功有所归：面向多智能体系统的对比式归因拓扑搜索

# Credit Where Credit Is Due: Contrastive Attribution Topology Search for Multi-Agent Systems
Source: [https://arxiv.org/html/2610.29292](https://arxiv.org/html/2610.29292)
\\workshoptitle

Managing Agents that Manage Agents: Workshop on Responsible Use of Meta\-Agents

###### Abstract

An LLM multi\-agent system \(MAS\) is only as good as the agents it chooses to trust: its accuracy and cost hinge on its topology, meaning which agents are included and how they communicate\. A single task score, however, does not reveal which agents help or hinder performance\. We propose Contrastive Attribution Topology Search \(CATS\), which searches for compact teams within a fixed supergraph of specialized agents\. An LLM attributer compares execution traces across candidate topologies and assigns credit to individual agents\. CATS uses these credits to update supergraph edges while progressively pruning weak edges and agents, yielding a small team for deployment\. With small open\-weight models and matched candidate evaluations, CATS improves mean accuracy on BigCodeBench by 5\.3 percentage points over score\-only heuristic search while using 54% fewer deployment tokens\. On MBPP, CATS matches the strongest baselines with fewer tokens than the other searches\. In a HotpotQA prompt\-poisoning stress test, CATS excludes all adversarially prompted agents in all three runs, whereas random search retains some at comparable accuracy\. Per\-agent credit thus supports both team optimization and the pruning of potentially harmful agents\.

## 1Introduction

LLM\-based multi\-agent systems split work across specialized agents, for example one that writes code and another that tests it\. Such collaboration can improve small models\[[9](https://arxiv.org/html/2610.29292#bib.bib9),[10](https://arxiv.org/html/2610.29292#bib.bib10)\], but more agents and messages mean more tokens\. Building a good system therefore requires choosing which agents to include and how they communicate, that is, the*topology*\. Since the best topology depends on the task, manual design is difficult\[[6](https://arxiv.org/html/2610.29292#bib.bib6),[5](https://arxiv.org/html/2610.29292#bib.bib5)\], which motivates automated search over candidate teams\.

Task scores, however, evaluate the team as a whole: a correct solution may contain unnecessary work, and a failed one may include useful contributions\. Scores alone thus say little about which agents to keep\. Can feedback on individual agents guide the search for compact, effective teams?

We introduce*Contrastive Attribution Topology Search \(CATS\)*, an offline meta\-agent that assembles teams from a fixed agent pool\. Starting from a*supergraph*of candidate links, CATS evaluates sampled teams on target\-domain tasks\. An LLM compares their transcripts and assigns each agent signed credit\. CATS then updates link probabilities, prunes weak links and unreachable agents, and selects one fixed team for deployment\. Agent models, prompts, roles, and tools never change\.

Our contributions are:*\(i\)*contrastive per\-agent credit to guide team construction \(Figure[1](https://arxiv.org/html/2610.29292#S2.F1)\),*\(ii\)*higher mean accuracy and lower deployment token use than score\-only search on two coding benchmarks with matched candidate evaluations \(Table[1](https://arxiv.org/html/2610.29292#S3.T1)\), and*\(iii\)*a HotpotQA stress test where CATS excludes all poisoned agents in every run, while random search retains some at comparable accuracy \(Table[2](https://arxiv.org/html/2610.29292#S3.T2)\)\.

## 2Method

Figure 1:CATS pipeline\.At each ofTTsteps,KKsubgraphs are sampled from the supergraph and evaluated onNNtasks\. The depicted supergraph is a simplified example\.CATS repeatedly samples teams from a supergraph, credits each agent, and prunes weak edges\.

Supergraph\.We search for an optimized multi\-agent topology as a subgraph of a hand\-crafted complete directed acyclic graph specialized to a chosen problem domain \(Figure[1](https://arxiv.org/html/2610.29292#S2.F1)\)\. Its nodes are agents and its edges denote direct communication \(and thereby the scheduling order\)\. Agents are specialized via system prompts, optional reasoning, and tool sets\. We hand\-craft them using domain knowledge \(automating this is left to future work\)\. Each edgeeecarries a logitθe\\theta\_\{e\}with sampling probabilityαe=σ⁡\(θe\)\\alpha\_\{e\}=\\sigma\(\\theta\_\{e\}\), initialized to a commonα0\\alpha\_\{0\}\. Following DARTS\[[7](https://arxiv.org/html/2610.29292#bib.bib7)\], we relax the discrete edge choices to these continuous parameters but replace gradient descent with heuristic credit\-based updates derived from contrastive attribution\.

