The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration

TL;DR

This paper introduces Token-Level Round-Robin Collaboration, a method that enhances multi-agent LLM robustness against adversarial majority attacks by interleaving token generation, supported by theoretical proofs and empirical results.

Contribution

It proposes a novel token-level interleaving approach that overcomes the limitations of response-level voting in multi-agent LLMs, backed by formal analysis and extensive experiments.

Findings

MAJ collapses under majority corruption in multi-agent LLMs

RR maintains high accuracy even with majority adversarial agents

Theoretical analysis shows token-level interleaving creates a non-linear logic chain

Abstract

Multi-agent large language model (LLM) architectures increasingly rely on response-level aggregation, such as Majority Voting (MAJ), to raise reasoning ceilings. However, in open environments, agents are highly susceptible to stealthy contextual corruption, such as targeted prompt injections. We reveal a critical structural vulnerability in current multi-agent systems: response-level aggregation collapses when corrupted agents form a local majority. Because voting aggregates fully-formed conclusions, it is blind to flawed intermediate logic. To overcome this systematic limitation, we propose the Token-Level Round-Robin (RR) Collaboration, where agents sequentially interleave generation within a shared auto-regressive context. We formalize this process as a discrete-time dynamical system, proving that token-level interleaving transitions aggregation from a brittle counting of final votes (a linear sum) to a dynamic, interwoven chain of logic (a non-linear operator product). Through this theoretical lens, we prove that the honest model's restorative pull can overpower adversarial corruptions, even when corrupted agents form a majority. We conduct an exhaustive empirical evaluation across diverse reasoning benchmarks and demonstrate that while MAJ collapses when corrupted agents reach a majority, RR maintains robust accuracy well beyond this critical threshold.