Adversarial verification: rethinking trust in multi-agent systems

May 3, 2026

The dominant pattern for making multi-agent systems "reliable" is to run more agents and take the consensus. Vote across N samples. Ensemble across model families. Add a judge. The implicit assumption is that agreement is evidence, and disagreement is noise to be averaged away.

This intuition came from places where it was true. Statistical estimation, classical fault-tolerant computing, ML ensembles trained on independently sampled data. None of those assumptions hold for stochastic agents driven by large language models. Failures are correlated, agreement is fragile, and a system optimized to suppress disagreement throws away the most diagnostically useful signal it has.

Over the last few months we ran two complementary efforts at Latere to interrogate the alternative: agents-verification, a research probe asking how classical Byzantine fault tolerance bears on multi-agent LLM systems, and Adversarial Review, a shipped tool that forks a Claude Code session and runs cross-examination by independent critics. Both push the same hypothesis from opposite ends. This post is an attempt to write down the thinking behind them.

What goes wrong with consensus-as-reliability

There are three load-bearing problems with treating agreement as a proxy for correctness in agent systems.

Failures are correlated. Classical Byzantine fault tolerance does not require probabilistic independence in the theorem; it requires a credible bound on how many replicas can be faulty at once. The $f < N/3$ threshold is meaningful only when fewer than a third of replicas can share the same Byzantine failure mode. Two agents drawing from the same base model, the same training distribution, and often the same prompt template do not have independent failure modes. They co-hallucinate. They share the same blind spots, the same biases toward fluent-sounding wrong answers, the same weaknesses on the same kinds of inputs. Adding a third copy does not buy you what the math promises. Berdoz et al. (arXiv:2603.01213) measured this directly: valid scalar consensus among LLM agents drops from 46.6% at $N=4$ to 33.3% at $N=16$ even without any adversary. Adding agents made it worse, not better. We replicate this regime in the agents-verification experiments 01 and 02, where the headline finding is the same: agreement is the wrong axis to optimize on.

Agreement is cheap to manufacture. A small amount of conformity pressure, a leading prompt, or a shared in-context example can drive agents into convergent but incorrect answers. The FREE-MAD work (arXiv:2509.11035) gives a modern version of this problem: in consensus-driven debate, agents that initially produce correct responses can be pulled toward incorrect ones, and final majority voting can degrade reasoning performance. When the system is graded on agreement, agents learn to agree, even when the right move would be to flag that they cannot.

Self-evaluation is biased. Panickssery et al. (arXiv:2404.13076) showed LLM judges systematically favor their own generations. Position bias in pairwise judges is well documented (ACL 2025). An ensemble of judges drawn from the same family inherits the same biases. The verification layer cannot be a cheaper echo of the layer it verifies and still tell you anything you did not already know.

The honest reading is that agreement among similar models is weak evidence of correctness. It is sometimes evidence of nothing more than that the input is unambiguous enough for any plausible decoder to land on the same answer.

What the BFT literature actually buys you

It is tempting to read this as "BFT does not apply, throw it out." That is the wrong lesson. The forty-year-old distributed-systems literature has two contributions that survive translation to stochastic agents, and they are exactly the contributions practitioners tend to skip past.

First, the separation of liveness from safety. A system can fail by producing the wrong answer (safety violation) or by failing to produce any answer at all (liveness violation). The empirical work above is striking precisely because it shows LLM consensus failures are mostly liveness failures: the agents do not converge on a wrong answer, they fail to converge at all. This matters for product design. A liveness failure is recoverable by escalation to a human or a different model. A safety failure is silent and ships. Systems that conflate the two will optimize for the wrong axis. The agents-verification specs are organized around this separation: liveness and safety are measured on independent axes in every experiment, never collapsed into a single accuracy number.

