Researchers from CUHK and other teams study the propagation and mitigation of false beliefs in multi-agent social networks

Add crowdsourcing promotion copy Add crowdsourcing promotion copy end Add App-exclusive traffic guidance

Why would a smart bracelet that does not exist at all appear on AI's recommendation list? The "AI poisoning" case exposed by CCTV's 2026 3·15 Gala brought this question to public attention: fabricated products were written into reviews, rankings, and user evaluations, and were then used by AI as a basis for recommendations.

If AIs can also communicate with one another, retain memories, and publish articles, how would the initial error develop? A study on multi-agent social networks found that false claims may be accepted by ordinary agents through sustained interaction, gradually forming a "fact" commonly accepted by the group, and may even persist after the fabricators stop their activities.

Researchers from the Chinese University of Hong Kong, the University of Edinburgh, the Hong Kong Polytechnic University, Tongji University, and the University of Oxford examined the spread, persistence, and mitigation of false beliefs in multi-agent social networks from the perspective of the "Mandela effect." The Mandela effect usually refers to many people having the same false memory about the same event. In human society, such false memories may form unintentionally. In multi-agent environments, however, similar group errors may be deliberately induced by fabricators manipulating information.

From the fabricated bracelet in the 3·15 Gala,

to false beliefs among agents

In a CCTV Finance investigation demonstration, an industry insider fabricated a smart bracelet named Apollo-9, used GEO (generative engine optimization) tools to generate promotional articles, and published them. Two hours later, a certain AI could already introduce this nonexistent product, citing precisely the fabricated article published that day. Subsequently, multiple forged expert reviews, industry rankings, and user reviews continued to be published, and two AIs ranked it at the top when recommending smart health bracelets (CCTV Finance report).

The 3·15 case demonstrated the real-world risk of artificially manipulating information sources: by writing a nonexistent product into articles, AI may treat it as a basis for recommendations and mislead users. The study further places the problem in a multi-agent environment: when an agent accepts a false claim, records it, tells its neighbors, and writes it into searchable articles, will more agents also believe it?

Figure 1: The left side corresponds to the real-world case of a fabricated bracelet polluting public information. The right side uses the nonexistent Nano Guava to demonstrate the false-belief propagation mechanism in the study: messages, memories, and searchable articles cause the false claim to be accepted and further repeated.

Nano Guava on the right side of the figure is a nonexistent model name, and "OpenAI released an on-device model named Nano Guava" is a fabricated claim. The figure shows the propagation process of this false claim. The fabricator first provides supporting articles and messages; ordinary agents accept the relevant claim through search and communication, then write it into memory, relay it to other agents, or publish new articles. In this way, something that does not exist may also be treated by models as a real object during interaction. Here, "believe" corresponds to the judgment of "accepting" a statement in the experiment.

How does the study track the spread of a piece of false information?

The study built a controlled environment: agents can communicate, retain private memories, search, and publish articles. All web pages were simulated locally, and false content did not enter the real internet.

The main experiment set up one fabricator agent and five ordinary agents. The fabricator promoted false statements, and ordinary agents combined neighbor messages, search results, and memories to judge whether to accept, reject, or remain uncertain. Ordinary agents that accepted a statement would also publish supporting articles. The judgments of the previous round thus entered the search results of the next round and became new evidence. The study used false statements as trackable objects to observe whether ordinary agents jointly accepted the same false claim through interaction and continued to retain this judgment after the fabricator exited. This group-shared, persistent false belief is the phenomenon examined in this study from the perspective of the "Mandela effect."

Research on human false memories has found that whether an event seems likely to occur and whether it is compatible with existing knowledge affect the likelihood of its being implanted into memory. The study constructed 540 false statements, covering 8 domains and 4 levels of plausibility, and evaluated them across 10 models and 3 communication network structures.

