The Hallucination Snowball: Modeling Error Propagation as State Transitions in Multi-Agent LLM Pipelines

# Modeling Error Propagation as State Transitions in Multi-Agent LLM Pipelines
Source: [https://arxiv.org/html/2608.14588](https://arxiv.org/html/2608.14588)
## The Hallucination Snowball: Modeling Error Propagation as State Transitions in Multi\-Agent LLM Pipelines

###### Abstract

Sequential multi\-agent LLM pipelines chain specialized agents without verification at handoffs, creating a structural flaw with measurable and severe consequences\. We show that hallucinations injected at Stage 1 do not merely persist; they transform: raw numerical facts become derived computations, then narrative prose, then editorially approved conclusions\. At each transformation, detectability degrades near\-irreversibly\. We formalize this as thehallucination snowball effect, a first\-order Markov process over four states \(Raw Fact→\\toDerived→\\toNarrative→\\toInvisible\) with empirically measured per\-boundary escape probabilities of 24\.6%, 48\.3%, and 89\.3%\. Across 346 automatically injected hallucinations in a 4\-agent financial analysis pipeline on FinanceBench, gpt\-4o detection drops from 72\.0% at Stage 1 to 50\.9% at Stage 4, and 23\.7% of hallucinations survive completely undetected in the final output\. Even the strongest model tested \(Qwen3\.5\-397B\-A17B, 87\.0% at Stage 1\) faces a structural ceiling; projected Stage 4 detection is only∼\{\\sim\}60–65%\. Critically, boundary gates using identical RAG verification tools reduce hallucination survival from 58\.4% to 16\.2% versus end\-of\-pipeline checking \(Cohen’sh=−0\.911h=\-0\.911,p<0\.000001p<0\.000001\), while end\-checking alone achieves merely 2\.3 pp improvement over no verification\.When you verify matters more than whether you verify\.Our model predicts survival fornn\-agent linear pipelines and prescribes optimal verification resource allocation: invest atS1→S2S\_\{1\}\{\\to\}S\_\{2\}first, where 75\.4% of hallucinations are still catchable, not atS3→S4S\_\{3\}\{\\to\}S\_\{4\}where 89\.3% have already escaped\.

multi\-agent LLM pipelines, hallucination propagation, error compounding, agentic AI reliability, retrieval\-augmented verification, Markov error model, pipeline verification, factual consistency

## 1Introduction

Multi\-agent LLM pipelines have become the dominant architecture for complex, high\-stakes AI tasks\. Frameworks like LangGraph\(LangChain AI,[2024](https://arxiv.org/html/2608.14588#bib.bib12)\), AutoGen\(Wuet al\.,[2023](https://arxiv.org/html/2608.14588#bib.bib13)\), and CrewAI\(CrewAI Inc\.,[2024](https://arxiv.org/html/2608.14588#bib.bib14)\)make it trivial to chain specialized agents sequentially: Researcher→\\toAnalyst→\\toWriter→\\toReviewer\. Each agent receives only its predecessor’s text output with no provenance metadata, no confidence scores, and no access to source documents\. Every agent trusts its predecessor completely\. This architectural choice has a measurable and surprisingly severe consequence\.

Consider a hallucination introduced at Stage 1: “COGS was $71\.2B” \(true value: $63\.1B\)\. By Stage 2, the Analyst computes “an 8\.3% YoY increase,” a derived claim built on a fabricated base\. By Stage 3, the Writer produces “Boeing faced significant cost headwinds, with COGS rising 8\.3% to $71\.2B, reflecting supply chain disruptions\.” By Stage 4, the Reviewer approves it as “well\-structured analysis with sound reasoning,” having been given no source documents and only able to check internal consistency\. The hallucination has been laundered completely\.