Sampling\.At each step, we sampleKKtopologies by independently drawinge∼Bernoulli⁡\(αe\)e\\sim\\operatorname\{Bernoulli\}\(\\alpha\_\{e\}\), rejecting graphs with nodes unreachable from the source\. Since agents share an environment, not every agent needs a downstream consumer: edges are optional communication channels\. We evaluate each candidate onNNtasks, obtaining scoressk,qs\_\{k,q\}\. Candidates, tasks, and often agents run in parallel\.

Attribution\.An LLM attributer assigns each participating agentiiin candidatekkon taskqqa creditck,q,i∈\[−1,1\]c\_\{k,q,i\}\\in\[\-1,1\]\(harmful to helpful\) by comparing candidate rollouts on the same task\. The attributer sees task scores, length\-capped agent outputs, tool calls, and the final artifact state \(e\.g\., the coding environment\), and runs in parallel across tasks\.

Update\.Credits are normalized into per\-agent advantagesAk,i=\|Qk,i\|−1​∑q∈Qk,i\(ck,q,i−bq\)A\_\{k,i\}=\|Q\_\{k,i\}\|^\{\-1\}\\sum\_\{q\\in Q\_\{k,i\}\}\(c\_\{k,q,i\}\-b\_\{q\}\), whereQk,iQ\_\{k,i\}holds the tasks with a credit foriiinkkandbqb\_\{q\}is the mean credit over participating agents and candidates for taskqq\. Each edge\(u,v\)\(u,v\)fired in candidatekkis updated byθu​v←θu​v\+η​Ak,v\\theta\_\{uv\}\\leftarrow\\theta\_\{uv\}\+\\eta A\_\{k,v\}\. Unfired non\-source edges into an active agentvvreceive a smaller secondary updateθu​v←θu​v\+η​ρ​Ak,v\\theta\_\{uv\}\\leftarrow\\theta\_\{uv\}\+\\eta\\rho A\_\{k,v\}\. After each step we prune weak edges whose probability has fallen below the fractionδ\\deltaof its initial value \(the*pruning fraction*\),E←\{e∈E:αe≥δ​α0\}E\\leftarrow\\\{e\\in E:\\alpha\_\{e\}\\geq\\delta\\alpha\_\{0\}\\\}, and remove nodes that are no longer reachable from the source\. This shrinks\|E\|\|E\|and thus\|V\|\|V\|, reducing the per\-step cost\.

Selection\.AfterTTsteps we return the*best final candidate*G⋆=arg⁡maxk​1N​∑qsk,qG^\{\\star\}=\\arg\\max\_\{k\}\\tfrac\{1\}\{N\}\\sum\_\{q\}s\_\{k,q\}over the step\-TTcandidates, which are sampled under the accumulated priors\. Ties are broken in favor of fewer agents and then the earlier candidate\. As an ablation, we also evaluate the*pruned supergraph*GpG\_\{\\mathrm\{p\}\}, consisting of all nodes and edges that remain after pruning\.

Baselines\.We compare against \(i\) a direct LLM call without tools, \(ii\) a ReAct\[[13](https://arxiv.org/html/2610.29292#bib.bib13)\]single agent, both with literature\-derived system prompts \(Appendix Table[6](https://arxiv.org/html/2610.29292#A1.T6)\), \(iii\) a hand\-crafted multi\-agent system \(MAS\) designed before observing supergraph results \(Appendix Figure[4\(d\)](https://arxiv.org/html/2610.29292#A1.F4.sf4)\), \(iv\) random topology search, and \(v\) a score\-only heuristic search using CATS’s fired/unfired update and hyperparameters, with scalar task scores replacing agent credits\. Both search baselines matchK×TK\\times Tcandidate evaluations on the same tasks, not compute \(search costs: Appendix Table[10](https://arxiv.org/html/2610.29292#A1.T10)\)\.

