Dataset·Catalogue

Cascade Failure Topologies

Inject a measured error upstream, a hallucination, a tool error, bad context, and trace the blast radius downstream. A catalogue of how failures propagate through a multi-agent system, the mechanism, the blast radius, and how to contain it. Browse it below, or take the raw files.

Snapshot: 2026-06-22
Coverage: 9topologies·5families·8systemic·1terminal
Download

About this dataset

Unit: One row = one failure-propagation topology, with the upstream trigger, the propagation mechanism, the downstream blast radius, the MAST failure categories it maps to, how to detect it, how to contain it, and a defining citation.
Families: Propagation, amplification, verification bypass, lock-in, coordination, and context rot.
Severity: Localized (a few nodes), systemic (spreads across the run), or terminal (collapses the task).
Sources: Literature-grounded for now: arXiv, multi-agent failure taxonomies (MAST), and red-team reports. The Hermosa collab engine and blackboard games are a ready-made rig for empirical injection runs; a topology can later cite a run instead of a paper.
License: Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).
Cite: Hermosa Labs LLC, “Cascade Failure Topologies,” 2026-06-22.

The catalogue

Propagation2

An error spreads node to node as shared context.

Hallucination Fan-Out

[systemic]

Trigger: A single agent emits a hallucinated or unsupported claim into a shared artifact.
Mechanism: Downstream agents consume the claim as ground truth and build on it, so one local error becomes shared team context that no single agent re-checks.
Blast radius: Every agent that reads the poisoned artifact inherits the error; the affected set grows with the fan-out degree of the topology.

Detection & mitigation

Detection: Divergence between a propagated claim and its cited source; an independent verifier that re-derives the fact disagrees with the consumed value.
Mitigation: Independent verification before an artifact is shared (build-verify-reflect); provenance tags so downstream agents can discount unsourced claims.
MAST: Cat 2, Cat 3

Why Do Multi-Agent LLM Systems Fail? (MAST, arXiv:2503.13657)

Non-Local Failure Propagation

[systemic]

Trigger: A failure originates at one workflow node (via a natural-language interaction, tool invocation, or control-logic error) but produces no observable symptom at the point of origin.
Mechanism: The erroneous output flows downstream as apparently valid data; subsequent nodes consume it and build further actions on it, so the visible failure symptom materializes at a node far removed from the actual root cause, entangling attribution.
Blast radius: In 32% of observed failures the root-cause node differs from the symptom node, with propagation distances exceeding 40% of total workflow length in over 10% of cases; LLM/Agent and Logic/Control nodes are disproportionately prone to non-local manifestation.

Detection & mitigation

Detection: Causal-attribution tracing that links observable failure symptoms back through the dependency graph to their origin node; runtime provenance logs on each inter-node message.
Mitigation: Lightweight validation gates at each stage boundary so bad output is caught at the producer node before entering the shared message channel; anomaly detection on inter-node payloads rather than only on final output.
MAST: Cat 1, Cat 2, Cat 3

Demystifying the Lifecycle of Failures in Platform-Orchestrated Agentic Workflows (arXiv:2509.23735)

Amplification3

An error grows or compounds as it travels.

Hub-Entry Cascade Collapse

[terminal]

Trigger: An error seed is injected at or adopted by the central hub/supervisor node of a centralized multi-agent topology.
Mechanism: Because the hub is the strict informational cut-set, its adoption of an error immediately broadcasts the falsehood to all connected workers, producing system-wide infection governed by the principal eigenvector of the dependency graph; the same error content causes 100% system-wide failure from the hub versus 9.7% from a leaf node.
Blast radius: Hub injection causes system-wide failure (100% in a centralized LangGraph topology) versus 9.7% from a leaf node; per-framework Impact Factor 10.31x (LangGraph), 6.29x (CrewAI).

