Endogenous Byzantine Faults: Measuring and Containing Fault Contagion in LLM Multi-Agent Systems

LLM multi-agent systems use voting, debate, and peer review to obtain reliability from redundancy, on a premise inherited from Byzantine fault tolerance (BFT): an honest majority outvotes a faulty minority. The premise treats the set of faulty agents as fixed by the adversary. We show that in LLM systems the fault set is endogenous: an honest agent becomes faulty by reading a protocol message, so the fault spreads through ordinary use of the protocol. We formalize a contagious Byzantine fault model with three measurable quantities, the per-hop infection rate $\beta$, the payload replication rate ${\beta }_{\mathrm{rep}}$, and the inter-replica failure correlation $\rho$, under which an honest majority survives fewer than $n(1-2\beta )/(2(1-\beta ))$ adversaries under independent compromise, i.e. none once $\beta \ge 1/2$; contagion across rounds adds a cascade condition and correlated replicas an irreducible failure floor. The vote share these quantities imply tracks debate accuracy over 62 systems ($r=-0.94$, held-out $R^2=0.86$, no better than $\beta$ alone) and places 53 of them on the correct side of the majority threshold without fitting. In about 780k agent calls over 11 models from seven families and 1300 questions, a message that only claims coordinator authority flips 97% of Llama-3.3-70B agents on arithmetic they can verify themselves, while a worked argument flips 0%. Within the model families we test, larger models are harder to persuade but easier to command, and some models forward the payload at every hop of a relay chain. One adversary among five drives debate accuracy from 74–90% to 2% or less for four large models. Mixing vulnerable model families does not help; only members that resist the instruction channel do. A provenance gate that admits peer evidence but not peer directives restores accuracy to 72–87% and, unlike a warning prompt, mostly preserves the rate at which agents accept legitimate corrections; an adaptive attacker is left with the weaker evidence channel, which the gate does not address.