ai-research-survey

scan.json (25714B)

---

 {
   "paper": {
     "title": "Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerance",
     "authors": [
       "Lifan Zheng",
       "Jiawei Chen",
       "Qinghong Yin",
       "Jingyuan Zhang",
       "Xinyi Zeng",
       "Yu Tian"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2511.10400"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "LLM-based agents demonstrate stronger Byzantine fault tolerance than traditional agents, maintaining consensus even when 6 of 7 nodes are malicious (85.7% fault rate), exceeding the classical f < n/3 bound. The proposed CP-WBFT mechanism, particularly the Hidden-level Confidence Probe (HCP), achieves 100% round-level accuracy across all topologies under extreme Byzantine conditions. Network topology significantly impacts consensus effectiveness, with complete graphs enabling optimal performance while constrained topologies like chains limit it.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository link provided in the abstract: https://github.com/Z1ivan/Byzantine-Fault-Tolerance-in-LLM-MAS"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available benchmarks (GSM8K, XSTest, CommonsenseQA) and lists the exact questions used in Appendix Tables 4, 5, 7, 8, 9, 10."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment setup section is provided. Generation parameters are listed (Tables 6, 11) but not the full software environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The GitHub link is given but no README or reproduction guide is described."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1, 2, 17, 18 are point estimates with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims LLM-based agents 'outperform' traditional agents and HCP 'outperforms' PCP based solely on comparing numbers without any statistical tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "BFTI (Byzantine Fault Tolerance Improvement) is reported as the percentage improvement from IAA to FAA, providing context for the magnitude of improvement (e.g., '+85.71% BFTI from 14.29% baseline')."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Only 10 questions per dataset are used, described as 'specifically chosen to create a performance gap.' No justification for why 10 is sufficient, no power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be from single runs with a fixed seed (1234)."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Traditional agents serve as baselines in Table 1. PCP and HCP are compared against each other in Table 2. The paper also compares against the classical f < n/3 bound."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Models used include GPT-4o-mini, GPT-3.5-turbo, LLaMA3.1-8B-Instruct, and LLaMA3-8B-Instruct, all contemporary at time of writing."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 compares three extraction strategies (pooled, answer, query) across layers and models. PCP vs HCP comparison also serves as an ablation of the confidence probe approach."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics are used: IAA (Initial Agent Accuracy), FAA (Final Agent Accuracy), BFTI (Byzantine Fault Tolerance Improvement), and RA (Round-level Accuracy)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. No human evaluation of consensus quality, safety assessments, or mathematical reasoning outputs."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The 10 questions per dataset are specifically curated, but there is no separation into dev/test splits for the main evaluation. The HCP probe training uses train/test splits (Tables 14-16) but the system-level evaluation does not."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by network topology (7 topologies), task domain (GSM8K vs XSTest), and probe method (PCP vs HCP) in Tables 1, 2, 17, 18."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses PCP's negative BFTI on XSTest tree structures (-11.43%) and star-center-malicious configurations (-12.86%), noting 'PCP exhibits neutral or even negative BFTI on several XSTest topologies.'"
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "PCP shows negative BFTI on multiple XSTest topologies (Table 2b: tree -11.43%, star center malicious -12.86%, random -1.43%). These negative results are explicitly discussed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 85.7% fault rate tolerance, superior performance across topologies, and 'remarkable accuracy' — these are supported by Tables 1 and 2 showing HCP at 100% RA across topologies."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims LLM-based agents' 'superior reliability derives from advanced inherent reflective and discriminative capabilities' — this is a causal claim about mechanism, but the evidence is only correlational (LLM agents perform better on Byzantine tasks). The ablation of extraction strategies partially supports the probe design claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims to 'enhance the reliability of LLM-based agents' broadly, but tests only on 10 questions each from GSM8K and XSTest with specific model pairs. The title suggests general multi-agent system reliability, but results are limited to these narrow settings."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations. The 'malicious' agents are simply weaker models (GPT-3.5-turbo, LLaMA3), not truly adversarial. The performance gap could stem from model capability differences rather than Byzantine fault tolerance properties. This confound is not discussed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper equates model performance on 10 curated questions with 'Byzantine fault tolerance' and 'reliability' of multi-agent systems. Using weaker models as 'malicious/Byzantine' agents is a significant proxy gap — real Byzantine faults involve adversarial, arbitrary behavior, not just lower capability. This distinction is never acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are specified as 'GPT-4o-mini', 'GPT-3.5-turbo', 'LLaMA3-8B-Instruct', 'LLaMA3.1-8B-Instruct'. These are marketing names without snapshot dates or API versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided in Appendix B (Sections B.3.1, B.3.2, B.3.3 for PCP) and Appendix C (Section C.2.2 for HCP)."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Generation parameters are reported in Tables 6 and 11 (temperature, seed, max tokens, top-p, repetition penalty). Probe training parameters in Tables 12 and 13."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The CP-WBFT framework is described in detail: two-stage process (confidence probing + weighted consensus), information flow between agents, refinement protocol with equations (1-4), and Figure 3/4 illustrating the workflow."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Questions are described as 'specifically chosen to create a performance gap between strong and weak agents' but the selection criteria and process are not documented. For HCP, PCA preprocessing is described but the question curation process is opaque."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No limitations, threats to validity, or similar section exists in the paper. The conclusion mentions computational cost briefly but does not constitute a limitations section."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not discuss what settings or scenarios are excluded from its claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Raw model outputs, confidence scores, and consensus traces are not made available. Only aggregated results in tables are shown."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper states questions were 'specifically chosen to create a performance gap' but does not describe the selection procedure, how many candidates were screened, or what criteria defined a 'performance gap.'"