Detection & mitigation

Detection: Sharp discontinuous jump in aggregate error rate when the central coordinator's output changes; divergence between hub output and an independent re-derivation from raw inputs.
Mitigation: Quarantine the hub behind an independent verifier before downstream broadcast; distribute authority so no single node is a strict cut-set; genealogy-graph governance layer that tracks message provenance and suppresses amplification.
MAST: Cat 1, Cat 2, Cat 3

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration (arXiv:2603.04474)

Error-Crystallization Amplification

[systemic]

Trigger: A single atomic factuality or faithfulness error is injected into (or arises within) a shared multi-agent interaction chain.
Mechanism: The seed error is repeatedly cited and reused across the agent dependency graph; each agent that adopts it raises the probability that connected agents adopt it too (non-linear contagion modeled via spectral-radius growth), and when the system enters a supercritical regime the error crystallizes into shared constraints that all subsequent steps are built upon, making correction increasingly costly.
Blast radius: Without intervention, the cascade infects the majority of agent runs; the error solidifies into shared context artifacts (sources, assumptions, code skeletons, evaluation criteria) that downstream agents treat as ground truth.

Detection & mitigation

Detection: Monitor per-agent adoption rate of a specific claim; rapid cross-agent agreement on an unverified claim signals supercritical propagation; spectral-radius analysis of the dependency graph identifies the highest-leverage infection vectors.
Mitigation: Maintain an immutable reference layer that agents check before adopting a peer's claim; introduce governance probes that inject verified contradictions to arrest supercritical spread; require independent sourcing before a claim enters the shared constraint layer.
MAST: Cat 2, Cat 3

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration (arXiv:2603.04474)

Judge-Panel Bias Amplification

[systemic]

Trigger: An LLM-as-judge ensemble is deployed to produce a more reliable evaluation signal, with agents running a multi-round debate to reach a verdict.
Mechanism: Existing biases (position, verbosity, bandwagon) are amplified sharply after the first debate round and remain elevated in all subsequent rounds, so the multi-agent ensemble produces a more biased verdict than a single judge would have -- the social dynamic of debate turns a calibration problem into an entrenched directional error.
Blast radius: Every downstream decision, ranking, or reward signal derived from the panel verdict inherits the amplified bias; systems that use the panel as a trusted oracle are systematically steered by the distorted signal.

Detection & mitigation

Detection: Bias audit against held-out gold labels across multiple panel runs; variance tracking across rounds (rising bias with round count is the signal); comparison against a calibrated single-judge baseline.
Mitigation: Use meta-judge architectures (which the paper shows exhibit greater bias resistance) rather than open debate; inject a calibrated bias-free agent as a standing panel member; apply PINE-style debiasing before aggregation.
MAST: Cat 2, Cat 3

Judging with Many Minds: Bias Amplification in Multi-Agent LLM-as-Judge (arXiv:2505.19477)

Verification bypass1

The cascade defeats a verifier or safety gate.

Consistency Illusion: Reasoning-Level Divergence Under Answer Consensus

[systemic]

Trigger: A multi-agent system uses answer-level agreement across agents as a reliability signal in a safety-critical context such as medical question answering.
Mechanism: Debate reduces detectable contradictions between agents' surface answers while simultaneously decreasing the semantic similarity of their reasoning chains, so the consensus-as-reliability heuristic certifies an answer whose underlying justifications are actually diverging -- the agreement is a statistical artifact, not an epistemic one.
Blast radius: Any downstream stage that gates on the consensus signal (routing, human review escalation, confidence thresholding) inherits the false certification; errors embedded in divergent reasoning chains are never surfaced because the answer-level checkpoint passes.

Detection & mitigation

Detection: Cross-agent reasoning alignment metrics (e.g., CARA) that measure semantic similarity of reasoning chains independently of answer agreement; flag cases where answer consensus is high but reasoning alignment is low.
Mitigation: Require agents to commit to named facts and explicit stances on each other's claims (Grounded Debate Protocol); audit reasoning alignment alongside accuracy before treating consensus as a trust signal.
MAST: Cat 3

The Consistency Illusion: How Multi-Agent Debate Hides Reasoning Misalignment (arXiv:2606.08457)

Lock-in1

The team anchors on a wrong answer and freezes.

Sycophantic Consensus Lock-In

[systemic]

Trigger: An early or confidently stated answer (possibly wrong) is surfaced to the group.
Mechanism: Sycophantic agreement and anchoring suppress dissent; agents converge on the initial position regardless of correctness, and a verification step rubber-stamps the majority.
Blast radius: The whole deliberation collapses to one position; correct minority signals are lost and the error is laundered as consensus.