Second, the recognition that correlated failure is how a fault bound becomes false in practice. The fix is not to add more replicas. The fix is to break the correlation: heterogeneous models, heterogeneous prompts, heterogeneous tooling, and where possible, heterogeneous formulation of the question itself. The cost of this heterogeneity is real. Mixing model families introduces integration complexity, drift between providers, and a coordination tax. But it is the only thing that restores any useful version of the fault-diversity assumption that BFT deployments rely on.

The asymmetric move: structured disagreement

The deeper move is to stop treating disagreement as noise.

In an idealized debate, a single competent honest critic is sufficient to expose a flaw, regardless of how many other critics are lazy or wrong. This is the intuition behind Irving, Christiano and Amodei (arXiv:1805.00899) and the formal extension by Brown-Cohen, Irving and Piliouras (arXiv:2311.14125), which shows soundness under a large compute asymmetry: the honest strategy can use polynomial simulation steps while the dishonest strategy may use exponentially many. The complexity-theoretic intuition is that under optimal play, debate can answer PSPACE questions: a judge inspecting only the disputed claim that decides the debate can verify outcomes the judge could never have produced unaided.

A small formal contrast. Let $p_i \in [0, 1]$ be the probability that critic $i$ catches a flaw on the axis they evaluate, and let $\rho \in [0, 1]$ be the pairwise correlation between verdicts.

Aggregational verification with $k$ voters under majority vote: as $\rho \to 1$, the probability a flaw survives the ensemble approaches the probability that the shared failure mode misses it. Adding voters does not help.

Adversarial verification with $k$ independent critics on distinct axes, where one flaw suffices: the probability a flaw survives the panel factors over critics. Under independence this is exact; any residual positive correlation between verdicts only raises survival above the product, so the product is the best case you are buying.

The product only buys you something if the $p_i$ cover different ways the artifact can be wrong. Write $p_i = c_i d_i$, where $c_i$ is the probability that critic $i$ selects the relevant attack surface and $d_i$ is the probability that the critic turns that surface into a concrete objection. Duplicating critics on the same surface mostly increases $d_i$ locally. Forcing topic diversity increases coverage, roughly $1 - \prod_i (1 - c_i)$. This is why self-declared but de-duplicated attack topics are not a UX detail. They are how the protocol spends critic budget.

A single competent honest critic on the relevant axis ($p_i = 1$) collapses the product to zero. This is the asymmetry that can make adversarial verification dominate consensus when failures are correlated and at least one independent honest critic exists. Equivalently, in the doubly-efficient debate frame, a judge of bounded complexity $J$ can adjudicate claims produced by a prover of complexity $P \gg J$, because the judge only needs to evaluate the single leaf where the players' disagreement bottoms out, not the full claim.

There is also a useful monotonicity invariant. Let $U_t$ be the set of unresolved attacks after round $t$, $R_t \subseteq U_t$ the attacks resolved by a fix, concession, or convincing defense, and $A_{t+1}$ the new attacks introduced in the next round.

No unresolved objection disappears because more agents voted against it. It disappears only by being resolved. Majority aggregation violates this invariant by design: a real minority objection can be overwritten by a larger pile of shallow agreement. Adversarial verification preserves the objection until the proposer either repairs the artifact or pays the cost of a defense.

The implication for multi-agent design is precise. You do not need every critic to be competent. You need a process that surfaces the competent objection when it exists, and that terminates on the contested points rather than burying them under aggregate scores.

This is closer to proof checking, property testing, and red-team review than ensemble prediction. A verifier does not need to reproduce the whole artifact. It needs to force a disputed claim into a small enough witness or counterexample that a cheaper judge can inspect. In code, that witness might be a failing test, a vulnerable input, a violated invariant, or a missing source citation. In a planning system, it might be an unstated dependency, a resource conflict, or a reversible point of no return. The general pattern is the same: make the objection local, attach evidence, and preserve it until resolved.

This inverts a lot of common practice. Instead of:

Run N agents, take the majority answer, log the disagreements as an aside.

