How Do Hardware Faults Manifest Differently in LLM Agents?

AI summary

Overview

• Research area: Hardware fault resilience in large language model (LLM) agents; multi-agent and agentic systems reliability; AI security and alignment under hardware-induced corruption.
• Technical level: Intermediate. Readers need basic familiarity with LLM inference, agent loops (act–observe–repeat), and the idea of bit flips in model weights, but the paper's framing and metrics are accessible.
• Scope: A systematic fault-injection study measuring how random two-bit weight faults propagate differently through closed-loop LLM agent executions than through single-shot LLM inference, across three agent benchmarks, three models, and 6,814 total executions.

What This Paper Is About

Prior work on hardware faults in LLMs stops at the model output: a corrupted generation is treated as the endpoint of error propagation. The authors ask what happens instead when that corrupted output becomes an intermediate step inside an agent that repeatedly calls tools, observes results, and decides what to do next. Their goal is to characterize whether, and how, fault effects change once corruption enters a closed agent execution loop rather than a single inference call.

Key Contributions

1. First systematic study of hardware-fault resilience in LLM agents. The authors state this as the first evaluation of how random hardware-induced faults affect agents at the system level rather than only at the model-output level.
2. A fault-injection framework for closed-loop agent execution. They inject randomly sampled two-bit weight corruptions into a single model weight, keep the corrupted weight persistent across all LLM invocations in an execution, and leave the agent runtime, tools, and benchmark environment fault-free.
3. A large empirical campaign. 218 tasks across three benchmarks, with 8–13 clean runs and 15–25 fault-injected runs per task, totaling 2,400+ clean runs and 4,300+ fault-injected runs (6,814 executions overall), using Qwen3.6-27B as the primary model and Qwen3.8-27B and Granite4.1-30B for model-dependence checks.
4. A three-dimensional evaluation framing. Task outcome (did the agent complete the task), execution cost (input tokens, output tokens, agent turns), and consequential behavior (benchmark-specific security- and alignment-relevant metrics), rather than a single universal metric.

Main Findings

• Agents can recover from faulty intermediate outputs. On AgentDojo, the only benchmark in the study with multiple agent turns, agents recover from 3.3–25.9% of malformed tool calls via two observed mechanisms: recognizing that an intended environment change did not occur and issuing a corrected call, or comparing the previous call against the tool's schema and reformulating it. Token storms, by contrast, are never recovered from (0.0% recovery across all three models), because those generations contain no valid action and the harness classifies the turn as making no progress and terminates the trajectory.
• Error prevalence varies sharply by model. Token storms occur in 1.3–11.3% of executions (Qwen3.6-27B: 11.3%; Qwen3.8-27B: 1.3%; Granite4.1-30B: 4.8%). Malformed tool calls account for 2.3–61.4% of all tool calls (Qwen3.6-27B: 11.0%; Qwen3.8-27B: 61.4%; Granite4.1-30B: 2.3%), with recovery rates of 24.4%, 25.9%, and 3.3% respectively.
• Recovery costs computation. Faulted executions increase mean output tokens per execution by 38.0% pooled across benchmarks. On HomeBench, exact-match accuracy falls only 4.2 percentage points (75.6% to 71.4%) while mean output tokens rise 51.3% (1,656 to 2,505 per execution). On AgentDojo, output tokens rise 5.6% but input tokens and agent turns decrease slightly by 3.5–5.1%, which inspection attributes to token storms causing early termination. On Agentic Misalignment, output tokens rise 31.7%.
• The overhead is highly skewed. Median output token increases (+3.8–16.6%) are generally smaller than mean increases (+5.6–51.3%), indicating a small fraction of faulted trajectories drives most of the cost. Executions containing token storms account for 96.0% of the additional output tokens.
• Some faults stay fluent but are semantically wrong. The model can produce structurally valid actions that are semantically incorrect or misaligned, including an incorrect numerical interpretation, an unjustified transaction update, and a misdirected escalation. Because the actions remain structurally valid, these errors are hard to detect from generation validity alone.
• Security effects are near-neutral in aggregate, but individual faults can be severe. Controlling for degenerate executions and measuring attack success only over clean–faulted pairs with correct utility where the prompt injection is received, AgentDojo prompt-injection susceptibility differs by only 0.2–1.6 percentage points between clean and faulted execution. However, replaying one randomly injected 2-bit fault that caused a prompt-injection failure across all AgentDojo samples with Qwen3.6-27B increased attack success from 31.0% to 43.0% while preserving utility (56.0% to 58.0%); on AgentDojo's "Slack" suite, attack success rose from 57.0% to 92.0%.
• Alignment effects are model- and scenario-dependent. For Qwen3.6-27B on Agentic Misalignment, faults increased harmful action from 33.3% to 42.2% and classifier verdict from 38.9% to 46.7%. The same trend did not hold consistently for Qwen3.8-27B (harmful action 5.6% to 3.4%; classifier verdict 11.1% to 6.7%) or Granite4.1-30B (harmful action 5.6% to 4.5%; classifier verdict 5.6% to 4.5%). AgentDojo attack success rates were 32.7% to 32.5% (Qwen3.6-27B), 2.6% to 3.0% (Qwen3.8-27B), and 51.3% to 49.7% (Granite4.1-30B).
• Task utility changes are inconsistent. On AgentDojo utility, Qwen3.6-27B moved 56.0% to 52.3%, Qwen3.8-27B 51.0% to 57.0%, and Granite4.1-30B 32.0% to 28.4%, a range of -3.7 to +6.0 percentage points.