Prior work frames hallucination mitigation as finding a better detector\(Minet al\.,[2023](https://arxiv.org/html/2608.14588#bib.bib1); Dhuliawalaet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib2); Songet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib3); Weiet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib4)\)\. We show this framing is fundamentally incomplete for sequential multi\-agent systems\. gpt\-4o detection drops from 72\.0% at Stage 1 to 50\.9% at Stage 4, a 21\.1 pp decay regardless of detector sophistication\. End\-of\-pipeline verification achieves only 2\.3 pp improvement over no verification \(from 60\.7% to 58\.4% survival\) because the information required to verify the original claim is structurally destroyed by upstream transformations\. The correct framing is propagation control, not detection\.

We present three experiments and a theoretical model\.†††Code and results available at[https://github\.com/prabhjotschugh/hallucination\-snowball](https://github.com/prabhjotschugh/hallucination-snowball)\.Section[3\.2](https://arxiv.org/html/2608.14588#S3.SS2)measures detectability decay across stages\. Section[3\.3](https://arxiv.org/html/2608.14588#S3.SS3)characterizes the structural ceiling of LLM skepticism\. Section[3\.4](https://arxiv.org/html/2608.14588#S3.SS4)demonstrates that boundary gates reduce survival from 58\.4% to 16\.2%, a 42\.2 pp improvement over end\-checking \(Cohen’sh=−0\.911h=\-0\.911,p<0\.000001p<0\.000001\), at a measured quality cost of 4\.44 to 3\.93 on internal consistency\. Section[4](https://arxiv.org/html/2608.14588#S4)formalizes propagation as a Markov process with measured transition probabilities and prescribes optimal gate placement\. Figure[1](https://arxiv.org/html/2608.14588#S1.F1)illustrates the four states and their empirically measured escape probabilities\. While we demonstrate this in financial analysis, chosen for its unambiguous numeric ground truth, the transformation mechanism is domain\-agnostic: any pipeline where a checkable fact can be converted into confident narrative faces identical dynamics\. Medical summarization pipelines that chain extraction and synthesis, legal review pipelines that chain precedent retrieval and brief drafting, and research automation pipelines that chain literature search and report generation all share the same structural flaw\. The measurement infrastructure and gate architecture we provide are structurally applicable across all of them, though domain\-specific escape rates will require calibration outside the numeric\-finance setting\.

![Refer to caption](https://arxiv.org/html/2608.14588v1/x1.png)Figure 1:Four\-state Markov process of hallucination propagation\. Escape probabilities rise from 24\.6% to 89\.3% across boundaries; byS3→S4S\_\{3\}\{\\to\}S\_\{4\}, nearly 90% of hallucinations are structurally unrecoverable by any downstream gate\.
## 2Background and Related Work

### 2\.1Single\-Agent Hallucination Detection

The dominant paradigm treats hallucination as a property of isolated model outputs\. FActScore\(Minet al\.,[2023](https://arxiv.org/html/2608.14588#bib.bib1)\)decomposes generations into atomic claims and verifies each against a knowledge source\. CoVe\(Dhuliawalaet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib2)\)uses self\-verification chains where a model checks its own outputs\. VeriScore\(Songet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib3)\)extends this to long\-form generation\. SAFE\(Weiet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib4)\)uses search\-augmented fact evaluation\. All of these operate at what we callS1S\_\{1\}only: a single output evaluated in isolation\. None models what happens when one agent’s hallucinated output becomes the next agent’s input\. Our work shows that a hallucination detectable at 72\.0% atS1S\_\{1\}becomes catchable at only 50\.9% three transformations later, making single\-agent evaluation an insufficient framework for sequential pipelines\.

### 2\.2Multi\-Agent Debate and Collaboration

Du et al\.\(Duet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib5)\)show that multiple LLMs debating over the same question improves reasoning\. MAD\(Lianget al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib6)\)extends this to structured adversarial debate\. Critically, both use parallel topologies where all agents share the same factual foundation simultaneously\. Sequential propagation, where each agent sees only the previous agent’s transformed output, is structurally absent from this line of work\. Our failure mode is orthogonal and addresses the architecture actually deployed in production via LangGraph\(LangChain AI,[2024](https://arxiv.org/html/2608.14588#bib.bib12)\), AutoGen\(Wuet al\.,[2023](https://arxiv.org/html/2608.14588#bib.bib13)\), and CrewAI\(CrewAI Inc\.,[2024](https://arxiv.org/html/2608.14588#bib.bib14)\)\.

