Hallucination Cascades: When One Agent's Fabrication Becomes the Next Agent's Fact

A hallucination cascade is the process by which a fabricated claim produced by one agent in a multi-agent pipeline gets passed to a downstream agent, which treats it as ground truth, restates it, builds reasoning on top of it, and passes an increasingly entrenched version of it forward again. The originating error can be small: a misremembered figure, an invented citation, an overconfident inference stated as settled fact. What makes it a cascade rather than a single bad output is what happens next, downstream agents have no privileged way to tell a fabricated input from a verified one, so they extend it, cite it, and act on it exactly as they would extend, cite, or act on something true. By the time the pipeline's final output reaches a human reviewer, the fabrication is no longer a single agent's mistake sitting in isolation; it is load-bearing context for everything built after it.

This is a distinct failure from adjacent terms already covered here. Context handoff loss is legitimate, correct information failing to survive the boundary between agents; a hallucination cascade is the opposite direction of error, fabricated information that survives the boundary intact, or even strengthened, and gets treated as legitimate. Memory poisoning is adversarial or corrupted content entering a persistent store from outside the system; a hallucination cascade is self-generated, no external attacker or corrupted source is required, the system manufactures the error internally and then propagates it through its own normal operation. And it differs from single-agent hallucination as usually discussed: a lone model fabricating a fact in one response is a point failure that a reviewer can catch by checking that one output; a cascade is a multi-hop process where the claim's provenance gets progressively obscured, making it harder to catch the further it travels, not easier.

Mechanism

The clearest evidence that cascades behave as a genuine multi-agent dynamic, not just repeated single-agent hallucination, comes from a study built specifically to track claim-level propagation through agent chains. Researchers decomposed each agent's output into atomic claims and scored each one for factual consistency across sequential 3-agent chains built from GPT-5.3, DeepSeek-V3, and LLaMA-3-70B-Instruct, running 500 cascade experiments across 10 knowledge domains for 1,250 evaluated responses (Hallucination Cascade, arXiv:2606.07937). The headline result complicates the intuitive picture: the normalized hallucination score fell from 0.422 at the first agent to 0.272 by the final agent in the chain, an amplification factor of 0.644, meaning these particular chains net-attenuated rather than amplified fabrications on average. But factual accuracy fell alongside it, from 0.789 to 0.769, across the same chain. The two numbers together describe a real trade-off rather than a clean success: later agents in a chain tend to smooth over or drop claims that look uncertain, which reduces flagged hallucination but also discards some claims that were actually true, so a falling hallucination score across a chain is not on its own evidence that the chain is getting more trustworthy.

Whether a chain attenuates or amplifies its own errors turns out to depend heavily on how the agents are connected, not just on how many of them there are. A separate study modeling hallucination spread as a network process tested a heterogeneous six-agent system across five reasoning rounds on 1,317 queries from TruthfulQA and TriviaQA, varying the communication topology between agents (Collective Hallucination, arXiv:2606.07941). Scale-free topologies, where a small number of agents accumulate disproportionately many connections, showed the strongest undefended cascading effect: an amplification factor of 1.45 and a reproduction number of 1.21, a rate above 1.0 meaning the fabrication is self-sustaining, each infected agent produces on average more than one newly infected downstream agent, the same threshold condition that separates a contained outbreak from an epidemic in disease modeling. A hub-heavy orchestration pattern, one triage or planning agent that many others defer to, is structurally the scale-free topology this result describes; a fabrication that lands in the hub does not stay contained to one branch.

A third line of evidence explains why cascades get harder to catch as they travel, independent of whether the raw error count is rising or falling. A pipeline study built a four-stage financial-analysis pipeline on FinanceBench and modeled how an injected hallucination transforms as it moves through stages, proposing a four-state progression: Raw Fact, Derived, Narrative, and Invisible, where a specific fabricated number first appears as a discrete claim, then gets folded into a derived calculation, then gets absorbed into prose narrative, then becomes structurally undetectable because no single downstream span still states the original claim in checkable form (Hallucination Snowball, arXiv:2608.14588). Measuring GPT-4o's own ability to detect 346 injected hallucinations at each stage, detection fell from 72.0% at stage 1 to 50.9% at stage 4, and 23.7% of injected fabrications survived undetected all the way to the final output. The stage-to-stage transition data makes the shape of the problem concrete: 75.4% of hallucinations were still catchable at the first stage boundary, but by the third-to-fourth boundary, 89.3% had already escaped detectability. The claim does not become more wrong as it travels; it becomes less checkable, because the surface form that would let a verifier compare it against a source has been paraphrased and absorbed away.

A fourth study frames the underlying vulnerability structurally rather than statistically, modeling multi-agent collaboration as a directed dependency graph and identifying three distinct failure classes: cascade amplification, where a single seed error compounds across dependent agents; topological sensitivity, where the same seed error produces very different blast radii depending on graph shape; and consensus inertia, where once enough agents have echoed a claim, later agents defer to the apparent agreement rather than re-verifying it independently (From Spark to Fire, arXiv:2603.04474). The consensus inertia mechanism is worth isolating on its own: it means a cascade does not require each downstream agent to be individually credulous, an agent applying a reasonable heuristic, several teammates already said this, so it's probably right, is enough to keep a fabrication moving forward.

