Most AI safety research asks the same question: how do we make this model safer? Better training, better alignment, better evaluation. The assumption embedded in that question is that a safer model produces safer behavior when deployed in a real system with other agents and users.
"Position: Safety and Fairness in Agentic AI Depend on Interaction Topology, Not on Model Scale or Alignment" (arXiv:2605.01147), submitted to arXiv on May 1, 2026 by Tanav Singh Bajaj, Nikhil Singh, Karan Anand, and Eishkaran Singh, challenges that assumption directly. Their finding: in multi-agent AI systems, the structure of how agents connect and interact overrides the safety properties of any individual model. Well-aligned models can produce catastrophically unsafe outputs, purely because of how the system is wired together.
The three failure modes
The researchers tested multi-agent loan approval systems across 5,760 synthetic credit applications using models ranging from 3B to 70B parameters. They identified three distinct failure modes, each invisible to standard model-level safety evaluation.
Ordering instability
In sequential agent pipelines, the sequence of roles determines the outcome as much as the quality of reasoning. For LLaMA-3B models, approval rates ranged from 36.4% to 95.4% across the 24 possible orderings of four roles: a 59 percentage point spread. Even at 70B scale, the spread was 21.7 percentage points (71.5% to 93.2%). The same models, the same task, the same applications, completely different outputs depending on which agent went first.
The pattern was consistent: placing the Risk Manager first produced the lowest approval rates; placing the Data Scientist first produced the highest. No amount of alignment work on individual models eliminates this effect, because it is a property of the pipeline sequence, not the models.
Information cascades
In sequential systems, later agents follow earlier agents rather than reason independently. Small 3B models showed roughly 90% inter-agent agreement with 20% error correction, suggesting they were still performing some independent evaluation. At 70B and above, inter-agent agreement rose to over 99.9%, with error correction collapsing to under 0.1%.
Deliberation had effectively stopped. The first agent's judgment propagated through the pipeline unchanged, with remaining agents providing the appearance of review without any of the substance. More capable models formed consensus faster and more completely, amplifying this failure precisely because of their greater capability at reaching coherent agreement.
Functional collapse
Under parallel topology with judge aggregation, LLaMA-3B models produced approximately 98% overall approval across credit tiers, with low-credit applicants approved at 95% and high-credit applicants at 100%. By demographic parity metrics, this looks like a fair, non-discriminatory system. In practice, the system had stopped discriminating at all. Risk assessment had become a formality satisfied through indiscriminate approval rather than equitable evaluation.
Scaling model capability strengthens topology-driven failures rather than alleviating them. More capable models devote more processing to building coherent group agreement and less to independent evaluation. At 70B scale, the near-complete elimination of independent deliberation means the multi-agent system functions as a single-agent system with extra steps, inheriting none of the safety benefits that multiple independent reviewers are supposed to provide.
The regulatory gap this creates
Current AI safety frameworks evaluate models. They assess model outputs, measure model alignment, and certify model behavior. The interaction architecture connecting multiple models sits entirely outside this evaluation framework.
The paper's authors describe this as a fundamental problem and make four concrete governance recommendations. Safety certification should require topological sweeps across architectural variations. Benchmarks should explicitly specify the interaction structure being tested. Deployment should require architectural robustness testing before release. Regulatory disclosure should mandate documentation of system architectures and demonstrated stability across topology variations.
The underlying argument: agentic AI must be treated as a dynamical system, not a collection of aligned components. Interaction topology is a safety parameter that current evaluation methods do not measure. Regulators and deployers are auditing the wrong thing.
What this means in practice
The loan approval scenario represents a broad class of real-world deployments. Multi-agent AI systems are now used in hiring, medical triage, content moderation, legal research, and financial compliance. In most of these contexts, individually certified or evaluated models are connected through architectures that have received no equivalent scrutiny.
A 59 percentage-point swing in loan approval rates from reordering agents implies similar structural instabilities in other high-stakes pipeline decisions. An autonomous medical triage system using sequential agent review faces ordering instability. A hiring screening pipeline using parallel agent voting faces functional collapse. The structure of the pipeline is a safety parameter that current evaluation simply does not capture.
The full paper is available at arxiv.org/abs/2605.01147.
Common questions.
What is interaction topology in multi-agent AI systems?
Interaction topology refers to the structure determining how AI agents connect and communicate in a multi-agent system: which agents go first, which can see others' outputs, how decisions aggregate, and whether deliberation is sequential or parallel. A May 2026 study by Bajaj, Singh, Anand, and Singh demonstrated that this structure determines safety outcomes more than the safety properties of any individual model. The same models, connected differently, produced approval rate differences of up to 59 percentage points across 5,760 test applications.
What are the three topology-driven failure modes?
Ordering instability: in sequential pipelines, which agent goes first determines the outcome as much as the quality of reasoning, with approval rates varying by up to 59 percentage points. Information cascades: later agents follow earlier agents rather than reason independently, with 70B+ models showing 99.9% inter-agent agreement and 0.1% error correction. Functional collapse: in parallel voting systems, agents converge on approval rather than discrimination, satisfying fairness metrics through indiscriminate acceptance while abandoning meaningful risk evaluation. All three are invisible to model-level safety evaluation.
Why does individual model safety not compose into system safety?
A well-aligned model that produces safe outputs in isolation may defer to an earlier agent's judgment rather than apply independent evaluation when placed in a sequential pipeline. Scaling model size worsens this: 70B+ models showed near-complete collapse of independent deliberation because greater capability accelerates consensus formation. The May 2026 paper found that smaller 3B models still applied roughly 20% error correction, while larger models corrected errors only 0.1% of the time. Safety properties of individual models do not add together when the pipeline structure actively eliminates independent deliberation.
What regulatory changes does the paper recommend?
Four recommendations: safety certification should require topological sweeps across architectural variations, not just individual model evaluation; benchmarks should explicitly specify the interaction structure being tested; deployment should require stress-testing for architectural robustness before release; and regulatory disclosure should mandate documentation of system architectures with demonstrated stability across topology variations. The authors argue that interaction topology should become a primary regulatory target alongside model capability and alignment evaluation.