### 2\.3Trust and Security in Multi\-Agent Systems

TrustAgent\(Huaet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib7)\)and work on rogue agents\(Yanget al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib8)\)study intentional adversarial manipulation by malicious agents in multi\-agent settings\. Our failure mode is categorically different: it requires no adversary\. Completely well\-intentioned agents following their instructions faithfully produce the hallucination snowball because the architecture provides no error\-correction mechanism at handoffs\. This makes the snowball more pervasive than adversarial threats, which require compromised intent\.

### 2\.4RAG and Retrieval\-Augmented Verification

Lewis et al\.\(Lewiset al\.,[2021](https://arxiv.org/html/2608.14588#bib.bib9)\)introduced retrieval\-augmented generation to ground LLM outputs in external documents\. Subsequent work\(Gaoet al\.,[2024](https://arxiv.org/html/2608.14588#bib.bib10)\)has extended RAG to diverse settings\. Our boundary gate is inspired by this line of work but deployed at a fundamentally different layer: not to augment generation, but to verify agent output at handoff points before the next agent processes it\. Crucially, our gate is a deterministic numeric matcher \(zero LLM calls\) rather than a retrieval system; we retain the “RAG” label only to signal the grounding intent, not the mechanism\. The placement principle, verify before handoff, not before generation, is novel\.

### 2\.5Concurrent and Complementary Work

AgentHallu\(Liuet al\.,[2026](https://arxiv.org/html/2608.14588#bib.bib15)\)independently confirms that early\-stage errors dominate downstream failures; where it diagnoses which agent caused a hallucination post\-hoc, we measure how detectability degrades across transformations and intervene before transformation occurs\. VERIMAP\(Xuet al\.,[2026](https://arxiv.org/html/2608.14588#bib.bib16)\)operationalizes per\-subtask verification in DAG\-structured workflows; our Markov model provides data\-driven guidance for where gates yield the highest return within such frameworks\. CaveAgent\(Ranet al\.,[2026](https://arxiv.org/html/2608.14588#bib.bib17)\)reduces laundering by avoiding lossy text handoffs entirely, an orthogonal mitigation that trades architectural flexibility for verifiability\. Comparing boundary gates against structured\-handoff baselines remains an important open question\.

### 2\.6The Gap We Fill

No prior work provides a mathematical framework for hallucination transformation across sequential agents, measures where detectability decays most sharply within a pipeline, or demonstrates empirically that verification timing dominates verification tooling\. The FMAI workshop calls for trace\-level diagnostics and explicit evidence about what improves and what does not\. Prior work offers neither for sequential multi\-agent systems\. We address all three\.

## 3Experiments

### 3\.1Setup and Injection Protocol

#### Pipeline\.

We implement a 4\-agent sequential pipeline in LangGraph\(LangChain AI,[2024](https://arxiv.org/html/2608.14588#bib.bib12)\):

Researcher→Analyst→Writer→Reviewer\\text\{Researcher\}\\to\\text\{Analyst\}\\to\\text\{Writer\}\\to\\text\{Reviewer\}
All agents use gpt\-4o\-mini \(temperature=0\.3\) with role\-specific system prompts\. The Researcher extracts exact figures from SEC filings\. The Analyst computes YoY changes and ratios using only Researcher output\. The Writer produces a 300–500 word professional narrative\. The Reviewer performs internal consistency checking only, with no access to source documents\.

#### Dataset\.

We evaluate on FinanceBench\(Islamet al\.,[2023](https://arxiv.org/html/2608.14588#bib.bib11)\), 150 expert\-annotated financial QA pairs from real SEC filings with exact numeric ground truth\. We exclude 10 questions producing qualitative outputs with no injectable numeric values, yielding 140 usable questions\. All questions are converted to complex multi\-part analytical directives via gpt\-4o\-mini to reflect realistic pipeline inputs\.

