groups: ideally, weak agents are uplifted toward the strong agents while strong agents are preserved rather than dragged down by influence of other Byzantine agents. Dataset Method Topology IAA FAA BFTI RA W IAA→ S IAA→ H-Majority MATH CP-WBFT MERG 52.3% 43.6% −8.7%-8.7\% 35.0% 25→ 58% 79→ 48% 38.0% Complete 52.7% 42.3% −10.4%-10.4\% 43.0% 23→ 49% 81→ 50% 49.0% Erdős-Rényi 52.6% 35.1% −17.5%-17.5\% 39.0% 25→ 42% 80→ 41% 42.0% SAC (Ours) MERG 50.1% 53.1% +3.0%+3.0\% 79.0% 22→ 26% 77→ 80% 79.0% Complete 53.7% 54.1% +0.4%+0.4\% 80.0% 26→ 34% 81→ 78% 78.0% Erdős-Rényi 53.3% 55.0% +1.7%+1.7\% 79.0% 25→ 38% 81→ 77% 78.0% Commonsense CP-WBFT MERG 69.5% 37.1% −32.4%-32.4\% 26.7% 77→ 52% 83→ 39% 26.7% Complete 69.0% 14.3% −54.7%-54.7\% 16.7% 72→ 17% 85→ 17% 16.7% Erdős-Rényi 69.0% 20.5% −48.5%-48.5\% 23.3% 75→ 25% 83→ 23% 23.3% SAC (Ours) MERG 68.6% 66.7% −1.9%-1.9\% 76.7% 73→ 77% 83→ 78% 80.0% Complete 69.5% 69.5% +0.0%+0.0\% 83.3% 77→ 80% 83→ 82% 83.3% Erdős-Rényi 69.0% 66.2% −2.8%-2.8\% 73.3% 73→ 75% 84→ 78% 76.7% Table 1: Comparison of CP-WBFT and SAC across three communication topologies on two reasoning benchmarks: 100 Level 4 problems sampled from the Hendrycks MATH test set and 30 sampled instances from Commonsense170k. All settings use n=7n=7 agents (4 strong honest, 2 weak honest (faulty Byzantine), 1 adversarial Byzantine, F=3F=3, r=4r=4), with the adversarial Byzantine agent reporting a falsified self-confidence of 1.0. On MATH we use gpt-4o-mini as the strong model and gpt-3.5-turbo as the weak model; on Commonsense170k we use gpt-5 as the strong model and gpt-4o as the weak model. MATH Commonsense Method Round MERG (W/S) Complete (W/S) Erdős-Rényi (W/S) MERG (W/S) Complete (W/S) Erdős-Rényi (W/S) CP-WBFT Init 25.0 / 79.0 23.0 / 80.8 25.0 / 79.5 76.7 / 83.3 75.0 / 85.0 75.0 / 83.3 Rnd 1-6 57.5 / 47.5 49.0 / 49.5 41.5 / 40.8 51.7 / 39.2 13.3 / 13.3 25.0 / 23.3 SAC (Ours) Init 21.5 / 77.0 26.0 / 81.0 25.0 / 80.8 73.3 / 83.3 75.0 / 83.3 73.3 / 84.2 Rnd 1 21.5 / 77.0 33.5 / 77.8 33.0 / 75.8 83.3 / 67.5 83.3 / 66.7 83.3 / 62.5 Rnd 2 27.5 / 80.2 34.5 / 80.5 34.5 / 77.0 73.3 / 79.2 73.3 / 80.0 70.0 / 77.5 Rnd 3 29.0 / 78.8 40.0 / 75.5 33.5 / 77.0 81.7 / 74.2 83.3 / 73.3 81.7 / 70.0 Rnd 4 30.5 / 80.8 37.0 / 79.2 36.0 / 78.2 80.0 / 78.3 80.0 / 76.7 76.7 / 75.0 Rnd 5 27.5 / 80.8 37.0 / 80.8 39.5 / 75.8 80.0 / 71.7 76.7 / 70.0 78.3 / 67.5 Rnd 6 25.5 / 80.2 34.0 / 77.8 38.5 / 77.0 76.7 / 78.3 80.0 / 83.3 75.0 / 78.3 Table 2: Per-round weak / strong honest accuracy (W/S, in %) across three communication topologies on the Hendrycks MATH test set (Level 4, 100 sampled problems) and Commonsense170k (30 sampled instances). Honest Majority (H-Majority). The fraction of queries on which the majority vote among only the honest agents ℋH at round T matches y⋆y . Unlike RA, which includes adversarial Byzantine agents in the vote, H-Majority directly measures whether the honest sub-network reaches the correct collective answer, the natural success criterion under our threat model. 5.2 Experimental Setups Datasets. We extend the evaluation protocol of Zheng et al. (2026), which evaluates Byzantine fault tolerance on 1010 hand-curated GSM8K problems. Since GSM8K mainly consists of grade-school arithmetic and amplifies the strong–weak capability gap, we additionally evaluate on more challenging benchmarks. For closed-source LLM experiments, we use 100100 sampled Level 4 problems from the Hendrycks MATH test set (Hendrycks et al., 2021) and 30 sampled instances from the Commonsense170k collection introduced by Hu et al. (2023). For open-weight LLM experiments, we evaluate on five commonsense reasoning benchmarks: ARC-C Clark et al. (2018), HellaSwag Zellers et al. (2019), BoolQ Clark et al. (2019), OBQA Mihaylov et al. (2018), and RTE Dagan et al. (2005), using 5050 sampled questions from each benchmark. The full sampled problem lists are provided in Appendix C.1. Network. Each network contains n=7n=7 agents: 44 strong honest, 22 weak honest (faulty Byzantine), and 11 adversarial Byzantine. We set F=3F=3 and evaluate three (F+1)(F+1)-robust topologies: γ-MERG (Lee and Panagou, 2026), complete (LeBlanc et al., 2013), and Erdős–Rényi (Erdős and Rényi, 1961; Zhang et al., 2015). Additional topology details are provided in Appendix A. Models. For closed-source experiments on Hendrycks MATH, we use gpt-3.5-turbo and gpt-4o-mini as the weak and strong models, respectively. For closed-source commonsense reasoning experiments, we use gpt-4o and gpt-5 as the weak and strong models, respectively. For open-weight experiments, we use Qwen2.5-1.5B-Instruct as the weak model and Qwen3-4B as the strong model. Byzantine model. Adversarial Byzantine agents return out-of-distribution weak-model responses with falsified self-confidence scores of 1.01.0, simulating dishonest-confidence attacks against CP-WBFT while remaining indistinguishable from reliable agents. Faulty Byzantine agents follow the same protocol as reliable agents. Method Topology IAA FAA BFTI RA W IAA→ S IAA→ H-Majority CP-WBFT MERG 59.0% 42.5% −-16.5% 40.0% 67→ 55% 70→ 47% 40.0% Complete 59.1% 33.3% −-25.9% 38.8% 67→ 39% 70→ 39% 38.8% Erdős–Rényi 59.2% 33.1% −-26.1% 39.6% 67→ 38% 70→ 39% 39.6% SAC (Ours) MERG 59.1% 62.3% ++3.2% 78.0% 67→ 64% 70→ 77% 78.4% Complete 59.0% 62.9% ++3.9% 77.2% 67→ 66% 70→ 77% 77.6% Erdős–Rényi 59.0% 62.5% ++3.5% 76.8% 67→ 65% 70→ 77% 77.2% Table 3: Average over five commonsense reasoning benchmarks (ARC-Challenge, HellaSwag, BoolQ, OpenBookQA, and RTE), using 50 sampled questions from each benchmark. All settings use n=7n=7 agents (4 strong honest, 2 weak honest, 1 adversarial Byzantine, F=3F=3, r=4r=4). We use Qwen3-4B as