## 3Benchmarking

Experimental setup\.We target the local\-deployment setting and therefore use small open\-weight models: Gemma 4 12B for the MAS agents and the larger Gemma 4 31B endpoint for the attributer\[[4](https://arxiv.org/html/2610.29292#bib.bib4)\]\. We evaluate CATS on two agentic coding benchmarks, BigCodeBench and MBPP\[[18](https://arxiv.org/html/2610.29292#bib.bib18),[1](https://arxiv.org/html/2610.29292#bib.bib1)\]\. Each search runs for 4 optimization steps with a high learning rate and pruning fraction \(Table[5](https://arxiv.org/html/2610.29292#A1.T5)\)\. This configuration performed well in preliminary experiments that excluded the held\-out tasks, though we do not claim it is optimal\. We repeat all experiments over three random seeds and report means with standard deviations\.

Table 1:Searched topologies versus hand\-crafted and single\-agent baselines\.Held\-out coding tasks, mean±\\pmsample SD over 3 seeds, 100 tasks per benchmark\. Best score per benchmark in bold\.
Table 2:Poisoned\-pool stress test on HotpotQA\.Results for CATS, random search, and score\-only search \(mean±\\pmsample SD, 3 seeds, 100 tasks\)\.Figure 2:BigCodeBench search dynamics\(mean±\\pmSD, 3 seeds\)\.

BigCodeBench\.Our selected topologyG⋆G^\{\\star\}improves mean accuracy over the strongest baseline, score\-only heuristic search, by 5\.3 points while using 54% fewer deployment tokens with matched candidate evaluations \(Table[1](https://arxiv.org/html/2610.29292#S3.T1)\)\. Gains hold across all three seeds, but standard deviations overlap and uncertainty remains \(Table[8](https://arxiv.org/html/2610.29292#A1.T8)\)\.

MBPP\.G⋆G^\{\\star\}performs comparably to the hand\-crafted MAS and random search, using fewer deployment tokens than the other searches but more than the hand\-crafted MAS \(Table[1](https://arxiv.org/html/2610.29292#S3.T1)\)\.

Final\-candidate ablation\.DeployingG⋆G^\{\\star\}instead ofGpG\_\{\\mathrm\{p\}\}roughly halves coding deployment tokens, with higher mean accuracy on BigCodeBench and the same on MBPP \(Table[1](https://arxiv.org/html/2610.29292#S3.T1)\)\.

Offline search tokens\.Including attribution, CATS uses 28% and 35% fewer mean search tokens than score\-only search on BigCodeBench and MBPP, respectively, but roughly twice those of either search baseline on poisoned HotpotQA \(Table[10](https://arxiv.org/html/2610.29292#A1.T10)\)\.

Discovered architectures\.Every selected coding team retains a draft coder; 3 of 6 have no inter\-agent edges, but agents can still interact through the shared environment\. All selected HotpotQA teams instead retain reader\-to\-submitter paths \(Appendix[A\.2](https://arxiv.org/html/2610.29292#A1.SS2)\)\. These patterns support team construction, with agent selection the clearest coding result; they do not isolate a benefit from communication optimization\.

## 4Poisoned\-Pool Stress Test

Figure 3:Selected topologies on HotpotQA\(seed 13\)\. Poisoned agents are in orange\.A meta\-agent that assembles teams must also decline to delegate to agents it should not trust\. To probe this failure mode, we construct a*poisoned*variant of HotpotQA\[[12](https://arxiv.org/html/2610.29292#bib.bib12)\], a third domain distinct from the coding tasks above\. Its supergraph contains six adversarially prompted agents and four honest agents\. The attacks include plan misdirection, fabricated evidence, citation spoofing, instruction hijacking, late answer overwrites, and exact\-match sabotage \(Table[3](https://arxiv.org/html/2610.29292#A1.T3)\)\. The search receives no adversarial supervision: it observes only task scores and transcripts, and is never told which agents are poisoned\. Table[2](https://arxiv.org/html/2610.29292#S3.T2)shows why task score alone is insufficient to assess delegation: comparable scores can mask different levels of poisoned\-agent recruitment\. CATS retains no poisoned agents across all three seeds\. Random search retains two on average\. Score\-only search’s teams are cheap but inaccurate: 1, 2, and 5 agents, one with four poisoned\. CATS instead removes their incoming edges, making them unreachable \(Figure[3](https://arxiv.org/html/2610.29292#S4.F3)\)\. Exclusion is therefore a byproduct of the optimization signal, not a separate security filter\.

