ai-research-survey

scan.json (21654B)

---

 {
   "paper": {
     "title": "Beyond Single-Agent Safety: A Taxonomy of Risks in LLM-to-LLM Interactions",
     "authors": [
       "P. Bisconti",
       "M. Galisai",
       "F. Pierucci",
       "M. Bracale",
       "M. Prandi"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.02682",
     "doi": "10.48550/arXiv.2512.02682"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository, URL, or software artifact is mentioned anywhere in the paper. The paper is purely conceptual but could have released taxonomy data or analysis scripts."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No dataset or structured data artifact is released. The taxonomy tables are presented only within the paper text. A machine-readable version of the taxonomy could have been provided."
       },
       "environment_specified": {
         "applies": false,
         "answer": false,
         "justification": "This is a purely theoretical/conceptual paper with no computational experiments, so environment specifications are structurally inapplicable."
       },
       "reproduction_instructions": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted, so reproduction instructions are structurally inapplicable. The paper is a conceptual framework proposal."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "No experiments or quantitative results are reported. This is a theoretical framework paper with no empirical data."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "No comparative claims based on empirical data are made. The paper proposes a conceptual taxonomy, not experimental results."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No empirical measurements or effect sizes are relevant to a purely theoretical taxonomy paper."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "No samples or data collection of any kind. This is a theoretical paper."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experimental runs or quantitative measurements. Purely conceptual work."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly positions its contribution against two prior works: MAST (Multi-Agent System failure Taxonomy, [3]) and MARAI (Multi-Agent Risks from Advanced AI, [6]). Section 1.2 describes how the paper extends and unifies these approaches."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Both comparison frameworks are from 2025: MAST (Cemri et al., 2025) and MARAI (Hammond et al., 2025), which are contemporary works."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "The paper proposes a conceptual taxonomy, not a system with components to ablate."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No evaluation metrics are used. The paper proposes metrics (contagion velocity, misalignment diffusion, intent-opacity rate, goal drift) but does not measure them."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs are produced that could be evaluated by humans. This is a conceptual framework paper."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No data or benchmarks are used. Purely theoretical work."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "The taxonomy itself provides a structured breakdown across three levels (micro, meso, macro) with detailed risk types at each level (Tables 1-3), each with descriptions and observable effects."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The entire paper is about failure modes. Tables 1-3 enumerate specific failure cases (semantic drift, prompt infection, false consensus, collusion, polarization, etc.) with descriptions and observable effects."
       },
       "negative_results_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted, so there are no positive or negative experimental results to report."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims three contributions: (i) a theoretical account of collective risk, (ii) a taxonomy connecting micro/meso/macro failure modes, and (iii) a design proposal for Institutional AI. All three are delivered in Sections 2-4 respectively, though they are conceptual rather than empirically validated."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes implicit causal claims throughout, e.g., 'local compliance can aggregate into collective failure' (abstract), 'feedback loops that can magnify subtle deviations' (Section 1.1.1). These causal mechanisms are asserted based on analogy to multi-agent systems literature and a few cited empirical examples, but no causal evidence is presented for LLM-to-LLM settings specifically. The paper acknowledges this: 'experimental validation will follow' (Section 3.1)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper is careful to bound its claims. Section 3.2 states 'This taxonomy is conceptual and preliminary. Its function is not to claim empirical closure but to establish a common language.' Section 3.1 describes its dimensions as 'a working basis rather than an exhaustive set.' Section 4.3 explicitly positions the work as a 'starting point' requiring validation."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative frameworks or explanations for the phenomena it describes. It draws on multi-agent systems literature but does not discuss whether existing game theory, systems engineering, or distributed computing frameworks might already address these risks without the new ESRH concept. No alternative explanations for the cited empirical observations (e.g., collusion in auctions) are considered."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "No models are used in experiments. The paper is purely conceptual."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "No prompting is done. This is a theoretical framework paper."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted, so no hyperparameters are relevant."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is implemented. The paper discusses scaffolding conceptually but does not build or test any system."
       },
       "data_preprocessing_documented": {
         "applies": false,
         "answer": false,
         "justification": "No data is collected or processed. This is a purely theoretical paper."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section. The paper repeatedly notes that 'experimental validation will follow' (Sections 3.1, 4.3, 5) but does not consolidate limitations into a dedicated section."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to the validity of the proposed taxonomy are discussed. The paper does not address whether the three-tier structure might miss important risk categories, whether the dimensions are sufficient, or whether the proposed metrics would actually capture the phenomena."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states scope boundaries in multiple places. Section 3.2: 'This taxonomy is conceptual and preliminary.' Section 3.1: 'They are intended as a working basis rather than an exhaustive set, and additional dimensions may be introduced as experiments advance.' Section 4.2: mechanisms are 'deliberately abstract: they describe the functions required for internal governance, not yet their concrete implementation.' Section 5: 'This work is a starting point.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": false,
         "answer": false,
         "justification": "No data is collected. This is a purely theoretical paper proposing a conceptual framework."