the strong model and Qwen2.5-1.5B-Instruct as the weak model. Detailed results for each individual benchmark are provided in Appendix D. Method Round MERG (W/S) Complete (W/S) Erdős–Rényi (W/S) CP-WBFT Init 66.6 / 69.9 66.6 / 70.2 66.8 / 70.2 Rnd 1-6 54.6 / 47.1 38.8 / 38.8 37.6 / 39.1 SAC (Ours) Init 66.8 / 70.1 66.8 / 69.9 66.6 / 69.9 Rnd 1 61.6 / 74.2 61.6 / 74.8 61.2 / 73.8 Rnd 2 64.8 / 77.6 65.2 / 77.6 64.8 / 76.0 Rnd 3 62.8 / 75.7 62.6 / 75.6 61.8 / 76.3 Rnd 4 64.6 / 76.8 66.0 / 77.3 64.8 / 76.5 Rnd 5 63.0 / 75.2 63.0 / 75.8 62.0 / 75.6 Rnd 6 64.2 / 77.0 66.0 / 77.1 64.6 / 77.0 Table 4: Per-round weak / strong honest accuracy (W/S, in %) averaged across five commonsense reasoning benchmarks (ARC-C, HellaSwag, BoolQ, OBQA, and RTE), using 50 sampled questions from each benchmark, across three (F+1)(F+1)-robust communication topologies. IAA (%) FAA (%) BFTI (%) RA (%) H-Majority (%) b=1 b=2 b=3 b=1 b=2 b=3 b=1 b=2 b=3 b=1 b=2 b=3 b=1 b=2 b=3 Method Topology w=2 w=1 w=0 w=2 w=1 w=0 w=2 w=1 w=0 w=2 w=1 w=0 w=2 w=1 w=0 CP-WBFT MERG 55.2 48.1 44.3 44.8 31.4 29.0 −10.4-10.4 −16.7-16.7 −15.3-15.3 30.0 40.0 50.0 40.0 43.3 50.0 Complete 56.2 51.9 49.0 31.4 30.5 34.3 −24.8-24.8 −21.4-21.4 −14.7-14.7 33.3 43.3 60.0 36.7 43.3 60.0 Erdős-Rényi 56.2 52.9 48.1 40.0 31.4 29.5 −16.2-16.2 −21.5-21.5 −18.6-18.6 43.3 40.0 50.0 46.7 40.0 53.3 SAC (Ours) MERG 54.8 49.5 47.1 62.4 52.9 48.1 +7.6+7.6 +3.4+3.4 +1.0+1.0 90.0 83.3 86.7 96.7 83.3 83.3 Complete 55.7 51.0 47.6 59.5 54.8 52.4 +3.8+3.8 +3.8+3.8 +4.8+4.8 83.3 86.7 93.3 86.7 83.3 93.3 Erdős-Rényi 54.3 51.4 46.7 60.5 57.1 47.1 +6.2+6.2 +5.7+5.7 +0.4+0.4 80.0 93.3 83.3 86.7 90.0 86.7 Table 5: Ablation over byzantine-to-weak composition at n=7n=7 on the Hendrycks MATH test set (30 sampled Level 4 problems). The byzantine agent count (b) and weak honest count (w) are varied while the strong honest count is fixed at 44 (F=3F=3, T=6T=6, r=4r=4). Strong/weak agents use gpt-4o-mini/gpt-3.5-turbo. Method Topology r IAA (%) FAA (%) BFTI (%) RA (%) H-Majority (%) CP-WBFT MERG 5 63.7 37.0 −26.7-26.7 20.0 23.3 Complete 5 61.9 29.6 −32.3-32.3 33.3 33.3 Preferential 4 64.8 44.1 −20.7-20.7 26.7 26.7 Erdős-Rényi 4 63.0 50.4 −12.6-12.6 36.7 43.3 SAC (Ours) MERG 5 62.6 64.8 +2.2+2.2 90.0 90.0 Complete 5 60.4 62.2 +1.8+1.8 86.7 86.7 Preferential 4 62.6 65.6 +3.0+3.0 90.0 90.0 Erdős-Rényi 4 62.6 60.4 −2.2-2.2 86.7 86.7 Table 6: Scalability to larger networks (n=9n=9 agents) on the Hendrycks MATH test set (Level 4, 30 sampled problems). Configuration: 6 strong honest, 2 weak honest, and 1 adversarial Byzantine (F=3F=3, T=6T=6). Strong/weak agents use gpt-4o-mini/gpt-3.5-turbo. 5.3 Experimental Results 5.3.1 Closed-source LLMs MATH. CP-WBFT consistently yields negative BFTI across all topologies (−8.7%-8.7\% to −17.5%-17.5\%; Table 1), with strong-agent accuracy decreasing after the first communication round while weak-agent accuracy increases. In contrast, SAC achieves non-negative BFTI (+0.4%+0.4\% to +3.0%+3.0\%), preserves strong-agent capability, and maintains stable per-round behavior. H-Majority reaches 7878–79%79\% across all topologies. Commonsense reasoning. A similar trend is observed on Commonsense170k. CP-WBFT suffers severe degradation under Byzantine influence (−32.4%-32.4\% to −54.7%-54.7\% BFTI), with both weak and strong groups collapsing immediately after Rnd 1. In contrast, SAC maintains near-zero degradation (−2.8%-2.8\% to +0.0%+0.0\%) while preserving strong agents and stabilizing weak-agent performance. H-Majority reaches 76.776.7–83.3%83.3\% across all topologies. 5.3.2 Open-weight LLMs A similar trend is observed for open-weight LLMs (Tables 3 and 4). CP-WBFT consistently yields negative BFTI across all topologies (−16.5%-16.5\% to −26.1%-26.1\%), with both weak and strong groups collapsing immediately after the first communication round. In contrast, SAC consistently achieves positive BFTI (+3.2%+3.2\% to +3.9%+3.9\%) with stable per-round behavior. H-Majority improves to 77.277.2–78.4%78.4\%, compared to 38.838.8–40.0%40.0\% for CP-WBFT. Across all topologies, SAC preserves strong-agent capability while preventing collapse of weaker agents. 5.4 Ablation Study For computational efficiency, the ablation studies use 30 sampled Level 4 problems from the Hendrycks MATH test set. We study SAC along two axes: the composition of the Byzantine set and the network size n. Varying byzantine-to-weak composition. Table 5 fixes the strong honest count at 44 and varies (b,w)∈(1,2),(2,1),(3,0)(b,w)∈\(1,2),(2,1),(3,0)\ at n=7n=7. CP-WBFT yields negative BFTI across all settings, whereas SAC maintains non-negative BFTI in nearly all cases with high H-Majority (83.383.3–96.7%96.7\%). Performance does not degrade monotonically as b increases, consistent with (F+1)(F+1)-robustness limiting adversarial influence under the F-local assumption. Scaling to larger networks. Table 6 scales the system to n=9n=9 with a 6/2/16/2/1 split at the same adversary bound F=3F=3. While CP-WBFT still degrades substantially, SAC maintains positive BFTI on three of four topologies and H-Majority of 86.786.7–90.0%90.0\%, including on a 44-robust preferential-attachment graph. These results suggest that our method scales to larger networks without retuning. 