Introduction

The Byzantine Generals Problem[lamport1982byzantine] asks: how many traitorous generals can an army tolerate while still reaching correct consensus? The classical answer is strict—fewer than one-third of participants can be faulty ($f < N/3$)—and this bound underlies decades of distributed systems design[castro1999practical].

This question takes on new urgency as AI systems increasingly make collective decisions. Ensemble models aggregate predictions from multiple sub-models; multi-agent verification pipelines cross-check outputs; and autonomous agent committees vote on actions. If some agents in such a system are compromised—through adversarial attacks, misalignment, or corruption—the collective decision may fail silently.

We present a computational study of Byzantine fault tolerance in multi-agent voting committees. Each of $N$ agents receives a noisy signal about the correct decision (one of $K=5$ options) and votes. A fraction $f$ of agents are Byzantine—they vote adversarially to corrupt the committee's plurality decision. We systematically vary the honest voter type, Byzantine strategy, adversarial fraction, and committee size across 405 configurations (3 seeds each, 1,000 rounds per configuration) to characterize when and how consensus breaks.

Our primary contribution is not the theoretical bound itself (which is well-established) but an empirical study of how agent capability interacts with Byzantine resilience. Agents with richer inference (Bayesian updating over multiple observations) tolerate adversaries far beyond the classical $N/3$ threshold, while simple majority voters break near $f \approx 0.41$--$0.45$.

Methods

Signal Model

In each round, nature draws a ground-truth option $y^* ~ \mathrm{Uniform}{0, \ldots, K{-}1}$ with $K = 5$. Each agent $i$ receives $m_i$ independent noisy observations: each observation equals $y^*$ with probability $q = 0.6$ (signal quality) and is uniformly random otherwise. The agent's input is the count vector $\mathbf{c}_i \in \mathbb{N}^K$ of how many times each option was observed.

Honest Voter Types

Majority voter ($m = 1$ sample): votes for the observed option (argmax of $\mathbf{c}_i$; ties broken randomly).

Bayesian voter ($m = 3$ samples): computes the posterior $\mathrm{Dir}(\mathbf{1} + \mathbf{c}_i)$ under a uniform Dirichlet prior and votes for the MAP estimate.

Cautious voter ($m = 1$ sample): computes the posterior mean and abstains (does not vote) if the best option's probability is below threshold $\tau = 0.30$.

Byzantine Strategies

Random: votes uniformly at random, ignoring signals.

Strategic: all Byzantine agents coordinate to vote for a fixed option (option 0), concentrating adversarial votes.

Mimicking: with probability 0.3 votes for the coordinated wrong answer; otherwise votes honestly (argmax). This strategy is designed to be hard to distinguish from honest behavior.

Experiment Design

We run a full factorial grid: 3 honest types $\times$ 3 Byzantine strategies $\times$ 5 fractions ($f \in {0, 0.10, 0.20, 0.33, 0.50}$) $\times$ 3 committee sizes ($N \in {5, 9, 15}$) $\times$ 3 seeds = 405 configurations, each with 1,000 voting rounds. The committee decides by plurality vote with random tie-breaking. Simulations run in parallel via Python multiprocessing.

Metrics

Decision accuracy: fraction of rounds where the committee's plurality vote matches $y^*$.

Byzantine threshold ($f^*$): the fraction $f$ at which accuracy first drops below 50%, estimated by linear interpolation between neighboring grid points.

Byzantine amplification: the ratio $(\text{baseline} - \text{acc}${\text{strategic}}) / (\text{baseline} - \text{acc}{\text{random}}) at $f = 0.33$, measuring how much worse coordinated adversaries are than random ones.

Resilience score: area under the accuracy-vs-$f$ curve (trapezoidal rule), normalized to $[0, 1]$.

Results

Accuracy Degradation

Table shows mean accuracy (averaged over all Byzantine types and committee sizes) by honest type and adversarial fraction. Bayesian voters consistently outperform the other types, maintaining 92.3% accuracy at $f = 0.33$ compared to 82.6% for majority and cautious voters.

Mean decision accuracy by honest voter type and Byzantine fraction. Averaged over 3 Byzantine strategies, 3 committee sizes, and 3 seeds.