## 5Related Work

Topology is an established optimization target: GPTSwarm optimizes agent graphs, MaAS samples query\-dependent systems from an agentic supergraph, and AgentPrune prunes redundant or malicious communication\[[17](https://arxiv.org/html/2610.29292#bib.bib17),[15](https://arxiv.org/html/2610.29292#bib.bib15),[16](https://arxiv.org/html/2610.29292#bib.bib16)\]\. Graph\-GRPO derives statistical, per\-edge credit from relative task rewards within groups of sampled graphs\[[3](https://arxiv.org/html/2610.29292#bib.bib3)\]\. CATS instead uses LLM\-judged, per\-agent credit, adapting contrastive attribution from prompt optimization\[[14](https://arxiv.org/html/2610.29292#bib.bib14)\]to topology search: agent configurations stay fixed, while team membership and communication links change\. Introspective LLM judges do not faithfully approximate leave\-one\-out contribution\[[8](https://arxiv.org/html/2610.29292#bib.bib8)\], so we treat our credit as an optimization signal, not a causal measure\.

## 6Limitations, Responsible Use, and Conclusion

Evaluating a single model family across three domains and three seeds limits what we can conclude about broader transfer and variance, while high baseline scores on MBPP leave little headroom for accuracy gains\. Moreover, although pruning yields sparse coding teams, this may reflect coordination via the shared environment rather than a general lack of need for direct communication\. Finally, we only track token cost without optimizing it, making Pareto search over score and cost, as done for prompts by[Büssing et al\. \[2\]](https://arxiv.org/html/2610.29292#bib.bib2), a natural next step\.

Attribution credits have not been validated against human judgments\. Credit–success correlation \(Table[9](https://arxiv.org/html/2610.29292#A1.T9)\) is only a consistency check, since the attributer seessystem\_score\. The score\-only baseline was not separately tuned and does not isolate which component of CATS accounts for the difference\. Credit is node\-level, propagated equally to all incoming fired edges\. A comparison with Graph\-GRPO’s statistical edge\-level credit remains future work\[[3](https://arxiv.org/html/2610.29292#bib.bib3)\]\.

CATS turns a hand\-crafted supergraph into a small fixed team\. It improved the balance between performance and efficiency on BigCodeBench, reduced unnecessary complexity on the easier MBPP, and excluded poisoned agents that task scores alone could not detect\. In all three domains it matched or beat score\-only heuristic search on score, deployment\-token use, or both\. This supports attribution for team optimization and the pruning of potentially harmful agents, not a security guarantee\.

#### Responsible\-use statement\.

Selecting a topology determines which agents gain access to tools and task context\. Our stress test shows that attribution can exclude fixed adversarial prompts, but this does not establish deployment safety\. An adaptive adversary could act beyond the capped transcript window or exploit the unverified LLM attributer directly\. Tool and data permissions must therefore remain outside the optimizer\.

## Acknowledgments and Disclosure of Funding

Tom Zehle received funding from the European Union\. This work was supported by the European Union’s Horizon Europe research and innovation programme under grant agreement No\. 101214398 \(ELLIOT\)\. Views and opinions expressed are, however, those of the authors only and do not necessarily reflect those of the European Union or the European Commission\. Neither the European Union nor the granting authority can be held responsible for them\. Finally, we thank the anonymous reviewers for their constructive feedback\.