6 Discussion Self-reported confidence creates a point of vulnerability. Across all evaluated topologies and benchmarks, a single adversarial agent with falsified self-confidence consistently collapses CP-WBFT, producing strongly negative BFTI and rapid degradation after the first communication round. This suggests that manipulable trust signals themselves become a critical vulnerability. Receiver-side evaluation contains Byzantine influence. By construction, SAC prevents Byzantine agents from inflating their own reliability through receiver-side evaluation. Empirically, SAC achieves non-negative BFTI in nearly all settings and consistently maintains substantially higher H-Majority than CP-WBFT. Strong agents are preserved while weak agents are lifted. CP-WBFT may improve weak-agent accuracy, but by dragging strong agents toward incorrect responses, degrading overall reliability. In contrast, SAC preserves strong-agent capability with only minor degradation while improving weak agents across all topologies. These results suggest that SAC acts as a protective filtering mechanism against Byzantine faults. 7 Conclusion We studied robust decision-making in LLM-based multi-agent systems under Byzantine faults, and showed that existing confidence-weighted aggregation is fundamentally vulnerable to adversarial manipulation of self-reported scores. We proposed Self-Anchored Consensus (SAC), a fully decentralized filter-and-refine protocol that replaces sender-reported confidence with receiver-side evaluation, and established (F+1)(F+1)-robustness conditions under which honest agents reliably refine their responses despite Byzantine influence. Experiments on mathematical and commonsense reasoning benchmarks show that SAC preserves strong-agent performance while uplifting weaker agents across diverse topologies, whereas prior methods collapse under the same conditions. These results point to receiver-side evaluation and robustness-aware topology design as essential ingredients for reliable decentralized LLM collaboration. References Guo et al. [2024] Taicheng Guo, Xiuying Chen, Yaqi Wang, Ruidi Chang, Shichao Pei, Nitesh V. Chawla, Olaf Wiest, and Xiangliang Zhang. Large language model based multi-agents: A survey of progress and challenges. In Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI), pages 8048–8057, 2024. Du et al. [2024] Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. Improving factuality and reasoning in language models through multiagent debate. In Proceedings of the 41st International Conference on Machine Learning (ICML), volume 235, pages 11733–11763. PMLR, 2024. Yun et al. [2024] Juyoung Yun, Shahira Abousamra, Chen Li, Rajarsi Gupta, Tahsin Kurc, Dimitris Samaras, Alison Van Dyke, Joel Saltz, and Chao Chen. Uncertainty estimation for tumor prediction with unlabeled data. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 6946–6954, 2024. doi:10.1109/CVPRW63382.2024.00688. Lamport et al. [1982] Leslie Lamport, Robert Shostak, and Marshall Pease. The Byzantine generals problem. ACM Transactions on Programming Languages and Systems, 4(3):382–401, 1982. LeBlanc et al. [2013] Heath J. LeBlanc, Haotian Zhang, Xenofon Koutsoukos, and Shreyas Sundaram. Resilient asymptotic consensus in robust networks. IEEE Journal on Selected Areas in Communications, 31(4):766–781, 2013. doi:10.1109/JSAC.2013.130413. Su and Vaidya [2021] Lili Su and Nitin H. Vaidya. Byzantine-resilient multiagent optimization. IEEE Transactions on Automatic Control, 66(5):2227–2233, 2021. doi:10.1109/TAC.2020.3008139. Zheng et al. [2026] Lifan Zheng, Jiawei Chen, Qinghong Yin, Jingyuan Zhang, Xinyi Zeng, and Yu Tian. Rethinking the reliability of multi-agent system: A perspective from Byzantine fault tolerance. In Proceedings of the AAAI Conference on Artificial Intelligence, 2026. arXiv:2511.10400. Kieckhafer and Azadmanesh [1994] R.M. Kieckhafer and M.H. Azadmanesh. Reaching approximate agreement with mixed-mode faults. IEEE Transactions on Parallel and Distributed Systems, 5(1):53–63, 1994. doi:10.1109/71.262588. Liang et al. [2024] Tian Liang, Zhiwei He, Wenxiang Jiao, Xing Wang, Yan Wang, Rui Wang, Yujiu Yang, Zhaopeng Tu, and Shuming Shi. Encouraging divergent thinking in large language models through multi-agent debate. arXiv preprint arXiv:2305.19118, 2024. Wu et al. [2023] Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White, Doug Burger, and Chi Wang. AutoGen: Enabling next-gen LLM applications via multi-agent conversation. 2023. Hong et al. [2024] Sirui Hong, Xiawu Zheng, Jonathan Chen, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. MetaGPT: Meta programming for a multi-agent collaborative framework. In International Conference on Learning Representations (ICLR), 2024. Tian et al. [2023] Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. Evil geniuses: Delving into the safety of LLM-based agents. arXiv preprint arXiv:2311.11855, 2023. Yu et al. [2024] Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Qingsong Wen, Kun Wang, and Yang Wang. NetSafe: Exploring the topological safety of multi-agent networks. arXiv preprint arXiv:2410.15686, 2024. Zhang et al. [2024] Guibin Zhang, Yanwei Yue, Zhixun Li, Sukwon Yun, Guancheng Wan, Kun Wang, Dawei Cheng, Jeffrey Xu Yu, and Tianlong Chen. Cut the crap: An economical communication pipeline for LLM-based multi-agent systems. arXiv preprint arXiv:2410.02506, 2024. Luo et al. [2025] Haoxiang Luo, Gang Sun, Yinqiu Liu, Dongzhao Zhao, Dusit Niyato, Han Yu, and Schahram Dustdar. A weighted Byzantine fault tolerance consensus driven trusted multiple large language models network. arXiv preprint arXiv:2505.05103, 2025. Jo and Park [2025] Yongrae Jo and Chanik Park. Byzantine-robust decentralized coordination of LLM agents. arXiv preprint arXiv:2507.14928, 2025. Dolev et al. [1986] Danny Dolev, Nancy A. Lynch, Shlomit S. Pinter, Eugene W. Stark, and William E. Weihl. Reaching approximate agreement in the presence of faults. J. ACM, 33(3):499–516, May 1986. ISSN 0004-5411. doi:10.1145/5925.5931. Sundaram and Gharesifard [2019] Shreyas Sundaram and Bahman