Detection & mitigation

Detection: Unusually fast or unanimous agreement; low variance across independent samples; a held-out skeptic that still dissents when the group does not.
Mitigation: Independent sampling before any exchange; an adversarial or skeptic role required to refute; anti-consensus weighting that rewards a correct minority over a correlated majority.
MAST: Cat 2, Cat 3

Towards Understanding Sycophancy in Language Models (arXiv:2310.13548)

Context rot2

A poisoned shared store or memory degrades every reader.

Poisoned-Experience Cross-Session Drift

[systemic]

Trigger: An attacker plants a small set of malicious procedure templates in an agent's long-term RAG memory store alongside legitimate experiences.
Mechanism: Future agent instantiations load the poisoned store from disk; semantic similarity retrieval surfaces the malicious templates whenever a task resembles the poisoned entries, causing the agent to adopt unsafe patterns, and the behavioral drift propagates across sessions and across users without further attacker intervention.
Blast radius: Every future session of the agent and every user it serves after the memory is poisoned; a small number of poisoned records can dominate retrieved experiences on benign workloads.

Detection & mitigation

Detection: Behavioral anomaly detection across sessions; comparison of retrieved experience templates against an allowlisted baseline; monitoring for retrieval of low-trust memory records.
Mitigation: Trust-scored memory retrieval that discounts records below a provenance threshold; memory sanitization before persistence; periodic memory audits that replay experiences against a verifier.
MAST: Cat 1, Cat 3

MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval (arXiv:2512.16962)

Shared-State Cross-User Contamination

[systemic]

Trigger: A benign user interaction produces a scope-bound artifact (interpretation, transformation rule, or workflow) that persists in a shared agent state layer.
Mechanism: When a subsequent user queries the same shared-state agent, the agent silently reapplies the prior user's artifact without scope-checking, producing a silent wrong answer; no adversary is required and the contamination rate reaches 57–71% under raw shared state.
Blast radius: All users served by the same shared-state agent instance; each contaminating interaction raises the probability of corrupting subsequent users, compounding across the user population.

Detection & mitigation

Detection: Divergence between a user's explicit query intent and the agent's response; monitoring for artifact reuse across user-session boundaries; A/B comparison against an isolated-state baseline.
Mitigation: Write-time sanitization (Sanitized Shared Interaction) that strips user-specific scope before persisting artifacts; per-user context isolation; scope tags that prevent cross-user artifact reuse.
MAST: Cat 1, Cat 3

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents (arXiv:2604.01350)

Cascade Failure Topologies

Snapshot

2026-06-22

Coverage

9topologies·5families·8systemic·1terminal

Download

About this dataset

Unit

One row = one failure-propagation topology, with the upstream trigger, the propagation mechanism, the downstream blast radius, the MAST failure categories it maps to, how to detect it, how to contain it, and a defining citation.

Families

Propagation, amplification, verification bypass, lock-in, coordination, and context rot.

Severity

Localized (a few nodes), systemic (spreads across the run), or terminal (collapses the task).

Sources

Literature-grounded for now: arXiv, multi-agent failure taxonomies (MAST), and red-team reports. The Hermosa collab engine and blackboard games are a ready-made rig for empirical injection runs; a topology can later cite a run instead of a paper.

License

Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).

Cite

Hermosa Labs LLC, “Cascade Failure Topologies,” 2026-06-22.

The catalogue

Propagation2

An error spreads node to node as shared context.

Hallucination Fan-Out

[systemic]

Trigger: A single agent emits a hallucinated or unsupported claim into a shared artifact.
Mechanism: Downstream agents consume the claim as ground truth and build on it, so one local error becomes shared team context that no single agent re-checks.
Blast radius: Every agent that reads the poisoned artifact inherits the error; the affected set grows with the fan-out degree of the topology.

Detection & mitigation

Detection: Divergence between a propagated claim and its cited source; an independent verifier that re-derives the fact disagrees with the consumed value.
Mitigation: Independent verification before an artifact is shared (build-verify-reflect); provenance tags so downstream agents can discount unsourced claims.
MAST: Cat 2, Cat 3

Why Do Multi-Agent LLM Systems Fail? (MAST, arXiv:2503.13657)

Non-Local Failure Propagation

[systemic]

Trigger: A failure originates at one workflow node (via a natural-language interaction, tool invocation, or control-logic error) but produces no observable symptom at the point of origin.
Mechanism: The erroneous output flows downstream as apparently valid data; subsequent nodes consume it and build further actions on it, so the visible failure symptom materializes at a node far removed from the actual root cause, entangling attribution.
Blast radius: In 32% of observed failures the root-cause node differs from the symptom node, with propagation distances exceeding 40% of total workflow length in over 10% of cases; LLM/Agent and Logic/Control nodes are disproportionately prone to non-local manifestation.