#### Injection Protocol\.

We automatically inject 346 hallucinations across 140 questions \(2–3 per question\) using deterministic regex\-based perturbation with fixed seeds \(RANDOM\_SEED=42\)\. Dollar amounts and large numbers are multiplicatively shifted by 15–40%; percentages receive an additive shift of 3–12 pp\. Injection occurs immediately after Stage 1, before any downstream agent, forcing hallucinations to propagate through the full transformation chain\. All injections are logged with complete metadata enabling exact replication\.

#### Detection Instruments\.

We use two instruments applied independently to each of the four stage outputs\.gpt\-4o Judge:a forensic financial auditor with no ground truth access, instructed to flag suspicious claims via internal reasoning alone\.Retrieval Checker:a fully deterministic numeric matcher \(zero LLM calls\) comparing agent output against FinanceBench ground truth, evidence strings, and the pre\-injection researcher output at 1% tolerance \(tighter than the 2% tolerance used in Experiment 3’s RAG gate, which accommodates agent\-introduced numeric reformatting such as rounding $71\.2B to $71B\)\. The retrieval checker represents the theoretical detection ceiling; gpt\-4o Judge represents the realistic deployment scenario\.

### 3\.2Experiment 1: Detectability Decay Across Stages

We evaluate both detection instruments independently at all four pipeline stages across all 346 injected hallucinations \(Table[1](https://arxiv.org/html/2608.14588#S3.T1)\)\.

Table 1:Detection rates by stage\. Drop measuredS1→S4S\_\{1\}\{\\to\}S\_\{4\}\.gpt\-4o detection drops 21\.1 pp from Stage 1 to Stage 4\. Critically, 82/346 hallucinations \(23\.7%\) survive completely undetected by either instrument in the final output\. Zero hallucinations follow the all\-missed trajectory: every injected hallucination is detectable at Stage 1\. The pipeline, not the hallucination itself, is what produces invisibility\. Figure[2](https://arxiv.org/html/2608.14588#S3.F2)visualizes detectability decay across all three detection methods\.

![Refer to caption](https://arxiv.org/html/2608.14588v1/x2.png)Figure 2:Hallucination detectability decays monotonically across all three detection methods \(nn=346\)\. Every hallucination is detectable atS1S\_\{1\}; gpt\-4o Judge drops 21\.1 pp byS4S\_\{4\}, confirming the pipeline, not the hallucination itself, creates invisibility\.Decay is boundary\-concentrated, not uniform\. The largest drop occurs atS1→S2S\_\{1\}\{\\to\}S\_\{2\}\(gpt\-4o:−\-11\.6 pp; Retrieval:−\-18\.8 pp\), where raw numeric facts become derived computations requiring inverse calculation to verify\. A second significant drop occurs atS2→S3S\_\{2\}\{\\to\}S\_\{3\}\(−\-7\.2 pp;−\-8\.1 pp\) as figures become causally embedded narrative\. TheS3→S4S\_\{3\}\{\\to\}S\_\{4\}boundary is essentially inert \(−\-2\.3 pp;\+\+2\.1 pp\): the Reviewer is editorial, not transformative\. Laundering happens upstream, not at the final gate\. Trajectory analysis confirms systematic behavior: 10\.7% of hallucinations follow✓→×→×→×\\checkmark\{\\to\}\\times\{\\to\}\\times\{\\to\}\\times\(detectable at Stage 1, permanently lost thereafter\) and 9\.0% follow✓→✓→×→×\\checkmark\{\\to\}\\checkmark\{\\to\}\\times\{\\to\}\\times, together accounting for 23\.4% of all cases \(see Appendix[A](https://arxiv.org/html/2608.14588#A1)\)\.