Methodology in Plain English

The authors take three existing agent benchmarks and run their tasks many times, first with a healthy model and then with deliberately damaged models. The damage model is a "two-bit fault": for each faulted run, they pick one weight in the model and flip two bits in how that weight is stored. They chose two-bit corruption because it exceeds what the single-error-correcting ECC in modern GPUs can fix, and because prior LLM resilience studies use the same fault model. Crucially, the corrupted weight stays in the model for the whole run, so every subsequent LLM call inside that execution uses the same damaged state, while the agent's tools, runtime, and environment stay healthy. This isolates the effect of persistent model-state corruption from broken tools or bad environment inputs.

Each task is run repeatedly with independently sampled faults, allowing the authors to compare outcomes within the same task. They then measure three things: whether the task was ultimately completed, how much computation was used (input tokens, output tokens, agent turns), and benchmark-specific safety metrics (AgentDojo attack success rate; Agentic Misalignment harmful-action and classifier verdict rates). HomeBench serves as a high-volume structured action-generation workload, AgentDojo as a security-sensitive tool-calling workload, and Agentic Misalignment as consequential autonomous decision-making. Experiments ran in Python 3.11.15 with PyTorch 2.11.0 and CUDA 13.0 via the Inspect AI framework (v0.3.123) and inspect_evals (v0.10.0), on two systems: one with 48 Intel Xeon cores, 768 GB memory, and eight NVIDIA A40 GPUs, and one with 112 Intel Xeon cores, 2 TB memory, and eight NVIDIA H100 GPUs. The paper does not report formal statistical significance testing; the authors list more rigorous statistical analyses as future work.

Why This Matters

Impact on research. The paper argues that model-level resilience evaluations are not sufficient for agentic systems. In a single-turn setting, a corrupted generation is a terminal failure; in an agent, it becomes an intermediate observation that later steps can compensate for, at added cost, or that can silently corrupt environment state. This suggests resilience benchmarks should be scoped to end-to-end agent execution rather than isolated inference, and that the fault model should include persistent state (weights) rather than only per-call perturbations to tools or API responses.

Real-world applications:

• Datacenter LLM serving for agents. Agents run on accelerator-rich platforms with large heterogeneous memory hierarchies, where transient hardware faults remain a reliability concern; this work quantifies what those faults cost in tokens and turns.
• Security-sensitive tool-calling deployments. Faults that leave attack success rates nearly unchanged on average can, in individual corrupted models, raise attack success substantially (31.0% to 43.0% overall, 57.0% to 92.0% on a Slack suite), which matters for prompt-injection defenses.
• Autonomous decision-making systems. Scenarios like the Agentic Misalignment settings show that alignment-relevant behavior can shift under weight corruption for some models and not others, relevant to deployment-time risk assessments.
• Cost and capacity planning. A 51.3% increase in mean output tokens on HomeBench for a 4.2 percentage-point accuracy drop is a capacity-planning signal, particularly because token storms alone account for 96.0% of the added tokens.

Industry relevance. The results give hardware and serving teams a reason to treat faults as a cost and safety variable, not only a correctness variable, and give agent framework developers a reason to add detection for structurally valid but semantically wrong actions and for token storms, which are never recovered from.

Future Directions

• Generalize across fault conditions and agentic environments. The study covers persistent two-bit weight faults across a limited set of models and benchmarks; the authors call for examining whether the prevalence of subtle semantic errors and the pattern of fault propagation hold in other fault models and diverse multi-turn settings.
• Apply more rigorous statistical analysis. The authors state that distinguishing fault-induced behavioral changes from inherent execution variability requires stronger statistics than this campaign provides.
• Investigate individual security-degrading faults further. The finding that a single replayed 2-bit fault raised attack success from 31.0% to 43.0% while preserving utility suggests the search for such faults is its own research problem.
• Inform the design of resilient agentic systems. The stated long-term goal is to use these findings to build systems that tolerate hardware-induced memory faults, including detection and recovery mechanisms for token storms and semantically wrong but structurally valid actions.

Target Audience

Readers who benefit most are: reliability and hardware-fault researchers extending fault-injection work from classifiers and transformers to LLMs and agents; LLM agent and framework developers who need to know how failures manifest in multi-turn closed loops; AI security and alignment researchers interested in how weight corruption interacts with prompt injection and harmful-action rates; and system architects planning compute and token budgets for agentic deployments on GPU clusters. Readers looking for formal statistical guarantees, fault-tolerance mitigations, or results on non-two-bit fault models will not find them here.

Authors’ abstract

We present the first systematic study of the resilience of large language model (LLM) agents to random hardware-induced faults. Prior work on hardware fault resilience in LLMs focuses on model-level outcomes, such as incorrect outputs or generation failures. Yet LLM agents repeatedly interact with tools and environments, creating loops that can change how hardware faults manifest. We conduct an extensive evaluation across three agent benchmarks, comprising 6,814 agent executions: 2,400+ clean runs and 4,300+ fault-injected runs with independently sampled random two-bit weight faults. We trace how these faults propagate through agent execution. Unlike prior studies, we find that agentic execution transforms model-level corruption into distinct system-level outcomes: (1) agents can recover from faulty model outputs and still complete tasks correctly; (2) this recovery increases computational and execution costs; (3) a few faults cause subtle but semantically meaningful errors while the agent otherwise behaves normally; and (4) for some models and scenarios, faults can alter security and alignment behavior.