When Agents "Misremember" Collectively: Exploring the Mandela Effect in LLM-based Multi-Agent Systems

AI summary

Overview

Research area: Natural Language Processing, specifically large language model (LLM) based multi-agent systems, collective cognitive bias, and AI memory robustness.

Technical level: Intermediate. The paper's concepts (false memories, social influence, group debate) are intuitive, but interpreting the results requires familiarity with benchmark design, error/shift metrics, and multi-agent interaction protocols.

Scope in one sentence: The paper builds a benchmark called ManBench (20 tasks, 4,838 multiple-choice questions, five interaction protocols) and uses it to test whether 13 LLMs operating in multi-agent groups can be made to collectively misremember verifiable facts, what drives that effect, and how to reduce it.

What This Paper Is About

When multiple LLM agents talk to each other, false information introduced by one agent can be reinforced by others until the group "remembers" something that never happened. The authors call this the Mandela effect, named after the real-world phenomenon in which groups share a false memory of a verifiable fact (the paper notes the term was proposed by Fiona Broome in 2009, referring to widespread false memories that Nelson Mandela died in prison in the 1980s, though he actually passed away in 2013).

The goal is to measure whether this collective false memory exists in LLM-based multi-agent systems, identify the factors that strengthen or weaken it, and test defenses that keep agents anchored to facts.

Key Contributions

1. ManBench, a benchmark designed specifically for the Mandela effect in LLM-based multi-agent systems, comprising four task domains susceptible to the effect, 20 tasks, 4,838 questions, and five interaction protocols that vary in group composition and memory timescale.

2. A quantitative measurement framework with three metrics: error rate (Err^P), reality shift rate (σ^P), and maximal reality shift rate (σ_max), applied to 13 representative LLMs spanning commercial and open-source models.

3. A factor analysis of what drives the Mandela effect, covering group composition (generic vs. role-based), memory timescale (short-term vs. long-term), group size, knowledge domain, and model scale.

4. Mitigation strategies at two levels: prompt-level defenses (cognitive anchoring and source scrutiny) and a model-level supervised fine-tuning defense, reported as achieving an average 74.40% reduction in the Mandela effect compared to the baseline.

The paper states that code and dataset are available at https://github.com/bluedream02/Mandela-Effect.

Main Findings

• No evaluated LLM is immune. Error rates rise for every one of the 13 models once social influence is applied. Qwen-235B's error rate climbs from 25.48% at baseline to 74.75% under the Role-based Short-term Protocol. GPT-5 has the lowest baseline error rate at 17.63%, but its error rate more than doubles to 41.59% under the Role-based Short-term Protocol.

• Role-based groups are more persuasive than generic groups. For nearly all models, reality shift rates under role-based protocols (σ^RS, σ^RL) exceed those under generic protocols (σ^GS, σ^GL). Claude 4 Sonnet rises from 15.45% (σ^GS) to 35.21% (σ^RS); GPT-4o rises from 46.04% (σ^GS) to 55.95% (σ^RS). Deepseek-V3.1 is the sole exception, more vulnerable to the Generic Group (σ^GS = 60.60%) than the Role-based Group (σ^RS = 47.81%).

• Short-term false memories can solidify into long-term beliefs, but not always. GPT-5's reality shift rate falls from 31.03% (σ^RS) to 1.67% (σ^RL), and Llama3.3-70B also retains long-term memory integrity. In contrast, Claude 3.5 Haiku barely drops, from 63.67% (σ^RS) to 55.63% (σ^RL), and Llama3.1-8B actually rises from 61.69% (σ^GS) to 85.13% (σ^GL).

• Generic groups saturate at a small size. Under generic protocols, error and reality shift rates rise with more agents and then plateau; the paper reports GPT-4o-mini and Claude 3.5 Haiku going from about 37% with one agent to roughly 56% when the group reaches seven members, indicating seven agents are sufficient to exert maximum influence.

• Role-based groups follow an inverted-U. The Mandela effect peaks at a group size of six agents (σ^RS exceeding 63%) and then declines. For groups of nine or more agents, error rates fall below the Baseline Reality Protocol (Err^RS and Err^RL both under 32%), which the authors attribute to "suspicion-induced vigilance" — a large coordinated group reads as a suspicious conspiracy and triggers critical thinking.