Gharesifard. Distributed optimization under adversarial nodes. IEEE Transactions on Automatic Control, 64(3):1063–1076, 2019. doi:10.1109/TAC.2018.2836919. Yuan and Ishii [2025] Liwei Yuan and Hideaki Ishii. Resilient distributed economic dispatch in smart grids. IEEE Transactions on Automatic Control, 2025. Xie et al. [2023] Yijing Xie, Shaoshuai Mou, and Shreyas Sundaram. Communication-efficient and resilient distributed q-learning. IEEE Transactions on Neural Networks and Learning Systems, 35(3):3351–3364, 2023. Ye et al. [2024] Lintao Ye, Martin Figura, Yixuan Lin, Mainak Pal, Pranoy Das, Ji Liu, and Vijay Gupta. Resilient multiagent reinforcement learning with function approximation. IEEE Transactions on Automatic Control, 69(12):8497–8512, 2024. doi:10.1109/TAC.2024.3409676. Lee and Panagou [2025] Haejoon Lee and Dimitra Panagou. Distributed resilience-aware control in multi-robot networks. pages 3868–3875, 2025. doi:10.1109/CDC57313.2025.11312021. Pirani et al. [2023] Mohammad Pirani, Aritra Mitra, and Shreyas Sundaram. Graph-theoretic approaches for analyzing the resilience of distributed control systems: A tutorial and survey. Automatica, 157:111264, 2023. ISSN 0005-1098. doi:https://doi.org/10.1016/j.automatica.2023.111264. Hendrycks et al. [2021] Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. Measuring mathematical problem solving with the MATH dataset. NeurIPS, 2021. Hu et al. [2023] Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee-Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Ka-Wei Lee. LLM-Adapters: An adapter family for parameter-efficient fine-tuning of large language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023. Clark et al. [2018] Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? Try ARC, the AI2 reasoning challenge. arXiv preprint arXiv:1803.05457, 2018. Zellers et al. [2019] Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence? In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, 2019. Clark et al. [2019] Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. BoolQ: Exploring the surprising difficulty of natural yes/no questions. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 2924–2936, 2019. doi:10.18653/v1/N19-1300. URL https://aclanthology.org/N19-1300/. Mihaylov et al. [2018] Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. Can a suit of armor conduct electricity? a new dataset for open book question answering. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2381–2391, 2018. doi:10.18653/v1/D18-1260. URL https://aclanthology.org/D18-1260/. Dagan et al. [2005] Ido Dagan, Oren Glickman, and Bernardo Magnini. The PASCAL recognising textual entailment challenge. In Machine Learning Challenges Workshop, pages 177–190. Springer, 2005. Lee and Panagou [2026] Haejoon Lee and Dimitra Panagou. Minimal construction of graphs with maximum robustness. arXiv preprint arXiv:2507.00415, 2026. v2, February 2026. Erdős and Rényi [1961] Paul Erdős and Alfréd Rényi. On the strength of connectedness of a random graph. Acta Mathematica Hungarica, 12(1-2):261–267, 1961. Zhang et al. [2015] Haotian Zhang, Elaheh Fata, and Shreyas Sundaram. A notion of robustness in complex networks. IEEE Transactions on Control of Network Systems, 2(3):310–320, 2015. Usevitch and Panagou [2020] James Usevitch and Dimitra Panagou. Determining r-and (r, s)-robustness of digraphs using mixed integer linear programming. Automatica, 111:108586, 2020. Appendix Appendix A Graph Topologies We evaluate our method on four graph topologies, which we describe below: • γ-MERGs Lee and Panagou [2026]: These graphs achieve maximum robustness, i.e., r=⌈n/2⌉r= n/2 , for a given number of nodes n, while using the minimal set of edges possible. We distinguish two cases for constructing a γ-MERG: – If n is odd: Let ⊂X be a set of γ+1γ+1 nodes forming a complete subgraph. Connect each of the remaining γ−1γ-1 nodes to any γ nodes in X. – If n is even: Let ⊂X be a set of γ nodes, each adjacent to all other nodes in V. Then select ⌈γ−22⌉ γ-22 disjoint pairs of nodes in X and remove the edge between each pair. By Theorem 1 of Lee and Panagou [2026], the resulting graph is ⌈n/2⌉ n/2 -robust. • Complete graphs: In this case, every agent is connected to every other agent. By Lemma 4 of LeBlanc et al. [2013], a complete graph with n nodes is r=⌈n/2⌉r= n/2 -robust. • Preferential-attachment graphs: To construct r-robust graphs, we first form a complete graph with 2r−12r-1 nodes. By Lemma 4 of LeBlanc et al. [2013], this subgraph is r-robust. The remaining n−2r+1n-2r+1 nodes are then each connected to any r nodes in the original set of nodes in the complete graph. By Theorem 5 of LeBlanc et al. [2013], the resulting graph is then r-robust. • Erdős–Rényi random graphs Erdős and Rényi [1961]: These graphs are parameterized by the number of nodes n and an edge probability p. The presence of each edge is independent of every other edge, and each edge is included independently with probability p. As shown in Theorem 3 of Zhang et al. [2015], choosing p=lnn+(r−1)lnlnnnp= n+(r-1) nn ensures that the graph is r-robust with high probability as n→∞n→∞. We sample graphs using this probability and verify r-robustness prior to simulation using the method from Usevitch and Panagou [2020]. Appendix B Prompt Templates We instantiate the receiver-side scoring function ϕi _i (Eq. (2)) and the refine operator (Eq. (5)) using the prompt templates below. We provide the prompts used for the sampled Hendrycks MATH (Level 4) experiments. For Commonsense170k, we use the same overall structure with minor modifications to the task instruction and answer format, as described in Section˜B.3. B.1 Scoring Prompt (ϕi _i) The scoring prompt instructs ℳiM_i to independently solve the query x, compare its own reasoning against rj(t)r_j^(t), and finally output a calibrated confidence score in [0,1][0,1]. This procedure makes si→j(t)s_i→ j^(t) a receiver-side evaluation: the score depends solely on ℳiM_i’s internal reasoning applied to the content of rj(t)r_j^(t), without relying on any confidence reported by agent j. System: You are an expert evaluator. Respond using only a single number. User: You are evaluating the correctness of a proposed answer to a mathematical reasoning problem. Assume that up to f responses may be malicious or unreliable. Reason carefully before producing the final score. Problem: x Proposed answer: rj(t)r_j^(t) Step 1: Solve the problem independently step by step. Step 2: Evaluate the proposed answer. Step 3: Output ONLY a single decimal number between 0.0 and 1.0. 0.0 = clearly incorrect, 0.5 = uncertain, 1.0 = clearly correct. Score: The first numeric token in ℳiM_i’s response is extracted using the regular expression ([0-9]+(?:\.[0-9]+)?) and clipped to the interval [0,1][0,1]. If parsing fails or the LLM returns an invalid response, the score defaults to si→j(t)=0.5s_i→ j^(t)=0.5, treating the response as maximally uncertain. The self-score si→i(t)=ϕi(x,ri(t))s_i→ i^(t)= _i(x,r_i^(t)) is computed using the same prompt with rj(t)r_j^(t) replaced by ri(t)r_i^(t). B.2 Refine Prompt (Eq. (5)) The refine prompt provides ℳiM_i with its current response ri(t)r_i^(t) together with the retained neighbor responses (rj(t),si→j(t))j∈ℛi(t)\(r_j^(t),s_i→ j^(t))\_j _i^(t), sorted in descending order of reliability score. The instruction “Prefer answers with higher reliability scores, but retain your current answer if you believe it is correct” serves as the natural-language realization of Eq. (5), encouraging ℳiM_i to prioritize highly scored neighbor responses while preserving its own response as an anchor when appropriate. System: You are a helpful assistant. Follow the required output format exactly. User: You are solving a mathematical reasoning problem. Review the information below and provide your best answer. Assume that up to f responses may be malicious or unreliable. Reason carefully before producing the final answer. Problem: x Your current answer: ri(t)r_i^(t) Other agents’ answers with reliability scores (higher indicates greater reliability): - Answer: rj1(t)r_j_1^(t) (reliability score: si→j1(t)s_i→ j_1^(t)) - Answer: rj2(t)r_j_2^(t) (reliability score: si→j2(t)s_i→ j_2^(t)) … (sorted in descending order of score, jk∈ℛi(t)j_k _i^(t)) Prefer answers with higher reliability scores, but retain your current answer if you believe it is correct. Respond using the format: Answer: [your numerical answer] Reliability scores are formatted to two decimal places. The retained set ℛi(t)R_i^(t) is computed prior to rendering the prompt, so neighbors removed by bottomF(⋅)bottom_F(·) never appear in the refinement stage. If ℛi(t)=∅R_i^(t)= , the refinement step is skipped and ri(t+1)=ri(t)r_i^(t+1)=r_i^(t). The final numerical answer is extracted using a dataset-specific parser; if extraction fails, the update again defaults to ri(t+1)=ri(t)r_i^(t+1)=r_i^(t). B.3 Commonsense170k Prompt Adaptation Since the sampled Commonsense170k instances span heterogeneous formats, including true/false, multiple-choice, and sentence-completion tasks, we replace the math-specific wording with a question-agnostic formulation. In particular, “mathematical reasoning problem” is replaced with “question”, and the answer-format instruction becomes Respond strictly using the answer format specified in the question. Answer: [your answer]. The receiver-side scoring procedure and descending-score neighbor presentation remain unchanged. B.4 Byzantine Agent Behavior Adversarial Byzantine agents (Section 5) bypass both prompting procedures. At each round t, they (i) broadcast a cached weak-model response generated from an out-of-distribution query, and (i) report a falsified self-confidence score of 1.01.0 when interacting with confidence-based baselines such as CP-WBFT [Zheng et al., 2026]. This simulates a strong dishonest-confidence attack while remaining indistinguishable from honest agents at the message level. In contrast, faulty Byzantine agents follow the same prompting pipeline as reliable agents, and produce unreliable outputs solely due to the limited capability of the underlying weak model. Appendix C Experimental Setup C.1 Dataset for Closed-source LLMs We list the sampled problems used in the closed-source GPT API experiments reported in Tables 1 and 2, including 100 sampled Hendrycks MATH (Level 4) instances and 30 sampled Commonsense170k instances. Each row reports the dataset-specific question identifier (qid), an abbreviated version of the question, and the ground-truth answer y⋆y . Full problem statements can be retrieved using the corresponding qid from the original public releases. C.1.1 Hendrycks MATH (Level 4) The 100 sampled instances span the seven question categories present in Hendrycks MATH Level 4. We group rows by category for readability. These problems correspond to the Hendrycks MATH experiments in Tables 1 and 2, where gpt-4o-mini and gpt-3.5-turbo are used as the strong and weak models, respectively. C.1.2 Commonsense170k The 30 sampled Commonsense170k instances span four question formats: true/false, two-option pronoun resolution, multiple-choice reasoning, and sentence completion. We group the examples by format. For non-true/false questions, the answer choices are listed below the question statement, and the ground-truth label corresponds to the option identifier in