## References

- \[1\]Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry, Quoc Le, and Charles Sutton\.Program Synthesis with Large Language Models, August 2021\.arXiv:2108\.07732 \[cs\.PL\]\.
- \[2\]Jan Büssing, Moritz Schlager, Timo Heiß, Tom Zehle, and Matthias Feurer\.MO\-CAPO: Multi\-Objective Cost\-Aware Prompt Optimization, May 2026\.arXiv:2605\.18869 \[cs\.LG\]\.
- \[3\]Yueyang Cang, Xiaoteng Zhang, Erlu Zhao, Zehua Ji, Yuhang Liu, Yuchen He, Zhiyuan Ning, Chen Chen, Wenge Que, and Li Shi\.Graph\-GRPO: Stabilizing Multi\-Agent Topology Learning via Group Relative Policy Optimization, March 2026\.arXiv:2603\.02701 \[cs\.CL\]\.
- \[4\]Gemma Team et al\.Gemma 4 Technical Report, July 2026\.arXiv:2607\.02770 \[cs\.CL\]\.
- \[5\]Junda He, Christoph Treude, and David Lo\.LLM\-Based Multi\-Agent Systems for Software Engineering: Literature Review, Vision, and the Road Ahead\.*ACM Transactions on Software Engineering and Methodology*, 34\(5\):124:1–124:30, May 2025\.ISSN 1049\-331X\.doi:10\.1145/3712003\.
- \[6\]Xinyi Li, Sai Wang, Siqi Zeng, Yu Wu, and Yi Yang\.A survey on LLM\-based multi\-agent systems: workflow, infrastructure, and challenges\.*Vicinagearth*, 1\(1\):9, 2024\.doi:10\.1007/s44336\-024\-00009\-2\.
- \[7\]Hanxiao Liu, Karen Simonyan, and Yiming Yang\.DARTS: Differentiable Architecture Search\.In*International Conference on Learning Representations \(ICLR\)*, 2019\.
- \[8\]Mingyu Lu, Yushan Huang, Chris Lin, and Su\-In Lee\.Agents that Matter: Optimizing Multi\-Agent LLMs via Removal\-Based Attribution, May 2026\.arXiv:2605\.27621 \[cs\.MA\]\.
- \[9\]Weizhou Shen, Chenliang Li, Hongzhan Chen, Ming Yan, Xiaojun Quan, Hehong Chen, Ji Zhang, and Fei Huang\.Small LLMs Are Weak Tool Learners: A Multi\-LLM Agent\.In*Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*\. Association for Computational Linguistics, 2024\.doi:10\.18653/v1/2024\.emnlp\-main\.929\.
- \[10\]Varun Sunkaraneni, Pierfrancesco Beneventano, Riccardo Neumarker, Tomaso Poggio, and Tomer Galanti\.Agentic Systems as Boosting Weak Reasoning Models, May 2026\.arXiv:2605\.14163 \[cs\.AI\]\.
- \[11\]Ronald J\. Williams\.Simple Statistical Gradient\-Following Algorithms for Connectionist Reinforcement Learning\.*Machine Learning*, 8\(3\-4\):229–256, May 1992\.ISSN 0885\-6125\.doi:10\.1007/BF00992696\.
- \[12\]Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D\. Manning\.HotpotQA: A Dataset for Diverse, Explainable Multi\-hop Question Answering\.In*Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*\. Association for Computational Linguistics, 2018\.doi:10\.18653/v1/D18\-1259\.
- \[13\]Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R\. Narasimhan, and Yuan Cao\.ReAct: Synergizing Reasoning and Acting in Language Models\.In*International Conference on Learning Representations \(ICLR\)*, 2023\.
- \[14\]Tom Zehle\.CANTANTE: Optimizing Agentic Systems via Contrastive Credit Attribution, May 2026\.arXiv:2605\.13295 \[cs\.CL\]\.
- \[15\]Guibin Zhang, Luyang Niu, Junfeng Fang, Kun Wang, Lei Bai, and Xiang Wang\.Multi\-Agent Architecture Search via Agentic Supernet\.In*International Conference on Machine Learning \(ICML\)*\. PMLR, 2025a\.
- \[16\]Guibin Zhang, Yanwei Yue, Zhixun Li, Sukwon Yun, Guancheng Wan, Kun Wang, Dawei Cheng, Jeffrey Xu Yu, and Tianlong Chen\.Cut the Crap: An Economical Communication Pipeline for LLM\-based Multi\-Agent Systems\.In*International Conference on Learning Representations \(ICLR\)*, 2025b\.
- \[17\]Mingchen Zhuge, Wenyi Wang, Louis Kirsch, Francesco Faccio, Dmitrii Khizbullin, and Jürgen Schmidhuber\.GPTSwarm: Language Agents as Optimizable Graphs\.In*International Conference on Machine Learning \(ICML\)*\. PMLR, 2024\.
- \[18\]Terry Yue Zhuo, Minh Chien Vu, Jenny Chim, Han Hu, Wenhao Yu, Ratnadira Widyasari, Imam Nur Bani Yusuf, Haolan Zhan, Junda He, Indraneil Paul, Simon Brunner, Chen Gong, James Hoang, Armel Zebaze, Xiaoheng Hong, Wen\-Ding Li, Jean Kaddour, Ming Xu, Zhihan Zhang, Prateek Yadav, Naman Jain, Alex Gu, Zhoujun Cheng, Jiawei Liu, Qian Liu, Zijian Wang, Binyuan Hui, Niklas Muennighoff, David Lo, Daniel Fried, Xiaoning Du, Harm de Vries, and Leandro von Werra\.BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructions\.In*International Conference on Learning Representations \(ICLR\)*, 2025\.

