Silent Wrong-State Failures in Complex Systems

• Silent wrong-state failures are hidden errors where systems enter or maintain an incorrect state without explicit error signals, yet outputs remain plausible.
• They span diverse domains such as multi-agent AI, safety-critical perception, CI pipelines, and hardware reliability, characterized by differential observability.
• Detection and mitigation require external verification layers, anomaly detection techniques, and independent monitoring rather than relying solely on native error signals.

Silent wrong-state failures are failures in which a system enters or maintains an incorrect state, produces an incorrect result, or violates an intended constraint without surfacing an explicit error signal. In the recent literature, the term appears in closely related forms across LLM agents, multi-agent trajectories, safety-critical perception, CI pipelines, medical AI, numerical simulation, and hardware reliability. The common pattern is differential observability: the system appears operational, often even successful, while the relevant error is absent from native logs, return codes, or self-reports, and becomes visible only through external state inspection, downstream inconsistency, or independent verification (Yang et al., 25 Oct 2025, Pathak et al., 6 Nov 2025, Reddy et al., 8 Jul 2026).

1. Definition and scope

The core definition is stable across domains. In multi-agent AI systems, silent failures are failures that occur without explicit error signals even as the system deviates from intended or expected behavior; the deviations are observed in execution trajectories or traces rather than in explicit crash semantics (Pathak et al., 6 Nov 2025). In safety-critical AI, silent wrong-state failures are hazardous states produced by confident but wrong model outputs, such as a perception DNN misclassifying a pedestrian as background while the rest of the stack remains unaware (Yang et al., 25 Oct 2025). In CI, the same idea is operationalized as jobs marked successful that nonetheless fail entirely or partially to complete intended tasks, thereby creating an “illusion of success” (Aïdasso et al., 17 Sep 2025). In medical image classification, silent failures are incorrect predictions assigned high confidence by a confidence scoring function, so the failure is not detected by the confidence layer (Bungert et al., 2023). In hardware and training infrastructure, silent data corruption denotes incorrect computation without explicit failure signals, including cases where software completes but outputs wrong results or converges to different optima (Ma et al., 17 Feb 2025, Dixit et al., 2021).

Two features distinguish silent wrong-state failures from ordinary faults. First, they are not fail-stop: the system does not halt, panic, or return a machine-readable exception. Second, the externally visible artifact often looks plausible. Scientific agents may produce syntactically valid code or physically plausible but incorrect posteriors; production runtimes may turn upstream errors into fluent narratives; CI jobs may return a green check mark; hardware faults may preserve normal control flow while corrupting values (Rawat et al., 28 Apr 2026, Wu, 12 Jun 2026, Aïdasso et al., 17 Sep 2025).

The literature also shows that silent wrong-state failures are not confined to misclassification. They include missing required details, context propagation failures, cycles in agent execution, false success claims, policy-violating tool writes, silent segmentation misses, and state contamination across users (Pathak et al., 6 Nov 2025, Advani, 1 Jun 2026, Yang et al., 1 Apr 2026, Philps et al., 2024).

2. Failure mechanisms and taxonomies

Several taxonomies recur.

In multi-agent trajectories, the principal categories are drift, cycles, and missing details in final output, with related tool failures and context propagation failures also described. Drift denotes divergence from the intended execution path, cycles denote redundant loops or repeated tool/agent invocation, and missing-details failures denote outputs omitting specifically requested elements without surfacing explicit error (Pathak et al., 6 Nov 2025).

In false-success monitoring for LLM agents, the failure mode is defined more narrowly: the agent confidently claims task completion even though the environment state shows that the task was not achieved. The cited benchmarks show that these failures are tied to asserted completion language and other surface proxies rather than verified state changes (Advani, 1 Jun 2026). A closely related action-level formulation appears in tool-using agents: the agent proposes a policy-forbidden write, a policy-permissive tool executes it, and no tool error appears in the trace. The resulting database or environment state is wrong, but the trace contains no recoverable signal of failure (Reddy et al., 8 Jul 2026).

Shared-state agents introduce a distinct cross-session taxonomy. Unintentional cross-user contamination is divided into semantic contamination, where a user-specific interpretation of an ambiguous term persists; transformation contamination, where a user-specific transformation or aggregation rule is reused out of scope; and procedural contamination, where a user-specific workflow becomes a default for later users (Yang et al., 1 Apr 2026). The resulting outputs are often silent wrong answers because the reused artifact remains locally plausible.

