Which Graph Is Safest? Predicting Adversarial Capture of LLM Agent Groups from Local Kernels

In multi-agent LLM deliberation, a single adversarial agent can steer the group to a wrong answer, and how often this happens depends on the communication graph. We show that the deliberation dynamics are well predicted by a few local quantities: the question under deliberation, an agent's own answer, its number of neighbours, and how many of them hold the adversary's answer, with the adversary counted separately from neighbours it has converted. On this state we approximate the deliberation by a Markov chain whose transitions come from a per-question switching kernel. We study three open-weight 8B models, 600 MMLU-Pro questions and three memory protocols, with one adversary among six agents. Calibrated on eight graph–placement configurations, the kernel predicts adversarial capture, the probability that the adversary's answer becomes the group's majority, on 52 other configurations with a mean error of $0.012$, and it extends to groups of eight and twelve agents, two adversaries and ten rounds. Under a new question set or new adversary messages, question-specific susceptibility changes, so absolute capture needs four to five calibration runs there, but the ranking of graphs transfers much better. Ranking all 112 connected six-agent graphs, concentrating links on one agent is worst for every model, and which graph is best depends mainly on how the group starts: counterfactually raising how often the correct answer starts as a minority moves the most accurate graph from dense to sparse for models whose agents follow the majority strongly. On a second question set, LogiQA, reading these curves at its solo-answer distribution reproduces the ranking obtained after calibrating on LogiQA with rank correlation $0.95$–$0.99$. Our code is available on https://anonymous.4open.science/r/which-graph-is-safest-38C3/README.md.