## Appendix AAdditional Experimental Details

### A\.1Supergraphs and Graphs

\(a\)BigCodeBench\.\(b\)MBPP\.\(c\)Poisoned HotpotQA\.startPlannerExecutorVerifierrepair\(max\. 5\)

\(d\)Hand\-crafted MAS baseline\.

Figure 4:Initial supergraphs and fixed baseline\.Supergraph edges run forward between layers, and*start*edges select entry agents\. Orange nodes in \(c\) are adversarially prompted\. These labels are hidden from the search and attributer\. Agent codes are listed in Table[3](https://arxiv.org/html/2610.29292#A1.T3)\.Table 3:Agent pools\.HotpotQA alignment labels are for post\-hoc measurement only and are read by neither the search nor the attributer\. A read budget of zero permits listing titles but not reading passages\.BigCodeBench

MBPP

Poisoned HotpotQA

### A\.2Selected Deployment Architectures

Table 4:Selected deployment topologiesG⋆G^\{\\star\}\.These are the highest\-scoring step\-4 candidates on the search set and are the systems reported as “CATS” in the main tables\. Agent codes are resolved in Table[3](https://arxiv.org/html/2610.29292#A1.T3)\. Each listed edge is directed\.*start*denotes an entry edge\.The selected coding teams consistently retain a draft coder alongside one or two other agents, but their communication patterns differ \(Table[4](https://arxiv.org/html/2610.29292#A1.T4)\)\. For example, BigCodeBench seed 13 connects a draft coder, implementer, and test designer in a chain; MBPP seed 13 selects the same roles with only direct entry edges from*start*\. Two further BigCodeBench teams likewise have only entry edges, while the remaining MBPP teams retain a single inter\-agent edge\. These patterns show that selecting a set of agents and connecting that set are distinct decisions\. Because agents access a shared environment, teams with only entry edges can still interact through the persisted artifact\.

HotpotQA yields a different pattern: every selected team retains the second\-hop reader and either the drafter or final submitter, with directed communication from a reader to the answer\-submitting agent\. These teams combine retrieval and answer submission while excluding all poisoned roles\. The contrast with coding illustrates that the search does not always remove communication\. However, these graphs alone do not establish the benefit of their particular edges; that would require a comparison that holds agent membership fixed\.

### A\.3Search and Baselines

Table 5:Run settings\.*Left:*CATS hyperparameters, shared across benchmarks\.*Right:*per\-benchmark inference settings and mean CATS cost\. Attribution accounted for 9–11% of coding\-search tokens\.
Table 6:Operational definitions of the baselines\.All baselines use the same task model, grader, decoding limits, and seed\-specific held\-out tasks\.
### A\.4Evaluation Protocol

Field caps useo200k\_basetokens, retain the prefix, discard the tail, and append the marker\.\.\. \[truncated\]outside the cap\. Agent input fields \(query and upstream outputs\) use the 900/700\-token caps in Table[5](https://arxiv.org/html/2610.29292#A1.T5); the attributer’s query and string\-valuedsaysfields use 120 tokens for coding and 150 for HotpotQA, withdoestool\-effect logs andfinalsummaries exempt from field capping\. The assembled attributer prompt is also prefix\-capped at its model limit minus the attribution field cap\.

