Cross-Agent Hallucination Propagation

• Cross-agent hallucination propagation is the process where erroneous claims are amplified by unverified inter-agent communication in multi-agent LLM systems.
• It involves mechanisms such as context reuse, consensus over correlated errors, and synchronization protocols that compound hallucinations across reasoning rounds.
• Mitigation strategies emphasize evidence grounding, selective synchronization, and independent verification to control error amplification in distributed agent architectures.

Cross-agent hallucination propagation is the process by which an erroneous claim, imagined state change, unsupported summary, or stale shared belief produced by one agent becomes input to other agents, is treated as trustworthy, and is then preserved, elaborated, or amplified across subsequent reasoning rounds. In multi-agent LLM systems, this phenomenon has been described as a “domino effect,” “contamination effect,” “hallucination snowballing,” “collective hallucination,” and “context drift,” depending on whether the dominant channel is sequential planning, shared state synchronization, multimodal relay, or recursive consensus formation. Across recent work, the central technical insight is that hallucination in multi-agent settings is not only a property of individual model outputs; it is a system-level, time-evolving process shaped by communication topology, verification protocol, memory design, synchronization policy, and the degree to which downstream agents demand grounded evidence before accepting upstream content (Yang et al., 2 Dec 2025, Zhan et al., 30 Jan 2026, Rodrigues, 19 Jun 2026, Jamshidi, 6 Jun 2026).

1. Definition and conceptual scope

Cross-agent hallucination propagation refers to the way an erroneous claim produced by one agent in a multi-agent pipeline can be taken as input, trusted, or elaborated on by other agents, thereby amplifying and spreading the error through the system (Yang et al., 2 Dec 2025). In multimodal LLMs, hallucination means generating text that is linguistically plausible but factually inaccurate relative to the visual input. In Deep Research Agents, hallucination is unfaithful content relative to sources or user intent, and the propagation pattern is defined as sequential dependency where a downstream error is induced by an upstream hallucination, forming cascading chains (Zhan et al., 30 Jan 2026). In graph-based planning agents, a hallucinated state change is any imagined node-status update that does not match the ground-truth delta under the executed action, and propagation arises when a hallucinated atom inserted into the chat history conditions subsequent steps through attention (Song et al., 26 Jun 2026).

The literature distinguishes several related scopes. One scope is cross-agent propagation in systems with multiple distinct agents, where one agent’s output functions as flawed input to another. A second scope is cross-component propagation within a single agentic system, such as planner-to-summarizer or summarizer-to-planner transfer, which is explicitly treated as analogous to cross-agent propagation (Zhan et al., 30 Jan 2026). A third scope is collective hallucination, where unsupported claims diffuse through a communication graph and intensify under recursive interaction rounds (Jamshidi, 6 Jun 2026). A fourth scope is context drift, where concurrently operating agents maintain mismatched or stale internal knowledge states, so that synchronization itself can spread the wrong belief even while reducing apparent inter-agent divergence (Rodrigues, 19 Jun 2026).

A recurring misconception is that multi-agent interaction automatically improves factuality through redundancy. Several papers directly reject that assumption. “Council Mode” states that simple voting can elevate a widely-shared false prior to a “consensus,” and “Multi-agent Undercover Gaming” argues that classical Multi-Agent Debate relies on the unrealistic assumption that all debaters are rational and reflective (Wu et al., 3 Apr 2026, Liang et al., 14 Nov 2025). This suggests that propagation is not merely an error accumulation problem; it is also a reliability-estimation problem in which unverified agreement can be worse than disagreement.

2. Principal mechanisms of propagation

The most common propagation mechanism is context reuse without grounded verification. In InEx, a decision agent’s mistaken assertion can be relayed to self-reflection agents or an editor, which may accept or embellish the error if their verification is weak or biased, producing feedback or edited artifacts that appear to corroborate the false claim (Yang et al., 2 Dec 2025). In DeepHalluBench, “Action Propagation” marks plans that are logically coherent but grounded in prior hallucinated claims, so that a fabricated summary can induce a downstream search plan which in turn yields further misattribution and noise-dominated synthesis (Zhan et al., 30 Jan 2026). In GILP, imagined next-state deltas are appended to later prompts, making semantic transition errors persist across horizon steps (Song et al., 26 Jun 2026).