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Uses standard public benchmarks (GSM8K, XSTest, CommonsenseQA)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from question selection to final results has gaps. How the 10 questions were selected from each dataset is not explained. HCP probe training pipeline is better documented (PCA, z-score, logistic regression) but question curation is opaque."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed anywhere in the paper. No acknowledgments section mentioning grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Zhejiang University, East China Normal University, Zhongguancun Academy, Beijing University of Posts and Telecommunications, Kuaishou Technology, Tsinghua University."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding source disclosed, so independence cannot be assessed. One author is affiliated with Kuaishou Technology (a commercial entity), creating a potential undisclosed conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the four models used (GPT-4o-mini, GPT-3.5-turbo, LLaMA3, LLaMA3.1), despite evaluating them on GSM8K and XSTest benchmarks."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the 10 GSM8K or XSTest questions appeared in the training data of the models used."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "GSM8K was published in 2021 and XSTest in 2023. All four models were likely trained on data including these benchmarks. This contamination risk is not discussed, and is especially concerning given that only 10 questions per dataset are used."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, API cost, or latency reported despite using GPT-4o-mini and GPT-3.5-turbo APIs and running multi-round consensus across 7-node and 15-node networks."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No compute budget stated. The paper mentions 'significant computational cost' of the multi-round mechanism but does not quantify it."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "A single fixed seed (1234) is used across all experiments. No analysis of how results vary across different seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not explicitly stated. Results appear to be from single runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "For the main experiments, no hyperparameter search budget is reported. The HCP appendix shows top-10 configurations across layers but does not state total configurations searched."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C Tables 14-16 show top-10 configurations ranked by test accuracy across layers and extraction strategies, with test accuracy and AUC reported for selection justification."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors compare their CP-WBFT against traditional agents and between PCP/HCP variants, all implemented by themselves. No acknowledgment of self-comparison bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "HCP requires local model deployment and hidden state extraction while PCP uses API calls — fundamentally different compute costs. This compute difference is not quantified or discussed in relation to performance gains."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether GSM8K and XSTest actually measure Byzantine fault tolerance capability. Using weaker models as 'Byzantine' agents conflates model capability with adversarial behavior — a fundamental construct validity issue."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The CP-WBFT framework IS the system being evaluated — the scaffold is the product under test, not a confound."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "GSM8K (2021) and XSTest (2023) predate the training of all models used. No discussion of whether models memorized benchmark answers."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The confidence prompts explicitly ask models to rate their certainty, which could interact with memorized answers."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Only 10 questions are used per dataset, hand-selected to create performance gaps. No discussion of whether these specific questions are independent or representative."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used despite evaluating on public benchmarks with models likely trained on them."
       }
     }
   },
   "claims": [
     {
       "claim": "LLM-based agents demonstrate stronger Byzantine fault tolerance than traditional agents, maintaining consensus with up to 6 malicious nodes (85.7%) across most topologies.",
       "evidence": "Table 1 shows traditional agents collapse at 2-3 malicious nodes (RA=0%) while LLM-based agents maintain satisfactory IAA, FAA, and RA with 6/7 malicious nodes.",
       "supported": "moderate"
     },
     {
       "claim": "HCP achieves +85.71% Byzantine Fault Tolerance Improvement on complete graphs across both mathematical reasoning and safety assessment tasks while maintaining 100% round-level accuracy.",
       "evidence": "Table 2 shows HCP achieving 100% FAA and 100% RA on complete graphs for both GSM8K and XSTest, with BFTI of +85.71% from 14.29% baseline.",
       "supported": "weak"
     },
     {
       "claim": "CP-WBFT surpasses the classical Byzantine fault tolerance bound of f < n/3.",
       "evidence": "Table 1 and 2 show LLM-based agents maintaining consensus with 6/7 nodes malicious (85.7%), compared to the classical limit of tolerating fewer than 1/3 malicious nodes.",
       "supported": "weak"
     },
     {
       "claim": "Pooled hidden state extraction consistently outperforms answer and query extraction strategies.",
       "evidence": "Table 3 shows pooled achieving 85.29% (GSM8K) and 95.24% (XSTest) on LLaMA3.1, compared to answer (84.23%, 80.16%) and query (71.27%, 80.95%).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Extremely small evaluation set",
       "detail": "Only 10 questions per dataset are used for all experiments. This is far too small to draw reliable conclusions about Byzantine fault tolerance. A single question changing outcome could shift results by 10 percentage points."
