Verifier Ensembles Sharing Evidence Sources Approve Most Unsafe Agentic Actions

A new benchmark called VP-CONTROL tests runtime verification gates for agentic AI systems using 48 task templates across 2,880 scenarios and six fault regimes. On frozen proposals from two local actor model families, a cross-model vote over shared evidence approved 62.9% of unsafe proposals, compared to 22.9% when an independent evidence source was used, showing evidence-source diversity (40.9 percentage points of effect) matters far more than verifier-model diversity (11.3 percentage points). A calibrated portfolio controller achieved 1.9% unsafe execution with 38.2% automated safe coverage on the locked test set, but transfer to unseen fault families yielded 16-26% residual risk, and a separate FinQA check failed to reproduce the evidence-source effect with the tested small verifiers. A preregistered live study with concurrent writes over hypertext transfer protocol and SQLite found that verifier-only gates were defeated by after-check races, and only a full atomic guard recorded zero unsafe effects across 216 episodes. This is a benchmark and simulation study with synthetic tasks and local models, not a production deployment finding.

rss · arXiv cs.SE · Sep 11, 04:00

Does verifier-model diversity substitute for independent evidence in commit gates?

Many multi-agent and agentic pipelines add verification or approval steps before committing state-changing actions, often assuming that using multiple models or a voting mechanism reduces the chance of approving unsafe actions. This assumption treats model diversity as the main safeguard, but it can leave verifiers dependent on the same upstream evidence, data source, or tool output as the proposing agent, creating a common-mode failure the ensemble cannot detect.

Who is exposed

Organizations running agentic systems with commit gates, approval layers, or multi-agent verification pipelines that rely on cross-model voting without independent evidence sources are in scope. Teams should check whether their verifiers consume the same upstream data, tool calls, or context as the proposing agent, whether verification design distinguishes model diversity from evidence-source diversity, and whether commit-time enforcement (such as transactional or idempotency guards) exists rather than relying solely on pre-commit checks. Exposure is narrower for systems using fully independent evidence pipelines or full atomic guards, and the findings come from a synthetic benchmark with local actor models, so generalization to production tool ecosystems and larger models is not established.

What reduces the risk

No general fix exists, but the study indicates that prioritizing independent evidence sources over additional verifier models, using cost-aware portfolio selection based on deployment-observable metadata, and enforcing full atomic guards or idempotent request identifiers at commit time substantially reduce unsafe execution; calibration and transfer to unseen fault families remain unresolved limitations.

Tags: #agentic AI, #commit gates, #verification/evaluation, #benchmark, #multi-agent systems