A mechanism-oriented taxonomy from a longitudinal production runtime distinguishes environment and platform quirks, design-assumption mismatches, error swallowing and dilution, chained hallucination and fabrication, and operational omission and forensic blind spots. Class D is identified there as unique to LLM systems: the model does not merely fail to report an error but converts it into a fluent, plausible narrative delivered to the user. The paper terms this fail-plausible (Wu, 12 Jun 2026).

Scientific agent studies separate overt failure from silent scientific error. In one-shot astrophysical workflows, the paper defines mutually exclusive categories including wrong parameters and wrong computation. The latter is the canonical silent wrong-state case: code runs and produces plausible output, but formulas, units, or normalization are wrong. In deep-research workflows, the silent failure manifestations include prior-dominated posteriors reported as measurements, unphysical parameter values, parameterization drift between trials, and unreported systematic offsets (Rawat et al., 28 Apr 2026).

Hardware-oriented taxonomies emphasize causal origin. At datacenter scale, defect classes leading to silent data corruption include device errors, early life failures, degradation, and end-of-life wear-out (Dixit et al., 2021). In hardware accelerators, soft errors in control-flow operations create wrong-state progressions that may not manifest until output corruption or abnormal termination (Tanaka et al., 7 May 2025).

3. Observability, formalization, and measurement

Because native error channels are unreliable for this class of failures, the literature formalizes silent wrong-state failures through external observables.

For multi-agent trajectories, anomaly detection is defined over the sequence of executed agentic steps. Traces are instrumented via OpenTelemetry, and 16 features are extracted across token, latency, path, prompt/context, and model categories. Labeling is semi-automated: domain experts define ground-truth trajectories, and scripts compare observed traces against those references while also flagging repeated invocations and explicit errors (Pathak et al., 6 Nov 2025).

In CI, silent failure is operationalized through rerun-initiating successful jobs: successful jobs that were manually rerun despite no change in source code or build scripts. The probability that a successful job is rerun is modeled by the mixed-effects logistic regression

$$\boxed{ logit(P(Y_g = 1)) = \beta_0 + \sum_{i=1}^{n} \beta_i X_i + \theta_g }$$

with 32 independent variables and project-level random effects (Aïdasso et al., 17 Sep 2025).

In medical image classification, silent failures are captured through the combination “wrong prediction + high confidence.” The principal summary metric is the area under the risk-coverage curve: $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$ Lower AURC indicates fewer silent failures after abstention by confidence thresholding (Bungert et al., 2023).

In WMH segmentation, the analogue is an instance missed both by the segmentation and by the uncertainty map. The paper evaluates the proportion of unsegmented lesions flagged as uncertain, the proportion of undetected lesions, and overlap between uncertainty and error via

$$\mathrm{sUEO} = \frac{2\sum_i e_i u_i}{\sum_i (e_i^2 + u_i^2)} .$$

This makes the silent-failure definition lesion-centric rather than image-centric (Philps et al., 2024).

In hardware reliability modeling, application-level silent data corruption rate is estimated compositionally: $$FIT_{SDC} = \Bigg( \sum_{n=1}^{N} f_n \times \Bigg[ \sum_{m=1}^{M} pIAS_{nm} \times pSDC_{nm} \Bigg] \Bigg) \times s .$$ The two-level model separates low-level manifestation into architecture-visible state from application-level propagation to wrong output (Hari et al., 2020).

At training time, silent corruption is measured more locally. The LLM-training study defines mismatch frequency and severity for submodule computations and the worst-case noise-to-signal ratio

$$\mathrm{WCNTS}_i = \max_j \frac{\|g'_{i,j} - g_j\|_2}{\|g_j\|_2},$$

thereby exposing silent divergence even when aggregate loss remains normal (Ma et al., 17 Feb 2025).

4. Detection methodologies

Detection strategies fall into four broad classes: trace-based statistical detection, formal runtime verification, deterministic action gating, and active probing or checker computations.

Trace-based detection is the dominant method in agentic systems. On curated trajectory datasets, supervised methods such as XGBoost, Random Forest, Logistic Regression, SVM, and Naive Bayes are compared with semi-supervised SVDD and Isolation Forest and with unsupervised KMeans. Feature-importance analysis using SHAP indicates that path-level features, such as counts of steps, tools, and agents, are most predictive (Pathak et al., 6 Nov 2025).