     },
     {
       "flag": "Cherry-picked evaluation questions",
       "detail": "Questions are 'specifically chosen to create a performance gap between strong and weak agents.' This means the evaluation is designed to show the method works, not to test it under realistic conditions. The selection criteria are not documented."
     },
     {
       "flag": "Conflation of model weakness with Byzantine adversarial behavior",
       "detail": "Byzantine agents are simulated using weaker models (GPT-3.5-turbo, LLaMA3) rather than truly adversarial agents. Real Byzantine faults involve arbitrary/malicious behavior, not just lower capability. The paper's claims about 'Byzantine fault tolerance' are overstated for what is essentially a strong-weak model consensus mechanism."
     },
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are point estimates from single runs with a fixed seed. No error bars, confidence intervals, or multi-run analysis despite the stochastic nature of LLM outputs."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper entirely lacks a limitations or threats-to-validity section, a significant omission for a paper making strong claims about reliability and fault tolerance."
     },
     {
       "flag": "Contamination risk unaddressed",
       "detail": "Using only 10 questions from public benchmarks (GSM8K published 2021, XSTest 2023) with models likely trained on this data creates severe contamination risk. The 'strong' model may simply have memorized answers, inflating the apparent Byzantine fault tolerance."
     }
   ],
   "cited_papers": [
     {
       "title": "Large language model based multi-agents: A survey of progress and challenges",
       "authors": ["Taicheng Guo", "Xiuying Chen", "Yaqi Wang"],
       "year": 2024,
       "arxiv_id": "2402.01680",
       "relevance": "Survey of LLM-based multi-agent systems covering progress and challenges."
     },
     {
       "title": "Evil geniuses: Delving into the safety of LLM-based agents",
       "authors": ["Yu Tian", "Xiao Yang", "Jingyuan Zhang"],
       "year": 2023,
       "arxiv_id": "2311.11855",
       "relevance": "Investigates safety vulnerabilities in LLM-based agent systems."
     },
     {
       "title": "NetSafe: Exploring the topological safety of multi-agent networks",
       "authors": ["Miao Yu", "Shilong Wang", "Guibin Zhang"],
       "year": 2024,
       "arxiv_id": "2410.15686",
       "relevance": "Studies how network topology affects safety in multi-agent LLM systems."
     },
     {
       "title": "Scaling large language model-based multi-agent collaboration",
       "authors": ["Chen Qian", "Zihao Xie", "Yifei Wang"],
       "year": 2024,
       "arxiv_id": "2406.07155",
       "relevance": "Investigates scaling properties of LLM-based multi-agent collaboration."
     },
     {
       "title": "Multi-agent collaboration mechanisms: A survey of LLMs",
       "authors": ["Khanh-Tung Tran", "Dung Dao", "Minh-Duc Nguyen"],
       "year": 2025,
       "arxiv_id": "2501.06322",
       "relevance": "Survey of collaboration mechanisms in LLM-based multi-agent systems."
     },
     {
       "title": "From LLM reasoning to autonomous AI agents: A comprehensive review",
       "authors": ["Mohamed Amine Ferrag", "Norbert Tihanyi", "Merouane Debbah"],
       "year": 2025,
       "arxiv_id": "2504.19678",
       "relevance": "Comprehensive review of the progression from LLM reasoning to autonomous AI agents."
     },
     {
       "title": "Can LLMs express their uncertainty? An empirical evaluation of confidence elicitation in LLMs",
       "authors": ["Miao Xiong", "Zhiyuan Hu", "Xinyang Lu"],
       "year": 2023,
       "arxiv_id": "2306.13063",
       "relevance": "Empirical evaluation of LLM confidence calibration, directly relevant to the confidence probing approach."
     },
     {
       "title": "Survey on evaluation of LLM-based agents",
       "authors": ["Asaf Yehudai", "Lilach Eden", "Alan Li"],
       "year": 2025,
       "arxiv_id": "2503.16416",
       "relevance": "Survey on evaluation methodologies for LLM-based agents."
     },
     {
       "title": "Cut the crap: An economical communication pipeline for LLM-based multi-agent systems",
       "authors": ["Guibin Zhang", "Yanwei Yue", "Zhixun Li"],
       "year": 2024,
       "arxiv_id": "2410.02506",
       "relevance": "Proposes efficient communication methods for LLM-based multi-agent systems."
     },
     {
       "title": "Root defence strategies: Ensuring safety of LLM at the decoding level",
       "authors": ["Xinyi Zeng", "Yuying Shang", "Jiawei Chen"],
       "year": 2024,
       "arxiv_id": "2410.06809",
       "relevance": "Decoding-level safety mechanisms for LLMs, related to hidden-state confidence probing."
     }
   ]
 }