Detection & mitigation

Detection: Causal-attribution tracing that links observable failure symptoms back through the dependency graph to their origin node; runtime provenance logs on each inter-node message.
Mitigation: Lightweight validation gates at each stage boundary so bad output is caught at the producer node before entering the shared message channel; anomaly detection on inter-node payloads rather than only on final output.
MAST: Cat 1, Cat 2, Cat 3

Demystifying the Lifecycle of Failures in Platform-Orchestrated Agentic Workflows (arXiv:2509.23735)

Amplification3

An error grows or compounds as it travels.

Hub-Entry Cascade Collapse

[terminal]

Trigger: An error seed is injected at or adopted by the central hub/supervisor node of a centralized multi-agent topology.
Mechanism: Because the hub is the strict informational cut-set, its adoption of an error immediately broadcasts the falsehood to all connected workers, producing system-wide infection governed by the principal eigenvector of the dependency graph; the same error content causes 100% system-wide failure from the hub versus 9.7% from a leaf node.
Blast radius: Hub injection causes system-wide failure (100% in a centralized LangGraph topology) versus 9.7% from a leaf node; per-framework Impact Factor 10.31x (LangGraph), 6.29x (CrewAI).

Detection & mitigation

Detection: Sharp discontinuous jump in aggregate error rate when the central coordinator's output changes; divergence between hub output and an independent re-derivation from raw inputs.
Mitigation: Quarantine the hub behind an independent verifier before downstream broadcast; distribute authority so no single node is a strict cut-set; genealogy-graph governance layer that tracks message provenance and suppresses amplification.
MAST: Cat 1, Cat 2, Cat 3

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration (arXiv:2603.04474)

Error-Crystallization Amplification

[systemic]

Trigger: A single atomic factuality or faithfulness error is injected into (or arises within) a shared multi-agent interaction chain.
Mechanism: The seed error is repeatedly cited and reused across the agent dependency graph; each agent that adopts it raises the probability that connected agents adopt it too (non-linear contagion modeled via spectral-radius growth), and when the system enters a supercritical regime the error crystallizes into shared constraints that all subsequent steps are built upon, making correction increasingly costly.
Blast radius: Without intervention, the cascade infects the majority of agent runs; the error solidifies into shared context artifacts (sources, assumptions, code skeletons, evaluation criteria) that downstream agents treat as ground truth.

Detection & mitigation

Detection: Monitor per-agent adoption rate of a specific claim; rapid cross-agent agreement on an unverified claim signals supercritical propagation; spectral-radius analysis of the dependency graph identifies the highest-leverage infection vectors.
Mitigation: Maintain an immutable reference layer that agents check before adopting a peer's claim; introduce governance probes that inject verified contradictions to arrest supercritical spread; require independent sourcing before a claim enters the shared constraint layer.
MAST: Cat 2, Cat 3

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration (arXiv:2603.04474)

Judge-Panel Bias Amplification

[systemic]

Trigger: An LLM-as-judge ensemble is deployed to produce a more reliable evaluation signal, with agents running a multi-round debate to reach a verdict.
Mechanism: Existing biases (position, verbosity, bandwagon) are amplified sharply after the first debate round and remain elevated in all subsequent rounds, so the multi-agent ensemble produces a more biased verdict than a single judge would have -- the social dynamic of debate turns a calibration problem into an entrenched directional error.
Blast radius: Every downstream decision, ranking, or reward signal derived from the panel verdict inherits the amplified bias; systems that use the panel as a trusted oracle are systematically steered by the distorted signal.

Detection & mitigation

Detection: Bias audit against held-out gold labels across multiple panel runs; variance tracking across rounds (rising bias with round count is the signal); comparison against a calibrated single-judge baseline.
Mitigation: Use meta-judge architectures (which the paper shows exhibit greater bias resistance) rather than open debate; inject a calibrated bias-free agent as a standing panel member; apply PINE-style debiasing before aggregation.
MAST: Cat 2, Cat 3

Judging with Many Minds: Bias Amplification in Multi-Agent LLM-as-Judge (arXiv:2505.19477)

Verification bypass1

The cascade defeats a verifier or safety gate.

