Most AI safety research asks the same question: how do we make this model safer? Better training, better alignment, better evaluation. The assumption embedded in that question is that a safer model produces safer behavior when deployed in a real system with other agents and users.
Reordering the same four agents produced a 59 percentage point swing in approval rates.
"Position: Safety and Fairness in Agentic AI Depend on Interaction Topology, Not on Model Scale or Alignment" (arXiv:2605.01147), submitted to arXiv on May 1, 2026 by Tanav Singh Bajaj, Nikhil Singh, Karan Anand, and Eishkaran Singh, challenges that assumption directly. Their finding: in multi-agent AI systems, the structure of how agents connect and interact overrides the safety properties of any individual model. Well-aligned models can produce catastrophically unsafe outputs, purely because of how the system is wired together.
The three failure modes
The researchers tested multi-agent loan approval systems across 5,760 synthetic credit applications using models ranging from 3B to 70B parameters. They identified three distinct failure modes, each invisible to standard model-level safety evaluation.
Ordering instability
In sequential agent pipelines, the sequence of roles determines the outcome as much as the quality of reasoning. For LLaMA-3B models, approval rates ranged from 36.4% to 95.4% across the 24 possible orderings of four roles: a 59 percentage point spread. Even at 70B scale, the spread was 21.7 percentage points (71.5% to 93.2%). The same models, the same task, the same applications, completely different outputs depending on which agent went first.
The pattern was consistent: placing the Risk Manager first produced the lowest approval rates; placing the Data Scientist first produced the highest. No amount of alignment work on individual models eliminates this effect, because it is a property of the pipeline sequence, not the models.
Information cascades
In sequential systems, later agents follow earlier agents rather than reason independently. Small 3B models showed roughly 90% inter-agent agreement with 20% error correction, suggesting they were still performing some independent evaluation. At 70B and above, inter-agent agreement rose to over 99.9%, with error correction collapsing to under 0.1%.
Deliberation had effectively stopped. The first agent's judgment propagated through the pipeline unchanged, with remaining agents providing the appearance of review without any of the substance. More capable models formed consensus faster and more completely, amplifying this failure precisely because of their greater capability at reaching coherent agreement.
Functional collapse
Under parallel topology with judge aggregation, LLaMA-3B models produced approximately 98% overall approval across credit tiers, with low-credit applicants approved at 95% and high-credit applicants at 100%. By demographic parity metrics, this looks like a fair, non-discriminatory system. In practice, the system had stopped discriminating at all. Risk assessment had become a formality satisfied through indiscriminate approval rather than equitable evaluation.
Scaling model capability strengthens topology-driven failures rather than alleviating them. More capable models devote more processing to building coherent group agreement and less to independent evaluation. At 70B scale, the near-complete elimination of independent deliberation means the multi-agent system functions as a single-agent system with extra steps, inheriting none of the safety benefits that multiple independent reviewers are supposed to provide.
The regulatory gap this creates
Current AI safety frameworks evaluate models. They assess model outputs, measure model alignment, and certify model behavior. The interaction architecture connecting multiple models sits entirely outside this evaluation framework.
The paper's authors describe this as a fundamental problem and make four concrete governance recommendations. Safety certification should require topological sweeps across architectural variations. Benchmarks should explicitly specify the interaction structure being tested. Deployment should require architectural robustness testing before release. Regulatory disclosure should mandate documentation of system architectures and demonstrated stability across topology variations.
The underlying argument: agentic AI must be treated as a dynamical system, not a collection of aligned components. Interaction topology is a safety parameter that current evaluation methods do not measure. Regulators and deployers are auditing the wrong thing.
What this means in practice
The loan approval scenario represents a broad class of real-world deployments. Multi-agent AI systems are now used in hiring, medical triage, content moderation, legal research, and financial compliance. In most of these contexts, individually certified or evaluated models are connected through architectures that have received no equivalent scrutiny.
A 59 percentage-point swing in loan approval rates from reordering agents implies similar structural instabilities in other high-stakes pipeline decisions. An autonomous medical triage system using sequential agent review faces ordering instability. A hiring screening pipeline using parallel agent voting faces functional collapse. The structure of the pipeline is a safety parameter that current evaluation simply does not capture.
Structure is a safety parameter. Treat pipeline design like you treat model choice: test it, regulate it when stakes are high, and do not ship multi-agent systems into medicine or credit on model scores alone. For the wider control problem, see our plan. Full paper: arXiv:2605.01147.
The strongest pushback
The fairest objection is that careful model choice still dominates, and pipeline order is a second-order tweak. A 59-point swing from reordering agents is not second-order. Structure is a first-class safety parameter. Score the topology, not only the weights.