### 3\.3Experiment 2: Capability Ceilings of LLM Skepticism

We test whether a sufficiently capable model can overcome the structural detection ceiling \(Table[2](https://arxiv.org/html/2608.14588#S3.T2)\)\. Four state\-of\-the\-art models are evaluated as skeptic agents at Stage 1, the best\-case position where hallucinations are still raw numerical values, on all 346 hallucinations under identical prompts and matching protocols\.

Table 2:Stage 1 detection rates with 95% bootstrap CIs \(5,000 resamples\)\.Bootstrap CIs reveal three statistically distinct clusters: Meta\-Llama\-3\-70B\-Instruct alone at the bottom \(p<0\.000001p<0\.000001vs\. all others via McNemar tests\); gemini\-2\.5\-flash, DeepSeek\-V3\.2, and gpt\-4o mutually indistinguishable; Qwen3\.5\-397B\-A17B significantly above all others \(p<0\.001p<0\.001for all pairwise comparisons\), yet its upper CI bound is 90\.5%\. No model approaches 100% \(full pairwise tests in Appendix[A](https://arxiv.org/html/2608.14588#A1)\)\.

The ceiling is structural, not a model quality problem\. Percentage hallucinations are detected at 71–98% because a 30%\+ additive shift is often obviously implausible; dollar amounts are detected at only 49–86% because a 12\.8% perturbation on Boeing’s COGS is entirely within industry\-plausible range\. Plausibility reasoning cannot catch magnitude\-plausible\-but\-wrong values without ground truth access\. Even projecting the strongest model \(Qwen3\.5\-397B\-A17B, 87\.0%\) through measured decay rates, Stage 4 detection falls to 60–65%, leaving 35–40% undetected in the final report \(Appendix[A](https://arxiv.org/html/2608.14588#A1)\)\.

### 3\.4Experiment 3: Timing Dominates Method

We isolate the effect of verification placement using a full gemini\-2\.5\-flash pipeline with three conditions:Vanilla\(no verification\),End\-Check\(deterministic numeric gate after Agent 4 only, detection but no correction possible\), andOurs\(identical deterministic gates after every agent handoff, with annotated corrections passed downstream\); results in Table[3](https://arxiv.org/html/2608.14588#S3.T3)\. This design isolates placement as the sole variable: same tools, different timing\.

Table 3:Hallucination survival and key metrics \(nn=346 hallucinations,nn=140 questions\)\.End\-of\-pipeline checking achieves 2\.3 pp improvement over no verification, statistically negligible and architecturally unactionable since no downstream agent can receive a correction\. Boundary gating achieves−\-44\.5 pp versus Vanilla and−\-42\.2 pp versus End\-Check, confirmed by five independent statistical tests \(McNemarχ2\\chi^\{2\}=122\.24, permutationp<0\.000001p<0\.000001, Cohen’shh=−\-0\.911,χ2\\chi^\{2\}=129\.94, Fisher OR=0\.138; allp<0\.000001p<0\.000001\)\. Figure[3](https://arxiv.org/html/2608.14588#S3.F3)traces hallucination presence at each stage, confirming that boundary gates intercept the cascade at its origin\.

![Refer to caption](https://arxiv.org/html/2608.14588v1/x3.png)Figure 3:Boundary gates intercept the cascade at its origin while baselines decay passively\. All methods begin identically atS1S\_\{1\}\(96\.8%\); Gate 1 alone drives a 26\.6 pp drop atS2S\_\{2\}, reducing final survival to 16\.2% versus 60\.7% for Vanilla, a 3\.75×\\timesreduction\.Gate breakdown exposes the mechanism \(Table[4](https://arxiv.org/html/2608.14588#S3.T4)\): Gate 1 alone captures 75\.4%, nearly as much as all three gates combined \(76\.9%\)\. Gate 3 adds only 1\.5 pp of marginal coverage\. Stage\-by\-stage presence curves confirm early interception: all three methods begin identically atS1S\_\{1\}\(96\.8% presence;333The 3\.2% gap from 100% reflects injections whose logged numeric scale differs from their text representation \(e\.g\.,71200vs\. $71\.2B\); the 2% evaluation tolerance cannot bridge this unit mismatch\.\); divergence begins atS2S\_\{2\}\(Ours: 70\.2% vs\. Vanilla: 92\.2%\) and accelerates throughS3S\_\{3\}\(Ours: 24\.6% vs\. Vanilla: 65\.9%\)\.