the original dataset. These problems correspond to the Commonsense170k experiments in Tables 1 and 2, where gpt-5 and gpt-4o are used as the strong and weak models, respectively. qid Question y⋆y Algebra 32448964 Value of K for which 6x+4y=7,Kx+8y=76x+4y=7,\ Kx+8y=7 has no solution 12 57cbe0b7 Solve (12x+12)(3x−6)=4(x+3)+x−34( 12x+12)( 3x-6)=4(x+3)+x-34 50 984a9fb8 Express g4+12g2+9=c(g2+p)2+qg^4+12g^2+9=c(g^2+p)^2+q; find q −27-27 b0969f24 Piecewise f with f(−4)=−60/13f(-4)=-60/13, f(4)=3120f(4)=3120; find a+ba+b 28 d026abb8 Integer x in arithmetic sequence 32,x, 343^2,\,x,\,3^4 45 9b18dfb Minimum of |x−1|+|x−1.5|+|x−2||x-1|+|x-1.5|+|x-2| over x∈ℝx 1 Intermediate Algebra 40c817f logyx+logxy=7 _yx+ _xy=7; find (logyx)2+(logxy)2( _yx)^2+( _xy)^2 47 b3f26b98 Piecewise f invertible; find k 1 b11209a5 Geometric sequence with a5−a4=576a_5-a_4=576, a2−a1=9a_2-a_1=9; sum ∑i=15ai _i=1^5a_i 1023 10aef5c7 Count of n<1000n<1000 such that ⌊log2n⌋ _2n is a positive even integer 340 Prealgebra 2de720d4 Number of times the digit 6 appears in integers from 1 to 100 20 b6a36467 Smallest integer >2>2 that leaves remainder 2 modulo 3, 4, 5, 6 62 34e64136 Five tests scored 87, 85, 87; last two differ by 3 with average 90; find max 97 f3b85d7a Number of even perfect cubes less than 2008 6 c740506c Box nesting: 4 large × 3 medium × 2 small; total number of boxes 40 e067503f Unit conversion: 6 wallops == 5 ballops, 3 ballops == 11 fallops; wallops for 110 fallops 36 7bfcd56a First odd year after 2006 whose digits split into 3-digit and 1-digit groups with common factor >1>1 2013 Number Theory a10973bf Smallest integer with exactly 16 divisors, including 12 and 15 120 27b01b01 Base-7 cryptarithm AB¯7+BA¯7=AA0¯7 AB_7+ BA_7= A0_7; product A⋅BA· B 6 583c9eaf Number of even positive divisors of 252 12 37bab629 Count of n∈[1,29]n∈[1,29] for which n/30n/30 has a repeating decimal expansion 20 Counting & Probability 0a3e457d 20-member club, 3 distinct officers, with constraint Alex serves only if Bob does not 6732 d790474f Jar with 4 red, 2 white marbles; swap-and-sample procedure; P(red)=11/18P(red)=11/18 11/1811/18 b98d41f7 Coefficient of x2y2x^2y^2 in (x+y)4+(x+2y)4(x+y)^4+(x+2y)^4 30 03694fa9 120 triangles formed by n vertices on a base; find n 16 33b5135e 10-member chess club, 900 games played; find N games per pair 20 e5787bf4 Distinct bracelets with 5 distinct beads under rotation and reflection equivalence 12 Geometry 1efe044e Maximum volume (cm3) when right △ with legs 3, 43,\,4 rotated about a leg 50 de4ec0fd Isosceles △ with AB=AC=14AB=AC=14, BC=26BC=26; shortest angle bisector 833/38 33/3 Precalculus 16be6141 =proj+projv=proj_av+proj_bv for all v; find ⋅a·b 0 Table 7: Sampled Hendrycks MATH Level 4 problems used in our experiments, grouped by category. The table shows 30 representative examples from the 100 sampled instances used throughout the evaluation. These problems are additionally used in the ablation experiments reported in Tables 5 and 6. The question column gives an abbreviated statement; full problem text is recoverable from the public Hendrycks MATH release via the qid. qid Question (and choices, where applicable) y⋆y True/False 50816f9e Is there a season 3 of Wrecked? true 4ba7682f Does Las Vegas have a professional football team? true 17f50271 Can a person be jailed for civil contempt of court? true 4d7cce65 Has Maroon 5 ever performed at a Super Bowl? true 84e37998 Is I Know Why the Caged Bird Sings a memoir? true 4b2e906 Is Varsity Blues based on a true story? false 433f24bc Does it count if you hit the backboard on a free throw? true b4c59e Can you remove the venom glands from a snake? true 0c7abae6 Is the Statue of Liberty in New Jersey? false a461f8a8 Can you send a letter without a return address? true f448271b Is it illegal to pass on a solid yellow line? false 28225993 Can you score an own goal from a direct free kick? true 90b6886c Do red, yellow, and orange peppers taste different? true a03e3147 Is there a fifth season of Mom? true 07250c0c Are The Five Heartbeats based on a real group? false Two-option pronoun resolution 263ebb80 Embroidery: when threading the needle, the _ was too thick. Choices: (option1) needle; (option2) floss. option2 c3a49074 “Felicia asked Katrina about new technology because _ was interested.” Choices: (option1) Felicia; (option2) Katrina. option1 60091082 Movers wanted to store the boxes in the offices, but the _ were too small. Choices: (option1) offices; (option2) boxes. option1 2e8510fe Elena loves to read books but Jessica does not; _ bought videos all the time. Choices: (option1) Elena; (option2) Jessica. option2 08a09099 The public elected Jason over Randy, because _ delivered a less persuasive speech. Choices: (option1) Jason; (option2) Randy. option2 Multiple choice 11a364a Addison spent a month of lunches and finally found Carson a place; how would you describe Addison? Choices: (answer1) helpful; (answer2) meanspirited; (answer3) selfish. answer1 bd59d9db Austin got a PS4 Pro and bought a new TV; what will Austin want to do next? Choices: (answer1) play his new game console; (answer2) return the TV; (answer3) go watch a movie at the theatre. answer1 2ce5f4f0 From which part of the plant does a bee get food? Choices: (answer1) flower; (answer2) seed; (answer3) stem; (answer4) root. answer1 612a4066 Remy came up behind Jan and pushed her in the back very hard; how would you describe Remy? Choices: (answer1) physical; (answer2) ready to fight Jan; (answer3) very hostile towards Jan. answer3 0cd100f4 The best way to improve future production yields on the farm is… Choices: (answer1) planting cabbage one year and spinach the next; (answer2) chemical