Seeds 13–15 jointly control splits, global randomness, topology sampling, and generation\. The generation endpoint, hosted by the University of Freiburg, used the aliasesgemma\-4\-12b\-llmlb\(agents/baselines\) andgemma\-4\-31b\-llmlb\(attributer\)\. Weight hashes and quantization were not exposed\. Coding runs use fresh temporary directories and process groups with a 30\-second timeout\. Crashes, timeouts, empty environments, and unusable results score zero\. Deployment tokens count all agent\-call input and output tokens per held\-out task\. All reported±\\pmvalues and shaded bands are Bessel\-corrected sample standard deviations over three runs\.

Table 7:Dataset splits and grading\.Each held\-out set contains 100 tasks\.
### A\.5Per\-Seed Results and Additional Analyses

Table 8:Per\-seed evaluations supporting the headline comparisons\.Each seed groups results for the selected topologies on its 100\-task held\-out set\. Scores are percentages\. Tokens are thousands of input plus output tokens per task\.V/EV/Ecounts selected agents/edges, including start edges\.PPcounts poisoned agents \(HotpotQA only\)\.Seed 13Seed 14Seed 15MethodScoreTokensV/EV/EPPScoreTokensV/EV/EPPScoreTokensV/EV/EPPBigCodeBenchCATS537\.163/3—434\.702/2—488\.282/2—Random359\.065/6—2811\.082/2—425\.931/1—Score\-only search456\.623/3—3723\.714/5—4613\.755/8—MBPPCATS724\.453/3—855\.903/4—855\.442/3—Random759\.327/7—8431\.319/12—8215\.827/8—Score\-only search739\.796/6—8428\.858/15—8027\.8810/18—HotpotQACATS588\.373/406411\.242/305718\.633/50Random6012\.975/525420\.016/635912\.233/31Score\-only search273\.952/20226\.185/54241\.241/10\(a\)MBPP search score\.\(b\)MBPP surviving edges\.
Figure 5:CATS dynamics on MBPP\.The corresponding BigCodeBench panels appear in the main paper\. Lines show means over three seeds\. Bands show sample standard deviations\.Table 9:Credit–success consistency check\.Correlation between the mean credit over participating agents,c¯k,q\\bar\{c\}\_\{k,q\}, and the binary task scoresk,qs\_\{k,q\}, over all \(candidate, task\) pairs\. Within\-task columns correlate within each query\. Scores are binary, so Pearsonrris the point\-biserial coefficient\. Four pairs are dropped from seed 15 due to one unparsed transcript\. The attributer seessystem\_score, so this is not independent validation of credit quality\.Table 10:Offline search tokens, separate from deployment\.Millions of input plus output tokens for 16 candidates on 100 search tasks, averaged over seeds 13–15; totals include sample SD\.

## Appendix BBigCodeBench Attributer Call

We adapt contrastive attribution\[[14](https://arxiv.org/html/2610.29292#bib.bib14)\]for BigCodeBench by grading the persisted code artifact instead of agent text\. We also expose ordered, compact tool effects\. The representative call below is excerpted, with omitted material marked\[\.\.\.\]\.

=====PROMPT\(ABRIDGED\)=====

\#Task

Youareanattributionagentforamulti\-agentsystem\.

\[\.\.\.\]

Yourgoalistoestimatehoweachagent’sbehaviorcontributedtothe

outcomeofitsexecutionbycomparingdifferencesacrossexecutions\.

Baseyourattributionon:

\-thesystemscoredifferencesacrossexecutions,

\-thesystemprediction

\[\.\.\.\]

\-whateachagentmeasurablychangedinthesharedenvironment\.