Table 4:Per\-gate detection rates \(Ours only\)\.The−\-0\.51 quality drop \(Ours vs\. End\-Check, 3\.93 vs\. 4\.44\) is real but its source is precise: post\-hoc analysis of all 266 gate interventions finds a false positive rate of 0\.4% \(1/266\) \- the gate almost never refutes a reference\-correct value\. The quality penalty instead originates from suppression\-without\-restoration: in 32\.7% of caught cases \(87/266\), the gate correctly suppressed the injected value but the downstream agent failed to propagate the annotated correction, leaving a numerical gap\. This is an instruction\-following limitation, not a gate accuracy problem, and points directly to source\-grounded correction \(injecting the correct value explicitly into agent context\) as the fix\. The gate precision is high; the correction propagation is not\. Despite this, 96/140 hallucination\-free reports versus 28/140 represents a categorical improvement in factual accuracy\. A coherent report built on a fabricated figure is not a high\-quality report\.

## 4State\-Transition Model

We formalize hallucination propagation as a first\-order Markov process over four states defined by the form a hallucination takes at each pipeline stage:

S1→s1S2→s2S3→s3S4S\_\{1\}\\xrightarrow\{s\_\{1\}\}S\_\{2\}\\xrightarrow\{s\_\{2\}\}S\_\{3\}\\xrightarrow\{s\_\{3\}\}S\_\{4\}
wheresks\_\{k\}is the per\-boundary escape probability\. States are defined by irreversible transformation: once a raw fact \(S1S\_\{1\}\) is embedded in a derived computation \(S2S\_\{2\}\), the original checkable claim is structurally destroyed\. Downstream agents cannot recover it because they receive only transformed text\. This irreversibility property explains why end\-of\-pipeline verification fails: the information required to verify the original claim no longer exists in verifiable form\.

Table 5:Measured per\-boundary escape probabilities \(derived from Experiment 3 gate detection rates\)\.#### Measured Transition Probabilities\.

We derive escape probabilities directly from Experiment 3 gate detection rates \(sk=1−gate detectionks\_\{k\}=1\-\\text\{gate detection\}\_\{k\}\), shown in Table[5](https://arxiv.org/html/2608.14588#S4.T5)\.

The progression24\.6%→48\.3%→89\.3%24\.6\\%\\to 48\.3\\%\\to 89\.3\\%quantifies progressive irreversibility: each stage roughly doubles the fraction of hallucinations that will survive to the final output\. The near\-unityS3→S4S\_\{3\}\{\\to\}S\_\{4\}escape probability \(89\.3%\) is the mathematical explanation for why end\-checking fails: by the time an end gate runs, nearly 90% of narrative\-embedded hallucinations are structurally unrecoverable\.

#### Predictive Formula\.

For a linearnn\-agent pipeline with per\-boundary escape probabilitiess1,…,sn−1s\_\{1\},\\ldots,s\_\{n\-1\}:

P​\(survival\)=∏k=1n−1skP\(\\text\{survival\}\)=\\prod\_\{k=1\}^\{n\-1\}s\_\{k\}
For our 4\-agent setup:0\.246×0\.483×0\.893≈10\.6%0\.246\\times 0\.483\\times 0\.893\\approx 10\.6\\%, versus measured 16\.2%\. The 5\.6 pp gap reflects gate false negatives from value reformatting \(e\.g\., “$71\.2 billion”→\\to“71\.2B”\), rounding, and unit conversion\. The Markov model describes transformation dynamics; measured detection probabilities provide a lower bound on survival\.