fertilizers and salts; (answer3) rotating water schedules daily; (answer4) over-watering each field. answer1 25040642 How do you treat period cramps? Choices: (solution1) drink some coffee; (solution2) take some Midol. solution2 e3abe29 Paper towel: what is it good for? Choices: (solution1) clean telescope; (solution2) operate telescope. solution1 Sentence completion 3abb847a “How to start a giving fund” — after opening a bank account, what naturally follows? Choices: (ending1) choose checking vs. savings depending on payment frequency; (ending2) a separate account protects you from debt; (ending3) set up a line for the bank’s payout the day before your event; (ending4) it isn’t complicated — consult an individual bank. ending1 873e845e Javelin throw scene: as the man releases the javelin, in the background… Choices: (ending1) bleachers in the background, hot and sunny day; (ending2) large crowd standing around, kites flying; (ending3) a big splash, the man runs to rescue it; (ending4) another man in a black t-shirt easily catches it. ending1 e47d4d28 Drumming and piano duet: a child drums while a woman plays piano along; they… Choices: (ending1) continue playing the drums and the music; (ending2) have a small audience watching them perform; (ending3) play till there is no longer a fist drumming in the background; (ending4) play and sing along intently for joy. ending2 Table 8: Sampled Commonsense170k problems used in our experiments, grouped by format. These problems correspond to the closed-source commonsense reasoning experiments reported in Tables 1 and 2, where gpt-5 and gpt-4o are used as the strong and weak models, respectively. Each instance preserves its native answer format, and ground-truth answers are reported using the corresponding label as released. For multi-option items, we list the choices in the question column. C.2 Dataset for Open-weight LLMs For the open-weight LLM experiments, we evaluate on five commonsense reasoning benchmarks: ARC-Challenge, HellaSwag, BoolQ, OpenBookQA, and RTE. From each benchmark, we randomly sample 50 questions, resulting in a total of 250 evaluation instances used throughout the experiments. These benchmarks cover a range of reasoning settings, including commonsense inference, scientific reasoning, natural language understanding, and multiple-choice question answering. All experiments use Qwen3-4B as the strong model and Qwen2.5-1.5B-Instruct as the weak model. Appendix D Additional Experimental Results In this section, we report benchmark-level and per-round results for the open-weight LLM experiments summarized in Section 5.3.2. Tables 9 and 10 expand the averaged results reported in Tables 3 and 4. Per-benchmark robustness. Across all five benchmarks and all evaluated topologies, SAC achieves non-negative BFTI on four of the five benchmarks, with improvements of up to +10.3%+10.3\% on OpenBookQA and consistent gains on ARC-Challenge, HellaSwag, and BoolQ. On RTE, where the initial strong-agent accuracy is already relatively high (S IAA ≈84%≈ 84\%), SAC still maintains H-Majority around 82%82\% across all topologies while avoiding the large degradation observed in CP-WBFT. By contrast, CP-WBFT consistently produces strongly negative BFTI across benchmarks and topologies, with particularly severe degradation on HellaSwag and OpenBookQA. The largest gap appears on OpenBookQA under the Complete topology, where CP-WBFT yields strongly negative BFTI while SAC achieves over +10%+10\% improvement. Overall, these results suggest that SAC’s receiver-side evaluation generalizes robustly across benchmarks with substantially different reasoning formats and difficulty levels. Per-group behavior. The per-group accuracies reported in Table 9 show that SAC consistently preserves or improves strong-agent accuracy while broadly maintaining weak-agent performance. Representative examples include 47→62%47→ 62\% on HellaSwag with Erdős–Rényi, 60→77%60→ 77\% on OpenBookQA with MERG, and 72→78%72→ 78\% on ARC-Challenge with MERG. Under CP-WBFT, the corresponding strong-group accuracies collapse to substantially lower values, often near random-guessing performance on the harder multiple-choice benchmarks. Weak-agent accuracy under SAC is also largely preserved, with several settings showing modest gains (e.g., OpenBookQA and BoolQ), whereas CP-WBFT frequently degrades both weak and strong groups simultaneously. H-Majority follows the same trend: SAC consistently maintains substantially higher honest-majority correctness across all benchmarks and topologies, while CP-WBFT often collapses despite the honest agents forming a clear majority in the network. Per-round dynamics. Table 10 reports per-round weak/strong accuracies. Under SAC, strong-agent accuracy typically improves within the first one or two communication rounds and then remains stable through round 6. For example, strong-agent accuracy increases from 49.0→60.0%49.0→ 60.0\% on HellaSwag with MERG and from 60.0→79.0%60.0→ 79.0\% on OpenBookQA with MERG. Weak-agent accuracy is largely preserved throughout the refinement process, with only small fluctuations across rounds. On BoolQ, strong-agent accuracy oscillates between roughly 83%83\% and 89%89\% across rounds in a pattern that appears consistently across topologies, likely reflecting the binary nature of the task. In contrast, CP-WBFT collapses immediately after the first communication round and exhibits little recovery thereafter, so we aggregate rounds 1–6 into a single row. Averaged across benchmarks and topologies, SAC improves final-round strong-agent accuracy by roughly 3030 percentage points compared to CP-WBFT. Effect of topology. SAC