You do:

Run a proposer. Fork independent critics with no shared context. Each critic picks a distinct attack topic. Run cross-examination until the proposer concedes or the critic gives up. Surface only the unresolved disputes, scored by how long they survived attack.

This is exactly the protocol our Adversarial Review capability implements on top of Claude Code: after a coding session you run latere review in a terminal, it forks the session into independent critics via Claude Code's --fork-session, runs the cross-examination, and writes only the unresolved disputes to disk. Because it only ever touches the live session through a fork, the root transcript is byte-identical after a run. The adversarial back-and-forth never lands in the conversation you were having. Disagreement is no longer an aggregation problem. It is the product. The artifact that ships to the human is the list of things competent independent critics could not get the proposer to either fix or convincingly defend.

What we built to test this

The two efforts interrogate this from different angles.

agents-verification is a research repo. The setup uses real headless coding agents (claude -p, codex exec) rather than raw model API calls, so it captures realistic agentic failure modes: planning loops, tool-use errors, structured-output violations, not just sampling noise. Six experiments span two regimes:

• Parallel consensus (01-05): can N independent agents agree on a verifiable answer; what does Byzantine injection do to the agreement rate; does unanimous agreement on bug presence track ground truth; do partial-agreement maps reliably surface where a spec is ambiguous; does a K-of-N consensus gate reduce destructive actions without unacceptably blocking safe ones.
• Sequential chains (06): when agents consume each other's output, do errors propagate, amplify, or get corrected.

The repo is deliberately scoped as a probe, not a product. The interesting outputs are the disagreement maps and the per-experiment ROC frontiers, not a single benchmark number.

Adversarial Review is the productized version of one architectural choice from that research, narrowed to a single high-leverage application: post-hoc adversarial review of Claude Code coding sessions. After a coding session you run latere review; it forks the session into one or more critic agents, runs a multi-round cross-examination per critic, applies any concessions the proposer makes, and surfaces only the unresolved disputes. The design has five load-bearing properties:

1. Forked review, never in the root session. Each critic runs in its own branched fork via --fork-session; Adversarial Review runs as a separate process that writes results to disk. The user's primary transcript is never polluted by adversarial back-and-forth.
2. Verbatim channel. The critic's output reaches the proposer-clone as a plain user turn, not wrapped in a skill or template that might distort the proposer's normal defense behavior.
3. Self-declared topics. Each critic picks its own attack topic in round 1 (security, performance, internal consistency, evidence gap, and so on). Later critics are told which topics are taken so they pick something else. There is no fixed catalog. The debate-theoretic property that one competent honest critic suffices for soundness means a lazy critic on one topic does not break the others.
4. Persisted ledger. Every attack carries a stable id; every transition is appended to an attacks log. The headline is picked by a pure contention score (rounds_survived + (1 if re-attacked)), not by an LLM judge. The judging layer is statistical, not neural.
5. Critic isolation. v0 enforces "artifact plus task only" by critic system prompt and codex --sandbox read-only. Strict per-fork sandbox dirs are v1.

The thing we get out of it is, in our experience so far, qualitatively different from a code review or a self-critique. The critic does not vote on whether the diff is good. It picks a fight on one specific axis, presses it across rounds, and either gets a fix, gets a defense the human can read, or surfaces an unresolved leaf. The output for a typical session is a short list of disputes ranked by contention, with stakes and evidence inline.

What this implies for how products should be designed

A few opinions fall out of this for the kinds of systems we are building.

Verification should be adversarial, not aggregational. If you want a verification layer to do work, it has to be structurally able to disagree with the layer it verifies. Same model family, same prompt template, same in-context examples: you have built an echo. A different model, a different framing, an instruction to find what is wrong rather than to score what is right: now there is a chance.