A second mechanism is consensus over correlated errors. “Council Mode” identifies correlated errors, majority-vote amplification, and consensus over shared false priors as concrete pathways by which multiple models can jointly legitimize a false claim (Wu et al., 3 Apr 2026). “Collective Hallucination in Multi-Agent LLMs” formalizes this as a stochastic diffusion process over a directed communication graph, where adoption depends on confidence, semantic disagreement, and structural impact. The state evolution is written as

$$\mathbf{H}^{(t+1)} = \mathbf{P}^{(t)} \mathbf{H}^{(t)} + \boldsymbol{\epsilon}^{(t)},$$

with amplification governed by the effective impact matrix and by the reproduction number

$$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$

The paper interprets $\mathcal{R}_0^{(t)}<1$ as attenuation, $\mathcal{R}_0^{(t)}\approx 1$ as persistence, and $\mathcal{R}_0^{(t)}>1$ as self-amplification (Jamshidi, 6 Jun 2026).

A third mechanism is contamination through synchronization. “Hallucination as Context Drift” shows that naive full-broadcast synchronization can spread an erroneous belief from one agent to all others, lowering system-level divergence while increasing hallucination system-wide (Rodrigues, 19 Jun 2026). In the travel-planning setting, Full-Broadcast achieves low CDS even as HR peaks, illustrating that alignment on a wrong shared state can be more damaging than partial disagreement. This is important because many multi-agent designs treat higher agreement as a proxy for higher reliability.

A fourth mechanism is over-reliance on text-only relay in multimodal systems. “Visual Multi-Agent System” attributes multi-agent visual hallucination snowballing to the reduction of visual attention allocation across agent turns, with textual flow progressively displacing native visual evidence (Yu et al., 26 Sep 2025). The paper reports that average attention allocation to vision tokens drops from 0.165 at turn 1 to 0.099 at turn 10, and then to 0.063 by turn 20, while a subset of vision tokens with a unimodal attention peak in middle layers gradually disappears. In this setting, upstream textual descriptions become increasingly authoritative because downstream agents see less of the original image in the effective attention pattern.

A fifth mechanism is memory and message-path contamination. In OFP- or OVON-style pipelines, unsupported claims can be passed explicitly across inter-agent boundaries and preserved in structured hand-offs (Gosmar et al., 27 May 2026, Gosmar et al., 19 Jan 2025). The risk is especially pronounced when downstream agents receive polished but unsupported utterances without a parallel channel for uncertainty, provenance, or hallucination risk. Several systems therefore separate content from meta-assessment, for example through “utterance” and “whisper” fields in OVON (Gosmar et al., 19 Jan 2025).

3. Measurement, tracing, and formalization

A major line of work argues that end-to-end accuracy is insufficient because it obscures where propagation begins. DeepHalluBench therefore shifts from outcome-based to process-aware evaluation by reconstructing full research trajectories, decomposing them into atomic actions and atomic claims, and then auditing hallucinations along functional components and error properties (Zhan et al., 30 Jan 2026). Its PIES taxonomy separates Planning vs. Summarization and Explicit vs. Implicit errors. The paper defines

$$HES = \frac{|C_{\text{fabrication}}| + |C_{\text{misattribution}}|}{|C_{\text{total}}|},$$

$$HEP = \frac{|A_{\text{deviation}}| + |A_{\text{redundancy}}| + |A_{\text{propagation}}|}{|A_{\text{total}}|},$$

$$HIP = \frac{|Q_{\text{total}}| - |Q_{\text{executed}}|}{|Q_{\text{total}}|},$$

and the overall trajectory score

$H = HES + HIS + HEP + HIP.$

Propagation is traced with a Directed Acyclic Graph over atomic claims and actions, with edges indicating that one error propagated from another (Zhan et al., 30 Jan 2026).

Several papers make propagation measurable at the step level. GILP introduces operational hallucination metrics for agent-based world models: Hallucinated-State Rate, Propagation Depth, and Error-Explosion Slope (Song et al., 26 Jun 2026). If the ground-truth state delta is $\Delta_t^\star$ and the agent’s imagined delta is $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$0, a hallucinated state atom occurs on node $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$1 when $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$2. The mean number of subsequent steps that condition on a hallucinated atom becomes Propagation Depth. This formulation is narrow but useful because it makes latent world-model drift directly auditable.