• Ambiguous and specialized domains are most vulnerable. "History, Time, & Events" (σ^RS = 58.74%) and "Misconceptions & Social Cognition" (σ^RS = 52.67%) show high susceptibility, while "Domain-Specific Knowledge" reaches the highest initial shift at 67.46% (σ^RS) and the most persistent long-term false belief (σ^RL = 37.77%). Even "General Knowledge," with a low baseline error rate of 9.40%, shows a σ^GS of 48.06%.

• Scaling does not reliably help. In the Claude 3.5 family, σ_max falls from 72.0% (Haiku) to 39.6% (Sonnet), and the GPT family shows similar improvements. But Qwen3 shows inverse scaling, with σ_max rising from 89.3% (8B) to 92.2% (235B).

• Prompt-level defenses work, with trade-offs. For GPT-4o under the Generic Short-term Protocol, susceptibility drops from a 46.0% baseline to 17.8% with cognitive anchoring and 26.5% with source scrutiny. Under the Role-based Short-term Protocol, cognitive anchoring reduces σ^RS from 56.0% to 17.0% versus 25.2% for source scrutiny. Under long-term protocols the two converge: σ^RL falls from 33.6% to 15.2% (cognitive anchoring) and 14.5% (source scrutiny).

• Balanced fine-tuning beats one-sided fine-tuning. Training only on the resilience set pushes Llama3's σ^RS down from 99.5% to 18.2%, but makes the model reject all outside input — its σ^C under the Correct Guidance Protocol surges to 38.5%, worse than the untrained baseline. Training on the combined resilience and cooperative dataset brings σ^RS to 21.5% while keeping σ^C at 1.1%. A model trained only on the cooperative set reaches σ^C of 0.8%.

Methodology in Plain English

The authors start from BIG-Bench Hard (BBH) because its questions have verifiable correct answers (so memory deviation can be measured) and plausible distractors (so false claims have something to latch onto). For each question they prompt an LLM to select the most plausible incorrect answer, which becomes the "distractor" used as the false claim. Tasks are sorted into four domains: History, Time, & Events; Misconceptions & Social Cognition; General Knowledge; and Domain-Specific Knowledge. After subsampling, the dataset contains 4,838 multiple-choice questions across 20 tasks.

Evaluation happens in two phases. In Phase 1, a subject agent answers questions alone under the Baseline Reality Protocol, establishing what it actually knows. In Phase 2, the agent is exposed to one of four protocols that cross two axes:

• Group composition: a Generic Group of undifferentiated agents taking turns reinforcing a false consensus, or a Role-based Group of five specialized agents — an Error Conclusion Initiator, a Detail Support Provider, a Group Consensus Reinforcer, an Authority Endorser, and a Questioning Compromiser — each delivering distinct false evidence.
• Memory timescale: Short-term mode assesses the agent in the same conversation where the influence occurred; Long-term mode first consolidates the dialogue into a summary of beliefs, then re-queries the agent in a new interaction using that summary, testing whether the false belief persisted.

The four resulting protocols are Generic Short-term (GS), Generic Long-term (GL), Role-based Short-term (RS), and Role-based Long-term (RL). A later "Correct Guidance Protocol" (C) was added to check whether defenses make agents reject all outside input, including correct input.

Three metrics quantify the damage: error rate (share of questions answered wrong), reality shift rate (share of questions the agent answered correctly at baseline but wrong after group interaction), and maximal reality shift rate (share of correct baseline memories compromised by at least one of the four protocols).

For mitigation, the authors test two prompt-level defenses — cognitive anchoring (rely on internal knowledge first, be skeptical of external claims, demand proof before changing beliefs) and source scrutiny (analyze conversational dynamics and rhetorical roles rather than surface claims) — and a model-level defense using supervised fine-tuning on a dataset mixing a resilience set (successful defense reasoning chains) with a cooperative set (corrective and enriching guidance scenarios).

