Earlier today I wrote about how multi-agent decomposition degrades governance compliance — facts attenuate at handoff boundaries. That paper (Governance at the Boundary) referenced a companion problem: hallucinations transform across handoffs and become undetectable. That companion paper just appeared on arXiv. And the numbers are worse than you'd expect.
The Hallucination Snowball: Modeling Error Propagation as State Transitions in Multi-Agent LLM Pipelines by Prabhjot Singh and Bhushan Pawar (accepted at FAGEN Workshop, ICML 2026) formalizes what anyone who's debugged a multi-agent pipeline suspects but can't prove: a hallucination injected at step 1 does not merely survive — it metamorphoses into forms the next agent cannot detect.
The Four States of a Dying Fact
The authors define a first-order Markov process over four states:
graph LR
S1[Raw Fact] -->|"escape: 24.6%"| S2[Derived Computation]
S2 -->|"escape: 48.3%"| S3[Narrative Prose]
S3 -->|"escape: 89.3%"| S4[Invisible]
style S1 fill:#3b82f6,stroke:#1d4ed8,color:#fff
style S2 fill:#f59e0b,stroke:#d97706,color:#fff
style S3 fill:#ef4444,stroke:#dc2626,color:#fff
style S4 fill:#6b7280,stroke:#4b5563,color:#555
The pipeline is a 4-agent financial analyst chain on FinanceBench: Data Collector → Calculator → Writer → Editor. At each handoff, a hallucination transforms. A fabricated revenue figure (raw fact) becomes a computed growth rate (derived), then a sentence in a report (narrative), then an editorially approved conclusion (invisible). Each transformation makes it harder to detect — not by the sender, not by the receiver, but by the structure of the pipeline itself.
The per-boundary escape probabilities tell the story: a 24.6% chance the raw fact is flagged at stage 1–2. By stage 3–4, 89.3% of hallucinations that reach that boundary escape — because by then they look like normal narrative text.
The Numbers, Disaggregated
346 hallucinations were automatically injected into 4-agent pipelines across FinanceBench and tracked through the entire chain. The detection numbers for gpt-4o:
- Stage 1 (Raw Fact): 72.0% detected
- Stage 2 (Derived): 65.7% detected
- Stage 3 (Narrative): 47.9% detected
- Stage 4 (Invisible): 50.9% detected
- Final output (undetected): 23.7% survive completely
The best model tested was Qwen3.5-397B-A17B, which catches 87.0% at Stage 1. But even that hits a structural ceiling: projected Stage 4 detection is only ~60–65%. The degradation is not a model quality problem — it's a pipeline architecture problem.
The Most Important Result: When You Verify Matters More Than Whether You Verify
This is the finding that every framework maintainer needs to read twice:
| Verification strategy | Hallucination survival |
|---|---|
| No verification | ~58.4% |
| End-of-pipeline checking only | ~56.1% (2.3 pp improvement) |
| Boundary gates (verify at each handoff) | 16.2% |
Same RAG verification tool. Same model. The only difference is placement. End-checking is nearly useless (Cohen's h = -0.911, p < 0.000001 for boundary vs end). The authors' optimization prescription: invest verification resources at S₁→S₂ first, where 75.4% of hallucinations are still catchable, not at S₃→S₄ where 89.3% have already escaped.
Why This Matters Right Now
Every major agent framework shipping today — LangGraph, CrewAI, AutoGen, MCP-based chains, A2A delegation — defaults to sequential pipelines. The pitch is modularity. The hidden cost is structural hallucination amplification.
Two implications for builders:
1. Your end-to-end tests are misleading. They measure the output the Editor produced, not the fact the Data Collector hallucinated. A pipeline can produce a plausible final report while 23.7% of its internal facts are fabricated. Standard E2E evaluation will miss this because the transformations are lossy but coherent.
2. The fix is architectural, not model-level. You don't need a better verifier — you need verifiers at the boundaries, not the exit. The authors show this with an elegant formal model that predicts survival for n-agent linear pipelines. Moving verification from the end to the boundaries is a 3.6× reduction in hallucination survival using identical tools.
Limitations
- Linear pipeline only: The Markov model holds for sequential chains. Branched, hierarchical, or cyclic topologies (orchestrator-subagent, debate loops) may exhibit different amplification dynamics. The governance boundary paper found orchestrator-subagent was worse for policy attenuation; the same may hold here.
- Single domain: FinanceBench is financial analysis. The state transition model generalizes (the mechanism is architecture-level), but specific escape probabilities will shift with domain, model, and task complexity.
- Injections, not natural hallucinations: 346 manually injected errors with known ground truth is a controlled setting. Natural hallucinations in production pipelines may follow different distributions — harder to inject but also harder to characterize.
- Four agents, fixed roles: The Collector→Calculator→Writer→Editor chain is one specific decomposition. Agent specialization, prompt design, and model assignment all affect escape rates.
- Workshop paper length: 10 pages, 3 figures. The formal model for n-agent pipelines is sketched but not fully validated on longer chains. The projected detection ceiling for Qwen3.5 needs experimental verification.
The Upshot
The governance boundary paper and the hallucination snowball paper are two sides of the same coin. One shows that policy-relevant facts get lost at handoffs. The other shows that hallucinated facts transform and hide at handoffs. Together they make an uncomfortable case: multi-agent pipelines have a structural vulnerability that no single-model improvement can fix.
The fix in both cases is the same: verify at the boundaries, not at the exit. Gate each handoff with a verification layer that has access to the original evidence. Don't let the Editor decide whether the Writer's prose is true — check each transformation against the source before passing it along.
If you're shipping a multi-agent system in production today, these two papers should be required reading for your architecture review. The handoffs are where your system's integrity goes to die.
- The Hallucination Snowball: Modeling Error Propagation as State Transitions in Multi-Agent LLM Pipelines — Prabhjot Singh, Bhushan Pawar, Jun 2026 (FAGEN Workshop, ICML 2026)