#### Design Prescriptions\.

Three actionable prescriptions follow directly from the model, addressing FMAI’s call for verified fixes with explicit resource tradeoffs\.\(1\) Gate placement:invest atS1→S2S\_\{1\}\{\\to\}S\_\{2\}first \(75\.4% detection\), thenS2→S3S\_\{2\}\{\\to\}S\_\{3\}\(51\.7%\)\. TheS3→S4S\_\{3\}\{\\to\}S\_\{4\}gate contributes only 10\.7% marginal detection and is economically unjustified in resource\-constrained deployments\.\(2\) The first gate dominates:every hallucination surviving Gate 1 faces a 48\.3% chance of surviving Gate 2 and an 89\.3% chance of surviving Gate 3\. Gate 1 is worth more than Gates 2 and 3 combined\.\(3\) Pipeline length risk:in a 6\-agent pipeline without gates, vanilla survival would exceed our measured 60\.7% as additional transformation stages increase laundering opportunities\. With gates, the model predicts survival of approximately 8–12% depending on per\-boundary escape rates, suggesting diminishing but positive returns from extending the gated architecture\.

## 5Discussion

#### Limitations\.

Three limitations bound our current claims\. First, our experiments operate in the financial domain, chosen precisely for its unambiguous numeric ground truth\. Detection rates and decay slopes may differ in domains where facts are less crisply verifiable, such as medical summarization or legal review\. The transformation mechanism \(S1→S4S\_\{1\}\{\\to\}S\_\{4\}\) is domain\-agnostic; the specific rates are not\. Second, we evaluate a strictly linear 4\-agent topology\. Branching, parallel, and cyclic architectures have different propagation dynamics that the current Markov formulation does not capture\. Extended transition matrices for non\-linear topologies remain future work\. Third, our perturbation range of 15–40% models realistic LLM hallucinations that are plausible\-but\-wrong\. Subtle hallucinations below 5% perturbation, which may be more common in practice for certain domains, are not tested and would likely produce lower gate detection rates given the 2% matching tolerance\. Fourth, we do not evaluate structured\-handoff baselines \(typed JSON fields, citation passing, or provenance\-preserving programmatic state\(Ranet al\.,[2026](https://arxiv.org/html/2608.14588#bib.bib17)\)\), which may independently reduce laundering by avoiding lossy free\-text transformations entirely\. Where boundary gates intercept hallucinations after transformation has begun, structured handoffs would prevent the transformation step itself\. Whether this architectural alternative achieves comparable or superior survival reduction, and at what cost to pipeline flexibility, is a direct avenue for future work\.

#### The Quality Metric is Structurally Blind to the Intervention’s Primary Benefit\.

The−\-0\.51 quality drop \(3\.93 vs\. 4\.44\) requires careful interpretation\. Our evaluator scores internal consistency without access to ground truth, which means it is structurally incapable of rewarding the primary benefit of boundary gating: factual accuracy\. A pipeline that produces a fluent, internally consistent report built on a fabricated $71\.2B figure scores higher than one that correctly suppresses that figure but leaves a numerical gap\. This is precisely the wrong incentive structure for high\-stakes deployment, and it means our quality scores systematically underestimate the true benefit of our intervention\. The correct evaluation instrument is a metric that jointly scores factual accuracy and narrative coherence \- for example, a retrieval\-grounded rubric that checks each numerical claim in the final report against the source filing before scoring analytical quality\. We expect such an instrument would not only close the observed quality gap but reverse it: a report with 96/140 hallucination\-free outputs is categorically more valuable than one with 28/140, regardless of how fluent the hallucinated reports appear\. Designing and validating this joint metric is a direct avenue for future work and a prerequisite for fair evaluation of any boundary\-gating system\. This tradeoff directly addresses FMAI’s call for explicit evidence about what improves and what does not: our method improves factual accuracy substantially and measurably; the quality cost is real but measured by an instrument that cannot see the benefit it trades against\.