The multimodal and visual literature uses distinct but related instrumentation. InEx drives introspection with the Text-to-Visual Entropy Ratio,

$$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$3

and masks an attention head when $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$4 with $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$5 in experiments (Yang et al., 2 Dec 2025). “Visual Multi-Agent System” defines a hallucination snowballing score

$$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$6

which weights hallucination severity by propagation depth across the multi-agent structure (Yu et al., 26 Sep 2025). MedBench v5 monitors propagation through stage-specific metrics such as HPR, HCCR, DHDR, CHO, CIHSR, and CIHGR, explicitly separating initiation, propagation, anchoring, and contradiction interaction (Jinru et al., 23 Jun 2026).

Context-drift work treats propagation as a synchronization-control problem. “Hallucination as Context Drift” defines the Context Divergence Score

$$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$7

with threshold $$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$8 calibrated in the travel domain (Rodrigues, 19 Jun 2026). The system-level aggregate is

$$\mathcal{R}_0^{(t)} = \frac{1}{N} \sum_{i=1}^N \sum_{j=1}^N P_{ij}^{(t)}.$$9

This formulation is explicitly prescriptive rather than predictive: high divergence signals joint reasoning risk, but low divergence does not guarantee factual correctness.

A plausible implication is that the field is converging on a shared pattern: propagation becomes tractable when systems expose intermediate artifacts—claims, actions, state deltas, summaries, or compressed contexts—rather than only final answers.

4. Mitigation architectures and control strategies

Recent systems do not treat mitigation as a single verifier call; they combine gating, evidence grounding, and restricted message passing. InEx unifies two complementary modules: In, for internal introspective reasoning, and Ex, for external cross-modal multi-agent collaboration (Yang et al., 2 Dec 2025). The internal module uses TVER-based head masking, self-introspective visual augmentation, Vision-Enhanced MHA, and confidence-thresholded fusion based on Manhattan distance over top-$\mathcal{R}_0^{(t)}<1$0 logits with $\mathcal{R}_0^{(t)}<1$1. The external module alternates textual verification against a dense caption and visual verification through edited-image similarity, with a CLIP-like threshold $\mathcal{R}_0^{(t)}<1$2 and iteration cap $\mathcal{R}_0^{(t)}<1$3. Its core design principle is selective acceptance: answers pass only if both textual and visual gates succeed.

GILP adopts a different grounding primitive: a small parameterized world model constrains an LLM-based planner through per-step consistency and risk gates (Song et al., 26 Jun 2026). The LLM drafts an action and imagined delta, while the backbone predicts validity, next-state delta, reward, done, risk, and short-horizon value. Agreement is computed by Jaccard similarity between imagined and predicted change-sets, with thresholds $\mathcal{R}_0^{(t)}<1$4 and $\mathcal{R}_0^{(t)}<1$5. If consistency is low, a targeted correction prompt enumerates discrepancies and requests revision. This architecture is notable because only a small backbone is trained; the LLM remains API-based. The paper explicitly argues that the same mechanism extends to multi-agent coordination through a canonical global state, pending-delta queue, and commit policy that only accepts deltas passing the consistency gate.

Consensus-oriented systems attack a different failure mode: uncritical aggregation. “Council Mode” dispatches non-trivial queries to three heterogeneous frontier models and synthesizes their outputs with a dedicated consensus model (Wu et al., 3 Apr 2026). Its output is decomposed into

$\mathcal{R}_0^{(t)}<1$6

where consensus claims are drawn from the intersection of factual claim sets rather than from raw majority vote. The synthesis prompt forbids new claims not present in any expert response and preserves disagreement and unique findings rather than collapsing them prematurely. “Multi-agent Undercover Gaming” goes further by reframing debate as reliability estimation under controlled counterfactual perturbations: unreliable agents are detected through counterfactual tests and then eliminated or down-weighted before summarization (Liang et al., 14 Nov 2025).