The tested models were divided into open-source and closed-source groups: open-source models included Qwen3-8B, 14B, 32B, and 235B, as well as Llama-3.1-8B and Llama-3.3-70B. Closed-source models included Claude Sonnet 5, Claude Opus 5, GPT-5.5, and Gemini 2.5 Flash. The study observed their performance in fully connected, binary tree, and two-community networks, respectively, comparing whether model capability and communication structure could provide protection.

In the propagation stage, the study examined propagation scope and propagation speed separately: how many ordinary agents accepted the false claim, and when the accepting stance formed during interaction. It then observed whether the influence could persist after the fabricator exited and whether different correction measures were effective. Figure 2: The experiment compares different communication structures and, after the fabricator exits, retains existing articles and private memories to track whether false beliefs can persist.

How far can errors spread?

All ten tested models were affected

In baseline tests that provided only statements and asked the models directly, the false-statement acceptance rate was 0.0%–9.1%. After ten rounds of interaction in the main experiment, the final-round acceptance rate under different models and network settings reached 33.7%–96.0%. This indicates that judgment ability in a single question-and-answer exchange may not necessarily reflect how a model performs after being placed in a continuous interactive network. More noteworthy is that all ten tested models accepted some false information, covering both open-source and closed-source models. Although the degree of acceptance varied, this experiment did not find any model that was completely resistant to this type of influence.

Table 1 also shows differences among models. Qwen3-32B did not accept these false statements in direct question answering, but after interaction, its average acceptance rate across the three structures reached 94.5%. The corresponding value for GPT-5.5 changed from 2.6% to 50.4%. Claude Sonnet 5 had a relatively lower average acceptance rate of 35.1%, but still showed clear erroneous acceptance.

Larger models also did not bring consistent resistance. The average acceptance rates of Qwen3-8B, 14B, and 32B were 85.0%, 90.0%, and 94.5%, respectively, while the 235B model was 91.2%. These results did not show a pattern that “the larger the scale, the less likely to be misled.” The final acceptance rates under the three network structures were also relatively close for most models; changing only who communicates with whom failed to prevent false beliefs from forming.

Final acceptance rates were similar,

but was the speed of spread the same?

The final acceptance rates in different networks may be close, but the time at which erroneous acceptance formed differed. Starting from round 2, the paper recorded the round in which an ordinary agent last shifted from “reject” or “uncertain” to “accept,” counting only cases where such a shift occurred. A smaller round number indicates that the last shift to acceptance occurred earlier. The left side of the figure is calculated by agent, and the right side takes, for each statement, the latest shift round among the relevant agents and then calculates the average.

In the three model families Qwen, Llama, and Claude, the dual-community network had the smallest average round at both the agent and statement levels. Taking the statement-level results for the Qwen family as an example, the dual-community network was 3.73 rounds, while the fully connected network was 5.07 rounds. The fully connected network exposed participants to more messages and may also have brought more conflicting information, slowing the acceptance process. Similar propagation scope does not mean the same propagation speed.

Can one small-model fabricator

influence other models?

In the main experiment, the fabricator and ordinary agents used the same model in each setting. The study also added a mixed-model experiment: the fabricator was fixed as Qwen3-8B, and the models used by five ordinary agents were replaced one by one to examine cross-model information influence. In each group, the ordinary agents used the same target model, and different rows in the table represent different experimental combinations. The experiment used a fully connected structure and drew 25 statements from each of the four plausibility levels, for a total of 100. The results showed that even with only this small model as the fabricator, all nine tested target models still showed erroneous acceptance, including larger open-source models and closed-source models.

This experiment extends the risk from communication among same-model agents to cross-model scenarios: a smaller-scale fabricator may also influence agents driven by larger models through messages and shared articles. A similar risk also appeared in the March 15 case: false content generated by a GEO tool may influence recommendations across multiple AI platforms.

After the fabricator exits,

will false beliefs remain?

False beliefs may also persist after the fabricator exits. In the exit experiments with Qwen3-8B and Llama-3.1-8B, the researchers had the fabricator stop activity at round 5 but retained the published articles and the ordinary agents’ memories. By round 10, the changes in average acceptance rates under each plausibility level were all within ±0.8 percentage points. Stopping new fabrication activity did not cause the already formed false beliefs to clearly fade.