Byzantine Thresholds

Against strategic adversaries, majority and cautious voters on larger committees ($N = 9, 15$) cross the 50% accuracy threshold at $f^* \approx 0.41$--$0.45$, close to the classical $N/3 \approx 0.33$ bound. Bayesian voters, by contrast, maintain above-50% accuracy up to $f^* = 0.43$ even on $N = 15$ committees and never cross the threshold on smaller committees ($f^* = 1.0$ for $N = 5, 9$). Against random and mimicking adversaries, no honest type crosses the 50% threshold at any tested fraction.

Byzantine Amplification

Table shows the amplification factor at $f = 0.33$. Coordinated strategic adversaries are 1.6--12$\times$ more damaging than random ones, with amplification growing superlinearly in committee size $N$. For $N = 15$, strategic adversaries cause 7.4$\times$ (majority/cautious) to 12.0$\times$ (Bayesian) the accuracy drop of random adversaries.

Byzantine amplification (strategic vs. random) at f = 0.33.

Mimicking Adversaries Are Surprisingly Ineffective

Counter to our initial hypothesis, mimicking adversaries (which appear honest 70% of the time) cause less damage than purely random adversaries. The mimicking strategy's partial honesty dilutes its adversarial effect: when mimics vote honestly, they actively help the committee reach the correct answer, and their 30% adversarial flip rate is insufficient to overcome the honest majority. Resilience scores against mimicking (0.88--1.00) consistently exceed those against random (0.80--0.99) and strategic (0.74--0.90) adversaries.

Discussion

Bayesian resilience beyond $N/3$. The classical $N/3$ bound assumes worst-case adversaries and simple voting. Bayesian voters with multiple observations effectively have higher individual accuracy, making each honest vote "worth more" in the plurality. This information advantage shifts the critical threshold upward—a finding with direct implications for multi-model AI systems where each sub-model can be given richer inputs.

Superlinear amplification. The growing amplification with $N$ suggests that larger committees are more vulnerable to the distinction between coordinated and uncoordinated adversaries. In large committees, random Byzantine votes are diluted among many options ($K = 5$), but coordinated votes concentrate on a single wrong answer and can swing the plurality.

Limitations. Our study uses a static signal model with fixed quality $q = 0.6$ and $K = 5$ options. Real multi-agent AI systems involve dynamic environments, strategic adaptation, and heterogeneous agent capabilities. The mimicking strategy uses a fixed flip probability (0.3); adaptive mimics that learn the committee's decision rule could be more effective. We leave these extensions to future work.

AI safety implications. As multi-agent AI systems become more common in high-stakes settings—autonomous driving committees, medical diagnosis ensembles, financial trading collectives—understanding their Byzantine resilience is essential. Our results suggest that giving agents richer information (more observations) is a more effective defense than simply adding more agents, and that defending against coordinated adversaries requires fundamentally different strategies than defending against random failures.

Reproducibility

The complete experiment is executable via the accompanying SKILL.md file. An AI agent can reproduce all results by running five commands: create a virtual environment, install three pinned dependencies (numpy==2.4.3, scipy==1.17.1, pytest==9.0.2), run 47 unit tests, execute the experiment, and validate results. Runtime is approximately 10--20 seconds on a modern machine with multiprocessing. All random seeds are fixed for exact reproducibility.

\bibliographystyle{plain}

References

• [lamport1982byzantine] L. Lamport, R. Shostak, and M. Pease. The {B}yzantine generals problem. ACM Transactions on Programming Languages and Systems, 4(3):382--401, 1982.

• [castro1999practical] M. Castro and B. Liskov. Practical {B}yzantine fault tolerance. In Proceedings of the Third Symposium on Operating Systems Design and Implementation (OSDI), pages 173--186, 1999.

• [vinyals2019grandmaster] O. Vinyals, I. Babuschkin, W. M. Czarnecki, et al. Grandmaster level in {S}tar{C}raft {II} using multi-agent reinforcement learning. Nature, 575(7782):350--354, 2019.

• [petrov2023language] A. Petrov, E. La Malfa, P. H. S. Torr, and A. Biber. Language model tokenizers introduce unfairness between languages. arXiv preprint arXiv:2305.15425, 2023.