Why This Matters

Impact on research. Prior work treated factual errors as individual hallucinations or stateless, one-shot failures. This paper reframes them as socially induced, memory-related phenomena that persist after consolidation and retrieval, introducing the notion of long-term memory solidification. It also provides a benchmark where none existed, and a counterintuitive result — that larger models can be more vulnerable — that complicates assumptions about scaling as a safety fix.

Real-world applications:

• Contract review, a high-stakes setting the paper names as vulnerable to collective false memory among reviewing agents.
• Fact-checking, where shared false memories spreading through agent interactions would undermine the reliability of AI-driven information systems.
• Public policy analysis and social governance, fields the paper says increasingly rely on LLM-based multi-agent systems for complex problems.
• Diagnostic assistance, explored in the paper's extension using a 1,000-question subset of MedMCQA, a challenging medical dataset, where a group consensus built on mutually reinforced misinformation (for example, a misremembered medical symptom) could have severe consequences.

Industry relevance. The author list includes affiliations from OPPO Research Institute and Palo Alto Networks alongside Zhejiang University, UCLA, and the Zhejiang Key Laboratory of Decision Intelligence, indicating interest from both consumer AI product development and security/compliance sectors. The finding that a group of just six strategically coordinated agents is the most dangerous configuration, and that nine or more agents trigger vigilance, is directly actionable for anyone configuring agent team sizes in production.

Future Directions

• Benchmark expansion. The authors acknowledge that ManBench uses multiple-choice questions for controlled measurement, which simplifies unstructured dialogue, dynamic role changes, and open-ended tasks. They plan to incorporate more challenging cooperative tasks and advanced interaction protocols such as open-ended discussions.

• Stronger defenses. The paper proposes developing more generalizable defenses, such as introducing "critic" agents for cross-verification and reflection, described as potentially more adaptive than the current prompt- and tuning-based approaches.

• Teaching discernment rather than blanket skepticism. The fine-tuning ablations show that one-sided resilience training makes agents reject all external input, including correct guidance. Finding training regimes that balance skepticism and cooperation remains open.

• Extending to sensitive decision-making. The paper's own proof-of-concept on a 1,000-question MedMCQA subset (applying both defense types to the open-source Llama 3.1-8B) is presented as an extension; scaling this to real clinical or other high-stakes workflows is left for future work.

Target Audience

Researchers working on LLM multi-agent systems, AI safety and alignment, and computational social science will find the benchmark and metrics most useful. AI ethics researchers will value the framing of collective false memory as an ethical concern about misinformation spread. Practitioners who deploy agent teams for fact-checking, contract review, policy analysis, or clinical decision support should read the group-size and defense findings before choosing team configurations. Readers need no specialist mathematics, but some familiarity with LLM evaluation benchmarks will help.

Authors’ abstract

Recent advancements in large language models (LLMs) have significantly enhanced the capabilities of collaborative multi-agent systems, enabling them to address complex challenges. However, within these multi-agent systems, the susceptibility of agents to collective cognitive biases remains an underexplored issue. A compelling example is the Mandela effect, a phenomenon where groups collectively misremember past events as a result of false details reinforced through social influence and internalized misinformation. This vulnerability limits our understanding of memory bias in multi-agent systems and raises ethical concerns about the potential spread of misinformation. In this paper, we conduct a comprehensive study on the Mandela effect in LLM-based multi-agent systems, focusing on its existence, causing factors, and mitigation strategies. We propose MANBENCH, a novel benchmark designed to evaluate agent behaviors across four common task types that are susceptible to the Mandela effect, using five interaction protocols that vary in agent roles and memory timescales. We evaluate agents powered by several LLMs on MANBENCH to quantify the Mandela effect and analyze how different factors affect it. Moreover, we propose strategies to mitigate this effect, including prompt-level defenses (e.g., cognitive anchoring and source scrutiny) and model-level alignment-based defense, achieving an average 74.40% reduction in the Mandela effect compared to the baseline. Our findings provide valuable insights for developing more resilient and ethically aligned collaborative multi-agent systems. Code and dataset are available at https://github.com/bluedream02/Mandela-Effect.