Disagreement is the artifact, not a side effect. The output that ships to the human should be the unresolved disputes, with provenance, not a confidence score. Confidence scores collapse signal that the human needs. A list of "three things competent critics could not get the system to defend" is more actionable than "0.84 confident." This is not a UX preference. It is a statement about which failure modes silently ship and which surface in time to be corrected.

Claims need addresses. Debate degrades when the artifact is a blob. Every nontrivial claim should have a handle: file path, test case, source citation, requirement id, assumption id, decision record. That gives critics something concrete to attack and proposers something concrete to repair. Without addressability, adversarial review collapses into rhetoric.

Liveness failures should escalate, safety failures should block. A system that knows the difference between "the agents could not converge" and "the agents converged on the wrong answer" can route the first to a human and refuse to ship the second. A system that does not know the difference does the wrong thing on both.

The judging layer should be cheaper and dumber than the proposing layer. This is the intuition from doubly-efficient debate. If your judge has to be as smart as the proposer to evaluate the debate, you have not bought anything. The judge should inspect only the single disputed claim that decides the outcome. In Adversarial Review, the "judge" is a contention score, $\text{score}(a) = \text{rounds\_survived}(a) + \mathbf{1}[\text{re\_attacked}(a)]$: a count of how many rounds an attack survived, plus a bit for whether it was re-attacked. There is no LLM in that loop. That is on purpose.

Heterogeneity has a cost worth paying. Mixing critic models (Codex critics on a Claude proposer, in our case) introduces operational complexity. It is also the only thing that restores any useful version of the fault diversity the verification mathematics requires. We are not aware of a shortcut here. The default configuration in Adversarial Review is Claude proposer with Codex critics for exactly this reason.

The connection to the rest of Latere's thinking

The thread running through all of this is the same one in why Latere exists: the most important intelligence in an autonomous system is the one you cannot see. The human who set the direction, defined the constraints, decided when to override.

Adversarial verification is the technical version of that commitment. The point is not to remove the human from the loop. The point is to deliver, to the human, the smallest set of decisions that actually require human judgment: the unresolved disputes between competent independent critics, with the evidence each side put forward, and the stake that turns on the outcome. Everything else has been either fixed by the proposer or defended convincingly enough that no competent critic could break it.

The products we are building sit on top of this stance. Cella is the durable runtime for isolated, observable, revertible work. Wallfacer is the engineering platform where adversarial review becomes a first-class step in the agent loop, not an afterthought. The unresolved disputes still need a human-facing surface, but the architectural requirement is already clear: the person who has to make the call should see the contested decisions, not a flattened confidence score.

The deeper bet is that as agent systems get more capable, the value of the human in the loop does not diminish. It concentrates. It moves from "review every line" to "decide the contested ones." The job of the platform is to make sure that the contested ones are correctly identified, accurately framed, and never silently averaged away.

What we are still uncertain about

A few questions we do not yet have good answers to.

The first is the right cardinality. One critic per topic is the floor; the ceiling is unclear. More critics on the same topic should buy diminishing returns under correlated failure, but we do not have a clean empirical story for how that curve looks across model families.

The second is drift in adversarial protocols. A debate that runs for too many rounds starts to drift off the original claim, and contention scores can be inflated by stylistic friction rather than substantive disagreement. The right termination criterion is not yet settled. Our current heuristic (steady-state detection plus a hard round cap) catches the common cases but is clearly not optimal.

The third is how to evaluate adversarial verification itself. We can measure whether Adversarial Review finds bugs that the proposer missed (the v0 release tracks a "critic-found-bug rate" of fixes per attack), but the broader claim, that adversarial verification is a better path than aggregation for stochastic agents, deserves a careful benchmark. The agents-verification experiments are designed to probe this directly, but the existing literature is partial. We would like to do more here.

If any of this resonates, or if you have a counter-argument, we want to hear it.

Latere builds tools for a world where AI does increasingly intelligent work and humans make the decisions that matter. Founded by Dr. Changkun Ou.