Accountability layers in multi-agent AI pipelines often fail to catch errors
Audit Without Verification: When LLM Accountability Layers Relay Rather Than Check
Multiagent Systems
Summary
When multiple AI agents work together across different organizations, it’s hard to find who made a mistake just by reading their reports. The paper shows that these accountability layers often relay information without properly checking it, sometimes blaming innocent parties or missing the real source of errors. The authors found that removing agents’ own conclusions from reports improved error detection but reduced how much the system relied on those reports. This means effective audit layers need evidence independent of agents’ final statements to work well.
What this means in practice
- •For enterprise ai teams: Improve diagnosing faults in multi-agent AI workflows by designing audit layers that use evidence independent of agent conclusions.
- •For legal tech developers: Develop tools that better identify the origin of errors in AI reporting chains by avoiding reliance on agents’ own fault claims.
Authors
Paul-Peter Arslan
Abstract
Multi-agent LLM pipelines increasingly span organisational boundaries; when a fault surfaces, someone must determine where it entered. The artifact available is rarely a full execution trace: it is the reports each agent filed, and a filed report can state a conclusion alongside its observations. Using a pre-registered, institutionally partitioned pipeline of six agents with process-level information boundaries, balanced defect injection and matched clean twins (345,600 requests per chain model, two models), we first report that our pre-registered hypothesis -- that collective responsibility framing degrades escalation with chain length -- is not supported. The layer nevertheless fails asymmetrically. It originates almost nothing: zero allegations across 7,996 clean episodes where every agent stayed silent. It filters upstream error poorly, naming an innocent party in 34.4% and 62.6% of clean episodes where an agent raised a false alarm. Conditional on no agent proposing the true origin (59.5% of episodes on one chain model), an auditor reading the reports recovers it in 4.1% of cases -- below a uniform guess (20%) and the best fixed-link accuser (31.0%) -- while reaching 60.3% from the raw documentation of the same episodes. Deleting one clause, the field carrying the agents' own conclusion, isolates the cause at constant observations: accuracy rises to 45.2% (+41.2 pp, 95% CI +35.3 to +46.9) and adherence collapses from 94.4% to 3.4%; where the suggestion was correct the same deletion instead costs accuracy, 70.5% to 55.7%. The harm replicates on two frontier auditors in four conditions out of four (+8.5 to +39.0 pp) and in a second domain (+47.7 and +61.1 pp), where the cost disappears. The net effect is governed by upstream reliability together with both conditional magnitudes. An accountability layer needs evidence sufficiently independent of the conclusions it verifies.