Some architectures aim to prevent propagation by controlling memory and observability rather than by explicit factual verification. The HOPE-inspired Nested Learning architecture with Continuum Memory Systems assigns each agent its own Medium-Term Memory and Long-Term Memory, with per-agent semantic caches keyed by embeddings and threshold $\mathcal{R}_0^{(t)}<1$7 (Gosmar et al., 27 May 2026). Because caches are per-agent, the FrontEndAgent only reuses its own prior outputs, while the reviewers preferentially reuse sanitized and enforced responses. The authors describe this as a way to prevent systematic cross-agent reuse of fabrications. OVON-based pipelines similarly preserve uncertainty meta-information through “whisper context” and “whisper value,” so the next reviewer receives an explicit hallucination assessment rather than only surface text (Gosmar et al., 19 Jan 2025).

Synchronization protocols provide a separate mitigation family. SSVP lets agents exchange compressed three-sentence ContextSummary messages, compute CDS, and trigger ContextMerge only when divergence is high (Rodrigues, 19 Jun 2026). ContextMerge is instructed to identify contradictions, assess authority by timestamps and information quality, and reconcile—never silently overwrite. This is a direct response to the failure mode in which full broadcast reduces divergence but increases hallucination.

At the systems-theory level, “Collective Hallucination in Multi-Agent LLMs” combines confidence-weighted aggregation, adaptive impact regulation, external claim verification, and selective isolation of unreliable agents (Jamshidi, 6 Jun 2026). Trust weights are updated as

$\mathcal{R}_0^{(t)}<1$8

and an agent can be disabled if $\mathcal{R}_0^{(t)}<1$9. The paper’s control objective is to keep the effective propagation operator contractive so that the spectral radius remains below 1.

5. Empirical findings across settings

The empirical record does not support a single universal outcome. Some systems show net attenuation across stages, while others show strong amplification under specific interaction policies. InEx reports extensive experiments showing 4%-27% gains on general and hallucination benchmarks, including POPE accuracy improving from 79.83 to 88.73 on an MSCOCO subset with LLaVA-1.5-7B, CHAIR_S improving from 50.0 to 45.1, and MM-Vet improving from 31.10 to 36.00 (Yang et al., 2 Dec 2025). The paper also reports that paired one-sided $\mathcal{R}_0^{(t)}\approx 1$0-test and Wilcoxon $\mathcal{R}_0^{(t)}\approx 1$1-values on POPE are far below $\mathcal{R}_0^{(t)}\approx 1$2 across 20 seeds.

DeepHalluBench reaches a less optimistic conclusion about current deep research systems. On six DRAs, no system achieves robust reliability, and the diagnostic analysis traces the etiology of failures to systemic deficits, specifically hallucination propagation and cognitive biases (Zhan et al., 30 Jan 2026). Gemini shows Action Propagation of approximately 1.7% of actions, and more than 57% of source errors in Gemini and OpenAI trajectories originate early. The benchmark also reveals divergent failure styles: OpenAI and Grok are described as “confident fabricators,” Salesforce shows dominant misattribution, and Grok and Perplexity show high noise domination.

GILP demonstrates large gains in grounded planning. Against Agent-Replan, it increases success rate from 0.668 to 0.838, reduces HSR from 0.205 to 0.079, shortens propagation depth from 2.45 to 1.51, and decreases invalid-action rate from 0.169 to 0.065 while using approximately 1.30 LLM calls per step (Song et al., 26 Jun 2026). On real GPT-4o-mini validation, pooled HSR falls from 0.176 to 0.035, described as an 80% reduction with non-overlapping 95% confidence intervals.

Council-style consensus also shows strong results when disagreement is preserved and expert diversity is enforced. “Council Mode” reports a 35.9% relative reduction in hallucination rates on HaluEval and a 7.8-point improvement on TruthfulQA compared to the best-performing individual model (Wu et al., 3 Apr 2026). Its ablation is especially relevant to propagation: replacing structured synthesis with simple majority vote increases hallucination from 10.7% to 14.2%, and a same-model ensemble performs much worse than the heterogeneous council.

Not all multi-agent interaction helps. “Hallucination as Context Drift” reports that in the travel domain naive full-broadcast synchronization increases hallucination rate by 34% above the no-sync baseline, with HR 0.658 vs. 0.492, whereas SSVP reaches HR 0.463 and uses 58% fewer API calls than Full-Broadcast (Rodrigues, 19 Jun 2026). The contamination effect does not replicate in the software domain, where all conditions converge to low HR below 0.2. This domain dependence is one of the clearest signs that propagation behavior depends on dependency structure, not just on model quality.