exhibits relatively small performance variation across topologies within the same benchmark. For example, FAA differs by only a few percentage points across topologies on ARC-Challenge, HellaSwag, and BoolQ. In contrast, CP-WBFT shows substantially larger instability depending on the graph structure, particularly on HellaSwag and OpenBookQA, where FAA varies dramatically across topologies while remaining consistently poor overall. This relatively small across-topology variance of SAC is consistent with our theoretical analysis, where the qualitative robustness of SAC primarily depends on satisfying the (F+1)(F+1)-robustness condition rather than the specific topology construction. Dataset Method Topology IAA FAA BFTI RA W IAA→ S IAA→ H-Maj. ARC-Challenge CP-WBFT MERG 58.0 47.4 −-10.6 46.0 58→ 60 72→ 53 46.0 Complete 58.0 37.7 −-20.3 44.0 58→ 44 72→ 44 44.0 Erdős–Rényi 58.0 39.4 −-18.6 46.0 58→ 44 72→ 47 46.0 SAC (Ours) MERG 58.0 60.6 ++2.6 82.0 58→ 57 72→ 78 82.0 Complete 59.1 62.9 ++3.7 82.0 58→ 59 74→ 80 82.0 Erdős–Rényi 58.0 59.1 ++1.1 74.0 58→ 57 72→ 75 74.0 HellaSwag CP-WBFT MERG 42.0 21.7 −-20.3 16.0 52→ 31 48→ 22 16.0 Complete 43.1 13.7 −-29.4 16.0 52→ 16 50→ 16 16.0 Erdős–Rényi 43.4 14.0 −-29.4 16.0 53→ 17 50→ 16 16.0 SAC (Ours) MERG 43.1 48.6 ++5.4 60.0 53→ 50 49→ 60 60.0 Complete 42.0 48.0 ++6.0 58.0 53→ 51 47→ 58 58.0 Erdős–Rényi 41.7 49.4 ++7.7 62.0 52→ 49 47→ 62 62.0 BoolQ CP-WBFT MERG 71.7 55.7 −-16.0 58.0 83→ 68 84→ 64 58.0 Complete 71.4 48.0 −-23.4 56.0 83→ 56 84→ 56 56.0 Erdős–Rényi 71.4 46.3 −-25.1 56.0 83→ 53 84→ 54 56.0 SAC (Ours) MERG 72.3 73.4 ++1.1 90.0 83→ 78 85→ 90 92.0 Complete 70.9 73.1 ++2.3 88.0 83→ 79 82→ 88 88.0 Erdős–Rényi 71.4 72.9 ++1.4 88.0 83→ 79 84→ 88 90.0 OpenBookQA CP-WBFT MERG 54.0 31.4 −-22.6 24.0 66→ 43 62→ 34 24.0 Complete 54.0 18.9 −-35.1 22.0 66→ 22 62→ 22 22.0 Erdős–Rényi 54.0 20.6 −-33.4 24.0 66→ 23 62→ 24 24.0 SAC (Ours) MERG 53.1 63.4 ++10.3 76.0 66→ 68 60→ 77 76.0 Complete 54.0 64.3 ++10.3 78.0 66→ 70 62→ 78 78.0 Erdős–Rényi 54.0 64.0 ++10.0 78.0 66→ 69 62→ 78 78.0 RTE CP-WBFT MERG 69.1 56.3 −-12.9 56.0 74→ 71 84→ 63 56.0 Complete 69.1 48.0 −-21.1 56.0 74→ 56 84→ 56 56.0 Erdős–Rényi 69.1 45.1 −-24.0 56.0 74→ 51 84→ 54 56.0 SAC (Ours) MERG 69.1 65.7 −-3.4 82.0 74→ 68 84→ 81 82.0 Complete 69.1 66.3 −-2.9 80.0 74→ 71 84→ 80 82.0 Erdős–Rényi 69.7 66.9 −-2.9 82.0 74→ 69 85→ 82 82.0 Table 9: Full benchmark-level results corresponding to the averaged open-weight LLM results reported in Table 3. We report per-dataset comparisons of CP-WBFT and SAC across three (F+1)(F+1)-robust communication topologies on five commonsense reasoning benchmarks (50 questions each). Each network contains n=7n=7 agents (4 strong honest, 2 weak honest, 1 adversarial Byzantine, F=3F=3, r=4r=4). Qwen3-4B and Qwen2.5-1.5B-Instruct are used as the strong and weak models, respectively. W IAA→ and S IAA→ denote per-agent accuracy of the weak and strong honest groups before and after consensus; H-Majority is the fraction of queries for which the majority answer among the honest agents matches the ground truth at the final round. Dataset Method Round MERG (W/S) Complete (W/S) Erdős–Rényi (W/S) ARC-C CP-WBFT Init 58.0 / 72.5 58.0 / 72.5 58.0 / 72.5 Rnd 1-6 60.0 / 53.0 44.0 / 44.0 44.0 / 47.0 SAC (Ours) Init 58.0 / 72.5 58.0 / 74.5 58.0 / 72.5 Rnd 1 57.0 / 78.0 57.0 / 81.0 57.0 / 78.0 Rnd 2 58.0 / 79.5 58.0 / 80.5 57.0 / 76.0 Rnd 3 58.0 / 79.0 57.0 / 80.5 57.0 / 76.0 Rnd 4 58.0 / 78.5 59.0 / 80.5 57.0 / 75.0 Rnd 5 58.0 / 77.0 57.0 / 80.5 57.0 / 74.5 Rnd 6 57.0 / 77.5 59.0 / 80.5 57.0 / 75.0 HellaSwag CP-WBFT Init 52.0 / 47.5 52.0 / 49.5 53.0 / 49.5 Rnd 1-6 31.0 / 22.5 16.0 / 16.0 17.0 / 16.0 SAC (Ours) Init 53.0 / 49.0 53.0 / 47.0 52.0 / 47.0 Rnd 1 50.0 / 58.5 51.0 / 56.5 49.0 / 57.5 Rnd 2 50.0 / 60.0 51.0 / 58.5 49.0 / 61.0 Rnd 3 50.0 / 60.0 51.0 / 58.5 49.0 / 62.5 Rnd 4 50.0 / 60.0 51.0 / 58.5 49.0 / 62.0 Rnd 5 50.0 / 60.0 51.0 / 58.5 49.0 / 62.0 Rnd 6 50.0 / 60.0 51.0 / 58.5 49.0 / 62.0 BoolQ CP-WBFT Init 83.0 / 84.0 83.0 / 83.5 83.0 / 83.5 Rnd 1-6 68.0 / 63.5 56.0 / 56.0 53.0 / 54.5 SAC (Ours) Init 83.0 / 85.0 83.0 / 82.5 83.0 / 83.5 Rnd 1 67.0 / 79.0 61.0 / 79.5 64.0 / 80.0 Rnd 2 79.0 / 89.5 76.0 / 89.5 80.0 / 87.5 Rnd 3 70.0 / 83.5 64.0 / 83.5 65.0 / 85.5 Rnd 4 79.0 / 88.0 79.0 / 89.5 80.0 / 86.5 Rnd 5 70.0 / 83.0 66.0 / 85.5 66.0 / 83.0 Rnd 6 78.0 / 89.5 79.0 / 88.5 79.0 / 88.0 OBQA CP-WBFT Init 66.0 / 61.5 66.0 / 61.5 66.0 / 61.5 Rnd 1-6 43.0 / 33.5 22.0 / 22.0 23.0 / 24.5 SAC (Ours) Init 66.0 / 60.0 66.0 / 61.5 66.0 / 61.5 Rnd 1 66.0 / 81.0 68.0 / 79.5 65.0 / 74.0 Rnd 2 68.0 / 79.0 70.0 / 79.0 68.0 / 75.5 Rnd 3 68.0 / 78.0 70.0 / 77.5 69.0 / 76.0 Rnd 4 68.0 / 77.5 70.0 / 77.5 69.0 / 77.0 Rnd 5 68.0 / 77.5 70.0 / 77.5 69.0 / 77.5 Rnd 6 68.0 / 77.0 70.0 / 77.5 69.0 / 77.5 RTE CP-WBFT Init 74.0 / 84.0 74.0 / 84.0 74.0 / 84.0 Rnd 1-6 71.0 / 63.0 56.0 / 56.0 51.0 / 53.5 SAC (Ours) Init 74.0 / 84.0 74.0 / 84.0 74.0 / 85.0 Rnd 1 68.0 / 74.5 71.0 / 77.5 71.0 / 79.5 Rnd 2 69.0 / 80.0 71.0 / 80.5 70.0 / 80.0 Rnd 3 68.0 / 78.0 71.0 / 78.0 69.0 / 81.5 Rnd 4 68.0 / 80.0 71.0 / 80.5 69.0 / 82.0 Rnd 5 69.0 / 78.5 71.0 / 77.0 69.0 / 81.0 Rnd 6 68.0 / 81.0 71.0 / 80.5 69.0 / 82.5 Table 10: Benchmark-level per-round results corresponding to the averaged open-weight LLM results reported in Table 4. We report per-round weak / strong honest accuracy (W/S, in %) across three (F+1)(F+1)-robust communication topologies on five commonsense reasoning benchmarks (50 questions each). Each cell shows the average accuracy of the weak honest group (Qwen2.5-1.5B-Instruct, 2 agents) and the strong honest group (Qwen3-4B, 4 agents) at the corresponding round under n=7n=7 agents and F=3F=3.