       },
       "data_collection_described": {
         "applies": false,
         "answer": false,
         "justification": "No data collection takes place. The paper is a theoretical framework proposal."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No participants or data samples are recruited. Purely conceptual work."
       },
       "data_pipeline_documented": {
         "applies": false,
         "answer": false,
         "justification": "No data pipeline exists. The paper presents a conceptual taxonomy without empirical data."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is mentioned anywhere in the paper. There is no acknowledgments section disclosing grants or funding sources."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: DEXAI – Icaro Lab, Sapienza University of Rome, and Sant'Anna School of Advanced Studies. The paper does not evaluate any product from these organizations."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Funding is not disclosed at all. Without knowing the funding source, independence cannot be assessed. The absence of a funding disclosure is itself a gap."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "No pre-trained model is evaluated on any benchmark. The paper is a theoretical framework proposal."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "No models are evaluated on benchmarks, so train/test overlap is structurally inapplicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No benchmarks are used. Purely conceptual work."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. This is a theoretical framework paper."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "No method is implemented or run. This is a purely theoretical/conceptual paper, so cost reporting is inapplicable."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "No computation is performed. Purely conceptual work."
       }
     }
   },
   "claims": [
     {
       "claim": "Safety mechanisms designed for single-agent human-model interaction do not scale to LLM-to-LLM environments where outputs are recursively reused as inputs.",
       "evidence": "Section 1.1.1 cites JAILJUDGE benchmark showing multi-agent evaluation alters jailbreak success rates [8], and market-simulation experiments showing independently aligned agents spontaneously coordinate to supracompetitive equilibria [1,5]. However, these are third-party citations, not original experiments.",
       "supported": "moderate"
     },
     {
       "claim": "The ESRH framework formalizes how instability arises from interaction structure rather than isolated misbehavior, through three dimensions: interaction topology, cognitive opacity, and objective divergence.",
       "evidence": "Section 3.1 defines these three dimensions with proposed metrics (contagion velocity, misalignment diffusion, intent-opacity rate, goal drift). The framework is conceptually presented but not empirically validated. Section 3.2 explicitly acknowledges the taxonomy is 'conceptual and preliminary.'",
       "supported": "weak"
     },
     {
       "claim": "A three-tier taxonomy (micro, meso, macro) captures the progression from localized deviations to system-wide pathologies in multi-agent LLM systems.",
       "evidence": "Tables 1-3 present the taxonomy with 16 risk types across three levels, each with descriptions and observable effects. The taxonomy synthesizes MAST [3] and MARAI [6] frameworks. No empirical evidence is provided that these tiers actually correspond to distinct failure regimes.",
       "supported": "weak"
     },
     {
       "claim": "Institutional AI—embedding adaptive oversight, peer evaluation, and functional differentiation within multi-agent systems—can manage emergent collective risks.",
       "evidence": "Section 4 proposes the concept at an abstract level, describing three mechanisms (adaptive collective policy, peer evaluation and weighting, functional differentiation). No implementation, simulation, or evidence is provided. Section 4.3 states 'Later work will examine how these can be instantiated.'",
       "supported": "unsupported"
     }
   ],
   "methodology_tags": [
     "theoretical"
   ],
   "key_findings": "This paper argues that single-agent safety mechanisms (prompt engineering, RLHF, output moderation) are insufficient for multi-agent LLM ecosystems where feedback loops, imitation, and emergent coordination create systemic risks. It introduces the Emergent Systemic Risk Horizon (ESRH) framework with three dimensions (interaction topology, cognitive opacity, objective divergence) and a 16-risk-type taxonomy across micro, meso, and macro levels. It proposes Institutional AI as a governance architecture embedding adaptive oversight within multi-agent systems. The entire contribution is conceptual—no experiments, simulations, or empirical validation are presented.",
   "red_flags": [
     {
       "flag": "No empirical validation",
       "detail": "The paper proposes a taxonomy and framework but provides zero empirical evidence. All claimed risk types and mechanisms are asserted based on analogy and citation of third-party work, not demonstrated in any controlled setting. The paper repeatedly defers validation to 'future work.'"