\#AttributionScale

Assignafloatscorein\[\-1\.0,1\.0\]toeachagentforeachexecution:

\-positive=helpfulcontribution

\-negative=harmfulcontribution

\-0=neutralorunclearimpact

\#TheProtocol

Thissystemisgradedonanartifactheldinasharedcodingenvironment,

notonanyagent’stext:thecodepersistedwith‘write\_code‘iswhatthe

hiddentestsuiteruns,anditappearsinnoagent’soutput\.Soeveryagent

isgiventwokeys:‘says‘\(itstextoutput\)and‘does‘\(anumberedlogof

everytoolcallitmade,inorder\)\.

Each‘does‘lineis‘<seq\><VERB\><target\><delta\>\["<observed\>"\]‘:

1SETcode=c14L

\[\.\.\.\]

5EDITcodec1\-\>c2\+1/\-1

6NOOPwrite\_code"\[rejected\-unsafeimport\]"

\[\.\.\.\]Onlytargetsnamedin‘final‘aregraded\.Scratchwritescountonly

throughavisiblelaterobservationfollowedbyagradedwrite\.Whenseveral

agentswritecode,creditonlywhatsurvivesintothegradedvalue\.Trust

‘does‘overconflictingclaimsin‘says‘,andtreatexampletestsasthe

exactrequiredbehavior\.\[\.\.\.\]

\#Input

YouwillreceiveJSONwith‘query‘andan‘executions‘list\.Eachexecution

contains‘system\_score‘,‘final‘,andamappingfromagentnamesto‘says‘

and‘does‘\.\[\.\.\.\]

\#Output

First,brieflycomparetheexecutionsandidentifythekeybehavioral

differencesthatleadtodifferencesinthesystemscore\.

ThenreturnJSONinside<attribution\>\.\.\.</attribution\>\.Thetop\-levelobject

musthaveexactlyonekey,‘executions‘,containingexactlyfouritemsin

inputorder\.Eachitemcontainsonly‘agent\_credits‘,withexactlytheseven

specifiedagentnamesandfloatvaluesin\[\-1\.0,1\.0\]\.\[\.\.\.\]

\#Few\-shotexample

\[\.\.\.\]

=====RESPONSE\(ABRIDGED\)=====

Allfourexecutionsfailed\(system\_score:0\.0\),primarilybecausetheagents

struggledtoalignthecodeimplementationwiththeactualdatastructure

impliedbytheprompt\.

\[\.\.\.\]

InExecution3,EDGE\_CASE\_TESTER\_4wroteteststothescratchpad

\(‘test\_list‘\)\.However,becausenocoderfollowedthesetestswithawriteto

thegraded‘code‘target,thesetestshadzeroimpactontheoutcome\.\[\.\.\.\]

<attribution\>

\{"executions":\[

\{"agent\_credits":\{"BRAINSTORMER\_8":0\.0,"CRITIQUER\_7":0\.0,"DRAFT\_CODER\_1":0\.0,

"EDGE\_CASE\_TESTER\_4":0\.0,"IMPLEMENTER\_2":\-0\.2,"REVIEWER\_6":0\.0,"VERIFIER\_5":\-0\.4\}\},

\{"agent\_credits":\{"BRAINSTORMER\_8":0\.0,"CRITIQUER\_7":\-0\.2,"DRAFT\_CODER\_1":\-0\.4,

"EDGE\_CASE\_TESTER\_4":0\.0,"IMPLEMENTER\_2":0\.0,"REVIEWER\_6":0\.0,"VERIFIER\_5":0\.0\}\},

\{"agent\_credits":\{"BRAINSTORMER\_8":0\.0,"CRITIQUER\_7":0\.0,"DRAFT\_CODER\_1":0\.0,

"EDGE\_CASE\_TESTER\_4":0\.0,"IMPLEMENTER\_2":0\.0,"REVIEWER\_6":0\.0,"VERIFIER\_5":0\.0\}\},

\{"agent\_credits":\{"BRAINSTORMER\_8":0\.0,"CRITIQUER\_7":0\.0,"DRAFT\_CODER\_1":0\.0,

"EDGE\_CASE\_TESTER\_4":0\.0,"IMPLEMENTER\_2":0\.0,"REVIEWER\_6":0\.0,"VERIFIER\_5":0\.0\}\}

\]\}

</attribution\>