The visual-multimodal setting exhibits another strong contrast. “Visual Multi-Agent System” reports that ViF reduces Hallucination Snowballing Score by 39.8% on a circular MAS built from LLaVA-NeXT-7B and improves multiple benchmark metrics simultaneously, while several single-agent anti-hallucination baselines underperform in the multi-agent setting (Yu et al., 26 Sep 2025). By contrast, “Hallucination Cascade” finds that deeper cascades can reduce normalized hallucination from 0.422 to 0.272 in 3-agent chains, with attenuation factor 0.644, but this is accompanied by a decline in factual accuracy from 0.789 to 0.769 (Jamshidi et al., 6 Jun 2026). That trade-off indicates that attenuation can occur through correction, deletion, or cautious compression rather than by perfect preservation of correct content.

6. Limitations, controversies, and open directions

A first unresolved issue is whether propagation should be modeled as amplification, attenuation, or both. The answer in current work is “both,” but under different mechanisms. “Hallucination Cascade” documents net attenuation in sequential cascades (Jamshidi et al., 6 Jun 2026), whereas “Hallucination as Context Drift” shows amplification under naive synchronization (Rodrigues, 19 Jun 2026), and “Collective Hallucination in Multi-Agent LLMs” shows that amplification depends on topology, confidence coupling, and adversarial conditions (Jamshidi, 6 Jun 2026). This suggests that propagation is not a unitary phenomenon; it is an interaction between agent quality and protocol design.

A second issue is the reliability of the verifier itself. Many systems rely on dense captions, CLIP-like similarity, LLM judges, NLI cascades, or external validators (Yang et al., 2 Dec 2025, Zhan et al., 30 Jan 2026, Jamshidi, 6 Jun 2026). The cited papers repeatedly note that incomplete captions, editing artifacts, verifier corruption, or judge miscalibration can allow false claims to pass or correct claims to be suppressed. In the medical setting, MedBench v5 emphasizes that final evidence grounding can remain superficially stable even when contradiction detection, diagnosis updating, and hallucination propagation are degraded (Jinru et al., 23 Jun 2026). This directly challenges the idea that grounded final outputs imply stable internal reasoning.

A third issue is the cost–reliability trade-off. Training-free approaches such as InEx and ViF avoid retraining but add iterative inference and verification overhead (Yang et al., 2 Dec 2025, Yu et al., 26 Sep 2025). GILP adds only approximately 22% extra LLM calls in simulator ablations and around 20% token overhead in real validation (Song et al., 26 Jun 2026), whereas SSVP sharply reduces cost relative to Full-Broadcast but still requires more calls than No-Sync (Rodrigues, 19 Jun 2026). Council-style methods improve factuality but increase latency because total time is bounded by the slowest expert plus synthesis (Wu et al., 3 Apr 2026).

A fourth issue is scope and generalization. Several works are explicit that their experiments target planner–summarizer propagation rather than fully distinct agents, or image–text settings rather than audio or video (Zhan et al., 30 Jan 2026, Yang et al., 2 Dec 2025). Others note that contamination effects are domain-specific, that small backbones can be miscalibrated, or that editing artifacts can mislead similarity-based gates (Rodrigues, 19 Jun 2026, Song et al., 26 Jun 2026). MedBench v5 adds that strong macro-average task performance does not guarantee process stability and that stressors mainly disrupt contradiction detection, diagnosis updating, hallucination propagation, and contradiction-based self-correction (Jinru et al., 23 Jun 2026).

The main research direction emerging from this literature is evidence-first coordination. This includes claim-level provenance, intermediate-state exposure, confidence-aware message passing, selective synchronization, contradiction-triggered updates, and protocols that refuse to treat agreement as truth unless the agreement is grounded. A plausible implication is that future multi-agent systems will increasingly resemble controlled distributed systems: shared states will be versioned, claims will carry provenance and confidence, synchronization will be conditional rather than indiscriminate, and unreliable agents or modules will be down-weighted or isolated rather than merely averaged into a final answer.