Formal runtime verification is represented by the FAME framework. Requirements are specified in Signal Temporal Logic, monitors are synthesized through a toolchain such as RTAMT, and the monitors evaluate observable signals online with constant amortized overhead and bounded memory. A representative property is

$$G \big((\text{dist} < 30 \land \text{is\_ped}) \implies F_{[0,0.1]} (\text{conf} > 0.8)\big).$$

On violation, preverified mitigation can trigger fail-safe, fail-operational, or fail-degraded behavior (Yang et al., 25 Oct 2025).

Deterministic gating operates at the action boundary. In the airline-domain study, read-only pre-execution gates inspect the proposed tool call and current state before allowing a write. The gate suite includes cancellation_eligibility, baggage_allowance, passenger_count, and must_read_before_write; each is a deterministic predicate over tool name, arguments, and database state. This approach targets a bounded class of silent policy-violating writes rather than general reasoning errors (Reddy et al., 8 Jul 2026).

For false-success monitoring, the evidence argues against using LLM judges as primary monitors. Across five judges and five prompt strategies, no configuration exceeds AUROC 0.65 on tau2-bench, and the same judges reach only 0.54 AUROC on AppWorld API-call traces. Lightweight TF-IDF detectors paired with Logistic Regression or XGBoost perform substantially better and at much lower latency (Advani, 1 Jun 2026).

In systems where failure must be detected rather than inferred from outcomes, active probing remains standard. For network silent failures, memoryless schedules choose probe tests independently according to fixed frequencies, yielding geometric detection times with expectation $1/Q_e$, while deterministic schedules provide worst-case bounds. The optimization objective can be average cost,

$$\text{SUM}_e[\mathbf{q}] = \sum_e \frac{p_e}{\sum_{i:e\in s_i} q_i},$$

or worst-case cost under a linear program for $\text{MAX}_e$ (Cohen et al., 2013).

Application-level numerical checking uses paired schemes. A base computation $B_{n+1}$ and a cheap auxiliary computation $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$0 are compared through

$$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$1

and anomaly indicators such as relative jumps and variance changes trigger rollback or recomputation (Benson et al., 2013). In hardware accelerators, specification-derived Petri nets and behavior-derived state sequences provide in-situ monitors for illegal event orders or illegal state transitions (Tanaka et al., 7 May 2025).

5. Empirical findings across domains

The empirical record shows that silent wrong-state failures are common, heterogeneous, and often missed by native monitors.

Domain	Key quantitative findings	Source
Multi-agent trajectories	Two benchmark datasets of 4,275 and 894 trajectories; XGBoost reaches 98.03% and 94.81% accuracy, SVDD 96.47% and 89.63%	(Pathak et al., 6 Nov 2025)
Autonomous perception	In 100 challenging scenarios, 31 silent failures; FAME detects 29/31 (93.5%) with zero false positives in 100 nominal scenarios	(Yang et al., 25 Oct 2025)
Industrial CI	142,387 jobs across 81 projects; 11% of successful jobs rerun; 48% of wasted rerun server time spent on reruns of successful jobs	(Aïdasso et al., 17 Sep 2025)
False success in LLM agents	False success constitutes 45–48% of failures in single-control tau2-bench domains, 3% in dual-control telecom, and 75.8% in AppWorld self-assessing trajectories; best judge AUROC 0.64 on tau2-bench and 0.54 on AppWorld; TF-IDF detectors reach 0.83 and 0.95	(Advani, 1 Jun 2026)
Deterministic action gating	In $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$2-bench airline, full-benchmark success rises from 29.6% to 42.0% on gpt-4o-mini, a +12.4pp lift, and reproduces on a disjoint 15-seed set with +12.3pp	(Reddy et al., 8 Jul 2026)
Shared-state contamination	Under raw shared state, benign interactions produce contamination rates of 57–71%; write-time sanitization reduces contamination from 57% to 6% in shared conversational context but only from 71% to 33% and 60% to 41% in EHRAgent settings	(Yang et al., 1 Apr 2026)
Mathematical reasoning	Silent failure rate 8.8% on 500 GSM8K problems; only 18.4% of correct predictions use stable, faithful reasoning while 81.6% arise through computationally inconsistent pathways	(Sahoo et al., 3 Mar 2026)