How to detect it

Track claim-level provenance, not just output-level review. A pipeline that only checks final outputs for correctness will systematically miss cascades in the Hallucination Snowball sense, because by the final stage the original claim has often been paraphrased into a form where the source it needs to be checked against is no longer visible in the text.
Instrument stage boundaries, not just endpoints. The snowball data shows detectability collapses well before the pipeline finishes: 75.4% of injected errors were still catchable at the first inter-agent boundary versus 10.7% by the third. A verification pass placed only at the end of a pipeline is checking a problem that has already become close to unrecoverable.
Map your system's communication topology before assuming its cascade risk. A flat, independent-review structure and a hub-and-spoke structure where one planner or triage agent's output feeds everyone else carry measurably different amplification risk; the scale-free topology in the Collective Hallucination study was the one that crossed the self-sustaining reproduction-number threshold.
Watch for consensus as a false signal of correctness. If your review process treats "multiple agents agree" as evidence a claim is sound, that heuristic is exactly what consensus inertia exploits; agreement among agents that all derived their belief from the same upstream fabrication is not independent confirmation.
Do not use a single end-to-end hallucination-rate metric as your only health signal. The Hallucination Cascade study's own headline number, an apparent reduction from 0.422 to 0.272 across the chain, looks like improvement in isolation but co-occurred with a real accuracy drop from 0.789 to 0.769; track factual accuracy and flagged-hallucination rate as two separate series, not one.

Mitigation

Verify at stage boundaries, not only at the end. The single largest effect size in this body of evidence is the gap between boundary-gate verification and end-of-pipeline checking in the snowball study: 16.2% hallucination survival with boundary gates versus 58.4% with end-stage-only checking, a difference the authors report as statistically large (Cohen's h = -0.911, p < 0.000001). This is a direct, mechanistic argument for state externalization applied specifically to intermediate claims: write each agent's atomic claims to a durable, checkable record at the boundary it crosses, before the next agent has a chance to paraphrase them into an unverifiable form.

Treat topology as a design decision with a measurable cascade cost, not an implementation detail. Where a hub-and-spoke pattern is chosen for coordination simplicity, the Collective Hallucination result implies that hub's outputs deserve disproportionately more verification budget than any single spoke, since an error entering the hub is the one most likely to reach a self-sustaining reproduction rate.

Break consensus inertia by requiring at least one independently-sourced re-verification per claim, rather than counting agreement among agents that may share a common upstream input as confirmation. The From Spark to Fire study's genealogy-graph governance layer, which tracks each claim's dependency lineage rather than trusting its current level of apparent agreement, prevented final infection in at least 89% of runs across six mainstream multi-agent frameworks without requiring changes to the underlying collaboration architecture, evidence that lineage tracking, not raising the individual reliability of each agent, is what actually contains the spread.

Where a defense mechanism is deployed, favor one that acts on propagation dynamics rather than only on individual-response quality. The HPR-Adaptive framework tested in the Collective Hallucination study combines dynamic trust weighting, external claim verification, propagation-aware interaction regulation, and selective isolation of unreliable agents; against undefended scale-free topologies it cut the hallucination rate by 39% (0.118 to 0.072), raised factual accuracy from 0.812 to 0.867, and brought the reproduction number down from 1.08 to 0.81, moving the system from self-sustaining spread to controlled attenuation. The reproduction-number framing is the operationally useful part: a defense that gets a multi-agent system's error-reproduction rate below 1.0 has changed its qualitative behavior, not just its average error count.

Do not treat a falling aggregate hallucination score as proof a pipeline is healthier. Pair every hallucination-rate metric with a factual-accuracy metric measured against the same claims, and treat a chain where both are falling together, the pattern in the original cascade study's undefended baseline, as a red flag rather than a partial win.

Related terms

Context handoff loss: the boundary failure where correct information fails to survive an agent-to-agent transfer, the inverse direction of error from a cascade.
Memory poisoning: adversarial or corrupted content entering a persistent store from outside the system, distinct from a self-generated cascade.
Agent drift taxonomy: the broader classification this pattern sits under when it emerges gradually rather than from a single seed error.
State externalization: the mitigation pattern of writing claims to durable, checkable records, directly applicable at cascade stage boundaries.

FAQ

Is a hallucination cascade the same thing as a single agent hallucinating repeatedly? No. Repeated hallucination by one agent is a reliability problem local to that agent, checkable by reviewing that agent's outputs directly. A cascade specifically requires the fabrication to cross an agent-to-agent boundary and be treated as verified input by a downstream agent; the propagation, transformation, and loss of checkable provenance across that boundary is the phenomenon, not the fabrication rate of any single agent in isolation.

Does adding more agents to a pipeline always make hallucination worse? No, the evidence is mixed by design. The Hallucination Cascade study found net attenuation of flagged hallucination score across its 3-agent chains, alongside a real drop in factual accuracy, while the Collective Hallucination study found strong amplification specifically under scale-free, hub-heavy topologies. Whether more agents help or hurt depends on communication topology and on whether verification happens at stage boundaries, not on agent count alone.

Can this happen with a single model calling itself in a loop, without multiple distinct agents? The propagation mechanism described here, consensus inertia and topology-dependent amplification, specifically requires multiple interacting agents whose outputs feed each other as inputs. A single model reasoning in a loop can still compound its own errors turn over turn, but that pattern is closer to self-conditioning drift than to the multi-hop, provenance-obscuring dynamic these studies measured.