多智能体辩论可能放大安全风险：SafeConflict-Bias 诊断与 RiskTrace-Debias 修复
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
多智能体辩论会把本来能拒绝的不安全内容采纳率推到 100%，这篇给出不改模型就能压回 2% 以内的修法，做智能体的都该看看。
论文提出 SafeConflict-Bias 诊断协议，覆盖 6 类 Web 风险场景，在保持查询与检索证据不变的前提下隔离从众压力、权威线索等社会偏差。实验发现单独模型能可靠拒绝不安全指令，但标准多智能体辩论（MAD）下不安全采纳率从 0.0% 飙升至 100.0%。作者随后提出推理时审计框架 RiskTrace-Debias，通过证据优先预承诺、社会元数据掩码和一致性门控仲裁，把最坏情况不安全采纳率压到 ≤2.0%，且不引发过度拒答。该框架无需重训练或重新生成辩论，并输出可验证的溯源记录用于审计。
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
Retrieval-augmented Web applications increasingly employ multi-agent debate (MAD) to aggregate conflicting, noisy, and heterogeneous information, yet deliberation is fundamentally a social process susceptible to interpersonal dynamics. When retrieved Web sources contain latent hazards alongside safe factual content, social biases such as conformity pressure and authority deference can override evidence-grounded safety boundaries. In this work, we investigate whether the social structure of deliberation can paradoxically amplify latent Web safety risks. We introduce SafeConflict-Bias, a controlled counterfactual diagnostic protocol spanning six core Web risk categories, which holds queries and retrieved evidence strictly invariant while isolating conversational majority sway, authority cues, and confidence asymmetry. Empirical evaluation across diverse proprietary and open-source backbones reveals that while isolated models reliably reject unsafe guidance, standard MAD catastrophically capitulates to social pressure---surging unsafe adoption from 0.0\% up to 100.0\% and systematically silencing safe minority evidence. To resolve this systemic fragility without retraining or debate regeneration, we propose RiskTrace-Debias, an inference-time auditing framework uniting evidence-first precommitment, social-metadata masking, and consistency-gated arbitration. RiskTrace-Debias suppresses worst-case unsafe adoption to $\le 2.0\%$ across all architectures without inducing over-refusal, while generating verifiable provenance traces to audit interpersonal manipulation in Web deliberation.