After interaction,

will it still recommend nonexistent things to you?

Accepting a false claim may also affect subsequent recommendations. The study selected 260 statements suitable for recommendation questions and, after each interaction ended, asked each of the five ordinary agents once to provide three recommended objects. The experiment compared two answering methods: using only the existing information from the interaction, or re-searching based on the recommendation question and then answering in combination with the existing information.

Under the ten models and two answering methods in the recommendation experiment, the proportion of nonexistent objects entering the Top-3 recommendation list was 13.1%–75.8%. Among answers that had already included the fictional object in the recommendation list, the proportion ranking it first reached 65.3%–92.4%, far higher than the reference level of about one-third when three objects are randomly ordered.

Taking Qwen3-32B as an example, when using only existing information, 75.8% of answers recommended the fictional object, and among those answers, 92.4% ranked it first. After re-searching, these two proportions were still 72.6% and 91.4%. This echoes the March 15 case in which a fictional wristband was recommended by AI: false beliefs formed during interaction may further influence user-facing recommendations.

Correcting specific errors

is more effective than general reminders

The study further compared preventive and corrective measures. In the fully connected network experiment with Qwen3-8B, the false-statement acceptance rate was 84.4% when no defense was used. After adding a reminder to think independently, the acceptance rate dropped to 79.7%. When the original background web pages were labeled with official sources, it was 83.4%.

Directly correcting false claims that had already spread was more effective. After adding rebuttal articles, the acceptance rate dropped to 57.1%. After broadcasting corrections to all ordinary agents, it dropped to 27.8%. These interventions reduced the false acceptance rate, but some residual effect remained.

Final thoughts

Returning to the March 15 case, the fictional product first influenced AI through external articles. This study further shows that when agents also become information producers, errors may spread repeatedly within the group, leave an impact after the fabricators exit, and enter subsequent recommendations. An error written by one AI may become evidence for another AI, ultimately affecting the answers users see.

Based on these results, users can explicitly remind agents to verify evidence when using them. For example: do not directly accept a claim just because multiple web pages repeat it; trace it to the original source, check whether these sources are independent of one another, and clearly state uncertainty when evidence is insufficient. After obtaining specific correction materials, users can also ask the agent to recheck its previous conclusions. The independent-thinking reminder in the experiment brought only limited improvement, so prompting can serve as an auxiliary measure; reliable sources and corrections targeting specific errors are still needed.

Platforms also need to bear responsibility for maintaining the information environment. In addition to checking retrieved external materials, they should also pay attention to what agents publish and how that content is reused by other agents. Source tracing, identifying batch-fabricated content, and ensuring that correction information reaches affected agents in a timely manner are all directions worth advancing.

At the regulatory level, attention should also be paid to the use of automated publishing and fake reviews to manipulate AI recommendations, and content publishing and distribution platforms should be encouraged to establish mechanisms that are traceable, appealable, and correctable. Once fictional content is continuously published and repeated, it may contaminate the shared information environment and affect multiple systems and their users. Maintaining this environment requires the joint participation of content producers, platforms, and regulators.

As AI-generated content increases, agents can help people organize knowledge and discover information, but they may also accelerate the spread of fabricated content. This double-edged-sword effect makes trustworthy agents an even more urgent research direction. Models need to maintain judgment during continuous communication, memory, and retrieval, and they also need to update conclusions after discovering errors. Resistance to false information and the ability to correct errors deserve attention alongside models' task capabilities.article_adlist[

]article_adlistarticle_adlist[

For reprinting, please contact this official account for authorization

Submissions or report inquiries: liyazhou@jiqizhixin.com ]article_adlist Statement: This is an exclusive article for Sina.com; unauthorized reproduction is prohibited. tech_web_article_v2015_block_bottom Non-targeted 300*250 button 17/09 wenjing begin

Non-targeted 300*250 button end