Self-Restructuring Agents, Alignment Illusions, AI Bias

Three papers landed this week that share an uncomfortable question: does the thing you measured actually protect you? A multi-agent framework lets teams of agents restructure themselves mid-task instead of waiting to be redesigned. A red-team study finds that a nine-line regex filter can match an aligned model's block rate, depending entirely on how you measure "blocked." And a hallucination study finds that when models make things up about political news, the fabrications lean a specific direction regardless of which side the source article came from.

Agents That Rewire Themselves Mid-Task

Most multi-agent systems pick a team structure once, at startup, and stick with it. If a researcher agent starts drowning in a backlog of tool calls while a reviewer agent sits idle, nothing in the system notices. Bronislav Sidik, Chaya Levi, and Nizzan Kimhi built ATM (Autonomous Topology Mutation) to fix exactly that gap, letting a running multi-agent system detect its own bottlenecks and reshape its team structure without a human in the loop.

The system watches six telemetry signals per agent: queue depth, context thrash, tool-error rate, role entropy, retry-loop rate, and cross-agent wait time. It rolls those into what the authors call a Bottleneck Index, and when an agent crosses threshold, ATM can split its workload, spin up a helper, or reroute tasks to a less-loaded peer.

The part that matters for anyone shipping agent systems is the safety layer, not the restructuring itself. Runtime mutation is a scary idea if it means a system can silently grant itself new capabilities or lose track of state. ATM constrains every mutation with three invariants: new agents can never gain capabilities beyond what the team was already authorized to use, in-flight state has to route cleanly to wherever the mutation sends it, and a shadow validation pass checks a proposed restructuring before it goes live.

Runtime topology mutation targets the kind of load imbalance that shows up when one agent in a pipeline becomes a bottleneck under production traffic. Source: unsplash.com

Tested across 720 task runs on DeepSeek-V3, task success on coding workloads jumped from 3.3% to 61.7% with mutation enabled, and incidents where a high-privacy memory context leaked into the wrong agent dropped from 2.0 to 0.0 per task. Latency overhead stayed under 500 microseconds at the 99th percentile, which is the number that will actually decide whether teams building production agent pipelines take this seriously. The DeepSeek-V3 lineage remains a common testbed for this kind of agent-orchestration research because it's cheap enough to run hundreds of full task episodes against. The authors released code, benchmark harness, and traces on GitHub, which matters more than the headline numbers if you want to check the invariants hold under your own workload rather than take the paper's word for it.

If you've been following how brittle fixed-topology systems get under load, this connects directly to earlier coverage of multi-agent review reliability and agent consensus under uncertainty: the failure mode in both cases traces back to a team structure that can't adapt to what's actually happening at runtime.

When a Regex Filter Matches Alignment

Alexandre Cristovão Maiorano's study asks a blunter question than most alignment papers: strip out the model's trained safety behavior and replace it with a nine-pattern regex filter, then compare block rates. If alignment isn't beating a keyword list, what exactly is a company paying for when it fine-tunes a model for safety?

The setup ran Gemini 2.5 Flash, with and without the regex layer, against 45 adversarial probes expanded into roughly 1,555 test cases spanning the OWASP LLM Top-10 categories, using techniques including paraphrase mutation and PAIR-style adversarial framing. Under strict substring matching, both the aligned model and the regex-only baseline scored a 0% block rate across every category, with a statistically indistinguishable difference (p = 1.00) between them.

That result alone would suggest alignment adds nothing. But switching the measurement to an LLM-judge metric, which reads a response and decides whether it actually constitutes a refusal rather than checking for specific blocked strings, found refusals in 56% to 100% of the same adversarially-framed cases. Same model, same prompts, wildly different verdict depending on how "blocked" gets defined.

The paper's own framing is closer to a warning than a takedown: alignment's measured effectiveness depends almost entirely on evaluation methodology, and teams benchmarking their own deployments with naive substring checks may be flying blind.

That's a governance problem as much as a technical one. Plenty of production safety dashboards still rely on substring or keyword matching because it's fast and cheap to run at scale, and this paper is evidence that number can read as "fully blocked" while the underlying model is doing real, measurable work that the metric simply can't see. Teams assessing a jailbreak resistance claim should ask which measurement method produced it before trusting the headline percentage.

A lock that looks intact on the outside can still be hollow underneath, which is close to what the paper found when it compared measurement methods for the same aligned model. Source: pexels.com

Hallucinations That Lean One Direction

Chendi Wang, Liam Cunningham, Tom Yishay, and Jieying Chen took a different angle on the same underlying issue: not whether a safety measurement is honest, but whether a model's failures carry a hidden pattern nobody is tracking. Their paper, accepted to IJCAI's AI for Social Good track, treats hallucinations in political news Q&A as a diagnostic signal rather than pure noise.

The team built a pipeline around QBias, a set of 21,727 expert-labeled U.S. news articles spanning left, center, and right sources. For each article, they produced grounded questions, collected answers from four models, flagged sentence-level hallucinations, and classified the ideological lean of each fabricated claim with a fine-tuned stance classifier.

Hallucination rates varied a lot by model: DeepSeek 7B Chat hallucinated on 21.3% of generations, Mistral 7B v0.3 Instruct on 14.2%, Llama 3 8B Instruct on 14.1%, and GPT-4o mini on 7.8%, the lowest of the four. Source ideology barely moved those rates. What did move was the direction of the fabrications themselves.

Averaged across all four models, 67.5% of hallucinated sentences skewed left-leaning. That held even when the source article being summarized was right-leaning: 60.3% to 65.5% of hallucinations generated from right-leaning articles still classified as left-leaning, depending on the model. The paper's logit-level analysis ties this to an "uncertainty to guessing" mechanism, where hallucinations cluster in high-entropy generation moments and, in some models, that same uncertainty predicts which direction the guess drifts.

The study built its dataset from 21,727 labeled news articles spanning the ideological spectrum, then tracked which direction each model's fabrications leaned. Source: unsplash.com

Two caveats worth flagging before anyone runs with this: none of the four models tested is a current frontier system, and the paper doesn't claim to have isolated why the drift skews left rather than characterizing that it does. Anyone rolling out an LLM for news summarization or fact-checking at scale, especially around elections, has a concrete reason to run this kind of directional audit on their own model rather than assume a low raw hallucination rate is the whole story.

The Common Thread

None of these three papers argue that agents or alignment are broken beyond repair. They argue that the number on the dashboard and the thing actually happening underneath can diverge, sometimes by a lot, and the divergence only shows up when someone builds a way to measure the gap directly. ATM's telemetry exists because fixed topologies hide their own bottlenecks. The regex comparison exists because block-rate metrics hide which measurement produced them. The hallucination audit exists because aggregate accuracy numbers hide directional bias completely. If there's a practical takeaway, it's that whatever safety or reliability metric your team reports weekly is worth stress-testing the same way these three papers stress-tested theirs.

Sources:

• Autonomous Topology Mutation: Safe Runtime Restructuring for Multi-Agent LLM Systems with Capability, State, and Shadow Invariants
• ATM code, benchmark harness, and traces
• Isolating LLM Alignment from Regex: Zero Coverage and Metric-Dependent Divergence Under Adversarial Mutation
• Directional Hallucinations: Ideological Drift in News-Grounded LLM Question Answering
• Chendi Wang's research page