Further domain-specific evidence sharpens the picture. In astrophysical workflows, access to domain-specific context produces an approximately $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$3 improvement in the one-shot setting, from $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$4 to $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$5, yet the primary failure mode remains silent incorrect computation. In deep-research tasks, the system produces physically inconsistent posteriors without self-diagnosis (Rawat et al., 28 Apr 2026). In WMH segmentation, combining Stochastic Segmentation Networks with Deep Ensembles yields the highest Dice and lowest AVD score on in-domain and out-of-distribution data, while uncertainty features improve median class balanced accuracy for Fazekas classification from $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$6 to $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$7 in Deep WMH and from $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$8 to $$\mathrm{AURC} = \frac{1}{N} \sum_{i=1}^{N} \mathrm{error\,rate}([\text{samples with } s(x) \geq s(x_i)])$$9 in Periventricular WMH regions (Philps et al., 2024). In production LLM-agent runtime analysis, about 70% of silent failures were caught by human user-view observation, a retrospective audit of 15 incidents found 0% ex-ante prevention but 87% regression blocking, and incident latency ranged from 13 hours to 60 days (Wu, 12 Jun 2026).

6. Mitigation, assurance, and open problems

The mitigation literature converges on one point: silent wrong-state failures usually require an independent checking layer rather than additional confidence in the base model.

The strongest assurance proposals externalize monitoring. FAME surrounds opaque AI components with formally specified, runtime-checkable contracts and predefined mitigations aligned to ISO 26262 and ISO/PAS 8800 (Yang et al., 25 Oct 2025). The PIG Engine and ADE protocol suite pursue a related design principle for long-lived agents: deterministic, external governance rather than memory-resident self-correction. In that framework, entropy is modeled as

$$\mathrm{sUEO} = \frac{2\sum_i e_i u_i}{\sum_i (e_i^2 + u_i^2)} .$$0

with a reported reference $$\mathrm{sUEO} = \frac{2\sum_i e_i u_i}{\sum_i (e_i^2 + u_i^2)} .$$1 per interaction round, and PIG+ADE is reported to reduce the entropy constant by up to 5x–10x while not eliminating eventual reliability thresholds in very large or long-running systems (Liu, 6 Jun 2026). This suggests a research direction in which silent wrong-state failures are managed through bounded disorder and periodic intervention rather than presumed away.

At the same time, several studies caution against overestimating current monitors. In multi-agent trajectory detection, subtle drift without large changes in trace or path features remains hardest to detect, and both SVDD and XGBoost retain false negatives in that regime (Pathak et al., 6 Nov 2025). In false-success monitoring, LLM judges anchor on confident closing language or coarse action-sequence volume rather than verified state changes (Advani, 1 Jun 2026). In medical image classification, none of the benchmarked confidence scoring functions can reliably prevent silent failures across biomedical tasks and distribution shifts (Bungert et al., 2023). In shared-state agents, text-level sanitization is effective for conversational context but leaves substantial residual risk when shared state includes executable artifacts, implying the need for artifact-level defenses, provenance-aware retrieval, and regeneration rather than direct reuse (Yang et al., 1 Apr 2026).

A further theme is that post hoc testing is often better at blocking recurrence than predicting novelty. The longitudinal production-runtime study states that audits are “regression engines, not prediction engines,” and institutionalizes human user-view inspection because it was the most sensitive detector of fail-plausible incidents (Wu, 12 Jun 2026). Hardware and training papers make an analogous point from a different layer: aggregate metrics such as loss, gradient norms, or standard logs may remain normal while state silently diverges, so redundancy, shadow replicas, or direct comparison against healthy nodes become necessary (Ma et al., 17 Feb 2025, Dixit et al., 2022).

The open problem is therefore not merely better anomaly scoring. It is specification of the relevant state, construction of an independent observer, and determination of which invariants can be made state-decidable before irreversible action. Where those conditions hold, deterministic monitors, gates, probes, and verification layers perform well. Where the failure is semantically subtle, cross-session, or converted into plausible narrative, current systems remain dependent on richer context features, artifact-level controls, or human audit (Reddy et al., 8 Jul 2026, Rawat et al., 28 Apr 2026, Wu, 12 Jun 2026).