ClaimArena-LLM: Auditing Adversarial Propagation of False Causal Attributions in Multi-Agent LLM Debates

Abstract

Background: Multi-agent large language model (LLM) systems increasingly rely on structured interaction, debate, and final model-based evaluation, yet an unsupported causal attribution introduced by one participant may propagate through the interaction and influence subsequent decisions. This study introduces ClaimArena-LLM, a controlled framework for auditing adversarial propagation, evidentiary provenance, and final-stage evaluator vulnerability in multi-agent causal reasoning. Methods: ClaimArena-LLM uses 100 synthetic causal incident cases with predefined evidence-supported and false causal propositions. Each case was evaluated under matched adversarial and all-honest debate conditions using four functional roles: investigator, honest analyst, adversarial analyst, and auditor. The experimental program comprised 1460 validated runs, including the 200-run main experiment, claim-source lineage visibility and debate-round ablations, an 800-run balanced model–role rotation, and a 60-run proposition-identifier and presentation-order sensitivity control. Outcomes were scored deterministically from structured causal propositions, evidence references, claim lineage, reports, and auditor verdicts. Results: The adversarial analyst maintained the predefined false causal target with 97.6% mean fidelity. Adversarial exposure increased investigator shifts toward the false target by 16.0 percentage points (Holm-adjusted p = 0.035). At the auditor stage, false-target attribution increased by 11.0 percentage points (adjusted p = 0.043), verdict contamination by 20.0 percentage points (adjusted p = 0.002), and semantic provenance validity decreased by 20.0 percentage points (adjusted p = 0.002). Neither the manipulation nor the false target was explicitly detected. The ablations showed no robust adjusted differences, model–role rotation revealed substantial configuration dependence, and no benchmark-characteristic interaction remained significant after Holm correction. The proposition-identifier and presentation-order sensitivity control showed no statistically robust evidence that fixed proposition encoding explained the observed condition contrasts. Conclusions: Adversarial causal influence in multi-agent LLM systems is selective rather than uniformly propagative and depends strongly on functional role and model–role configuration. Within the tested architecture, a final LLM auditor cannot be assumed to provide an independent safeguard against upstream contamination. Reliable evaluation therefore requires separate assessment of causal correctness, propagation, semantic provenance, and final-stage adversarial awareness rather than reliance on final answer accuracy alone.