Consistency Illusion: Reasoning-Level Divergence Under Answer Consensus

[systemic]

Trigger: A multi-agent system uses answer-level agreement across agents as a reliability signal in a safety-critical context such as medical question answering.
Mechanism: Debate reduces detectable contradictions between agents' surface answers while simultaneously decreasing the semantic similarity of their reasoning chains, so the consensus-as-reliability heuristic certifies an answer whose underlying justifications are actually diverging -- the agreement is a statistical artifact, not an epistemic one.
Blast radius: Any downstream stage that gates on the consensus signal (routing, human review escalation, confidence thresholding) inherits the false certification; errors embedded in divergent reasoning chains are never surfaced because the answer-level checkpoint passes.

Detection & mitigation

Detection: Cross-agent reasoning alignment metrics (e.g., CARA) that measure semantic similarity of reasoning chains independently of answer agreement; flag cases where answer consensus is high but reasoning alignment is low.
Mitigation: Require agents to commit to named facts and explicit stances on each other's claims (Grounded Debate Protocol); audit reasoning alignment alongside accuracy before treating consensus as a trust signal.
MAST: Cat 3

The Consistency Illusion: How Multi-Agent Debate Hides Reasoning Misalignment (arXiv:2606.08457)

Lock-in1

The team anchors on a wrong answer and freezes.

Sycophantic Consensus Lock-In

[systemic]

Trigger: An early or confidently stated answer (possibly wrong) is surfaced to the group.
Mechanism: Sycophantic agreement and anchoring suppress dissent; agents converge on the initial position regardless of correctness, and a verification step rubber-stamps the majority.
Blast radius: The whole deliberation collapses to one position; correct minority signals are lost and the error is laundered as consensus.

Detection & mitigation

Detection: Unusually fast or unanimous agreement; low variance across independent samples; a held-out skeptic that still dissents when the group does not.
Mitigation: Independent sampling before any exchange; an adversarial or skeptic role required to refute; anti-consensus weighting that rewards a correct minority over a correlated majority.
MAST: Cat 2, Cat 3

Towards Understanding Sycophancy in Language Models (arXiv:2310.13548)

Context rot2

A poisoned shared store or memory degrades every reader.

Poisoned-Experience Cross-Session Drift

[systemic]

Trigger: An attacker plants a small set of malicious procedure templates in an agent's long-term RAG memory store alongside legitimate experiences.
Mechanism: Future agent instantiations load the poisoned store from disk; semantic similarity retrieval surfaces the malicious templates whenever a task resembles the poisoned entries, causing the agent to adopt unsafe patterns, and the behavioral drift propagates across sessions and across users without further attacker intervention.
Blast radius: Every future session of the agent and every user it serves after the memory is poisoned; a small number of poisoned records can dominate retrieved experiences on benign workloads.

Detection & mitigation

Detection: Behavioral anomaly detection across sessions; comparison of retrieved experience templates against an allowlisted baseline; monitoring for retrieval of low-trust memory records.
Mitigation: Trust-scored memory retrieval that discounts records below a provenance threshold; memory sanitization before persistence; periodic memory audits that replay experiences against a verifier.
MAST: Cat 1, Cat 3

MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval (arXiv:2512.16962)

Shared-State Cross-User Contamination

[systemic]

Trigger: A benign user interaction produces a scope-bound artifact (interpretation, transformation rule, or workflow) that persists in a shared agent state layer.
Mechanism: When a subsequent user queries the same shared-state agent, the agent silently reapplies the prior user's artifact without scope-checking, producing a silent wrong answer; no adversary is required and the contamination rate reaches 57–71% under raw shared state.
Blast radius: All users served by the same shared-state agent instance; each contaminating interaction raises the probability of corrupting subsequent users, compounding across the user population.

Detection & mitigation

Detection: Divergence between a user's explicit query intent and the agent's response; monitoring for artifact reuse across user-session boundaries; A/B comparison against an isolated-state baseline.
Mitigation: Write-time sanitization (Sanitized Shared Interaction) that strips user-specific scope before persisting artifacts; per-user context isolation; scope tags that prevent cross-user artifact reuse.
MAST: Cat 1, Cat 3

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents (arXiv:2604.01350)