     },
     {
       "flag": "Proposed metrics are undefined operationally",
       "detail": "The paper introduces metrics like 'contagion velocity', 'misalignment diffusion', 'intent-opacity rate', and 'goal drift' but provides no formal definitions, measurement procedures, or demonstrations of how they would be computed in practice."
     },
     {
       "flag": "No limitations section",
       "detail": "Despite being a conceptual framework paper, there is no dedicated discussion of limitations, alternative frameworks, or potential weaknesses of the proposed taxonomy. The paper does not consider whether existing systems engineering or distributed computing frameworks already address these risks."
     },
     {
       "flag": "Claims outrun evidence for Institutional AI",
       "detail": "Section 4 proposes 'Institutional AI' as a governance solution but provides only abstract mechanism descriptions with no implementation, formal analysis, or evidence of feasibility. The proposal is presented as a contribution but remains entirely speculative."
     }
   ],
   "cited_papers": [
     {
       "title": "Evaluating LLM agent collusion in double-auctions",
       "authors": ["K. Agrawal", "V. Teo", "J.J. Vazquez", "S. Kunnavakkam", "V. Srikanth", "A. Liu"],
       "year": 2025,
       "arxiv_id": "2507.01413",
       "relevance": "Empirical study of emergent collusion behavior in LLM agents, directly relevant to multi-agent safety risks."
     },
     {
       "title": "Why Do Multi-Agent LLM Systems Fail?",
       "authors": ["M. Cemri", "M.Z. Pan", "S. Yang", "L.A. Agrawal", "B. Chopra", "R. Tiwari"],
       "year": 2025,
       "arxiv_id": "2503.13657",
       "relevance": "MAST taxonomy of multi-agent system failures, directly relevant to understanding agentic AI reliability."
     },
     {
       "title": "AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviors",
       "authors": ["W. Chen", "Y. Su", "J. Zuo", "C. Yang", "C. Yuan", "C. Chan"],
       "year": 2024,
       "arxiv_id": "2308.10848",
       "relevance": "Multi-agent collaboration framework demonstrating emergent behaviors in LLM collectives."
     },
     {
       "title": "Algorithmic collusion by large language models",
       "authors": ["S. Fish", "Y.A. Gonczarowski", "R.I. Shorrer"],
       "year": 2024,
       "arxiv_id": "2404.00806",
       "relevance": "Empirical evidence of LLM agents spontaneously forming collusive strategies in market settings."
     },
     {
       "title": "Multi-Agent Risks from Advanced AI",
       "authors": ["L. Hammond", "A. Chan", "J. Clifton"],
       "year": 2025,
       "arxiv_id": "2502.14143",
       "relevance": "MARAI framework for multi-agent risks, a key comparison point for taxonomies of agentic AI safety."
     },
     {
       "title": "CAMEL: Communicative agents for 'mind' exploration of large language models",
       "authors": ["G. Li", "H. Hammoud", "H. Itani", "D. Khizbullin", "B. Ghanem"],
       "year": 2023,
       "relevance": "Foundational multi-agent LLM communication framework relevant to understanding agentic collaboration patterns."
     },
     {
       "title": "JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework",
       "authors": ["F. Liu", "Y. Feng", "X. Zhao", "L. Su", "X. Ma", "D. Yin", "H. Liu"],
       "year": 2024,
       "arxiv_id": "2410.12855",
       "relevance": "Demonstrates that multi-agent evaluation alters jailbreak success rates, relevant to AI safety in multi-agent settings."
     },
     {
       "title": "AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation",
       "authors": ["Q. Wu", "G. Bansal", "J. Zhang", "Y. Wu", "B. Li", "E. Zhu"],
       "year": 2024,
       "relevance": "Major multi-agent LLM orchestration framework relevant to understanding agentic programming architectures."
     },
     {
       "title": "SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering",
       "authors": ["J. Yang", "C. Jimenez", "A. Wettig", "K. Lieret", "S. Yao", "K. Narasimhan", "O. Press"],
       "year": 2024,
       "relevance": "Agentic software engineering system with continuous learning loops, relevant to AI-augmented development evaluation."
     },
     {
       "title": "Voyager: An open-ended embodied agent with large language models",
       "authors": ["G. Wang", "Y. Xie", "Y. Jiang", "A. Mandlekar", "C. Xiao", "Y. Zhu", "L. Fan", "A. Anandkumar"],
       "year": 2023,
       "arxiv_id": "2305.16291",
       "relevance": "Open-ended LLM agent demonstrating continuous learning and task generation in interactive environments."
     }
   ]
 }