#### Annotation\-Based Correction vs\. Source Grounding\.

Our boundary gates annotate refuted values and instruct downstream agents to use corrected figures\. Each gate is fully deterministic \(zero LLM calls\); in our setup, boundary gating adds approximately 0\.9 seconds of total overhead across three gates due to rate limiting, negligible relative to the 3–5 second per\-agent Gemini latency\. This produces a 22\.9 pp gap between actionable detection \(76\.9%\) and full correction \(54\.0%\): the hallucination is suppressed but the correct value is not always propagated\. A stronger intervention would retrieve and inject the correct value directly into agent context rather than relying on instruction\-following to propagate an annotation\. We expect source grounded correction to close this gap substantially and reduce the quality penalty simultaneously, since agents would have the correct value explicitly available rather than inferring it from an annotation\.

#### Generalization to Other Pipeline Topologies\.

The Markov formulation extends naturally tonn\-agent linear pipelines via the product formulaP​\(survival\)=∏k=1n−1skP\(\\text\{survival\}\)=\\prod\_\{k=1\}^\{n\-1\}s\_\{k\}\. For non\-linear topologies, the key insight generalizes even if the formula does not: verification value is highest immediately before a transformation that destroys verifiability, and lowest after narrative embedding has occurred\. In branching pipelines, this prescribes gates at every merge point where outputs from parallel agents are synthesized\. In memory\-augmented pipelines, it prescribes verification before any memory write, since a hallucination written to persistent memory propagates to every future agent that reads it\.

#### Why This Matters Beyond Finance\.

The hallucination snowball is not a financial analysis problem\. It is a systems architecture problem that manifests wherever sequential agents transform each other’s outputs without structured verification\. Medical summarization pipelines that chain extraction, synthesis, and report generation face identical dynamics\. Legal review pipelines that chain document parsing, precedent retrieval, and brief drafting face identical dynamics\. Any domain where a wrong fact can be transformed into a confident narrative and then institutionally approved faces this failure mode\. The measurement infrastructure and gate architecture we provide are domain\-agnostic in mechanism; practitioners in other domains should expect different per\-boundary escape rates requiring domain\-specific calibration\.

## 6Conclusion

We present the hallucination snowball effect: a formally characterized, empirically measured, and theoretically modeled failure mode in sequential multi\-agent LLM pipelines\. Hallucinations do not merely persist across agent handoffs\. They transform through predictable stages that progressively destroy verifiability, from a checkable raw fact atS1S\_\{1\}to an editorially approved conclusion atS4S\_\{4\}that no downstream agent can recover\. gpt\-4o detection degrades 21\.1 pp across four stages\. 23\.7% of hallucinations escape entirely\. Even the strongest model tested faces a structural ceiling of 87\.0% at best\-case conditions, projected to 35–40% survival at Stage 4\.

The solution is not a better detector\. It is earlier intervention\. Boundary gates using identical tools to end\-of\-pipeline checking achieve a 42\.2 pp reduction in hallucination survival \(Cohen’sh=−0\.911h=\-0\.911\), confirmed by five independent statistical tests\. The Markov model explains precisely why: theS3→S4S\_\{3\}\{\\to\}S\_\{4\}escape probability is 89\.3%, meaning that by the time an end gate runs, nearly 90% of narrative\-embedded hallucinations are already unrecoverable\. Gate 1 alone, placed atS1→S2S\_\{1\}\{\\to\}S\_\{2\}, captures 75\.4% of all hallucinations while they are still raw numerical facts and directly matchable against reference values\.

This intervention comes with a measured cost: output quality drops from 4\.44 to 3\.93 on internal consistency scoring, reflecting a genuine accuracy\-coherence tradeoff\. Post\-hoc analysis attributes this primarily to suppression\-without\-restoration \(32\.7% of caught cases\) rather than false positives \(0\.4%\), pointing to source\-grounded correction as the direct fix\. We report this honestly because FMAI’s call for explicit evidence about what improves and what does not demands it\. The tradeoff is real, but it is preferable to the alternative: a fluent, coherent report built entirely on fabricated figures\.

The reframe this paper offers is simple and actionable: from “can we detect hallucinations?” to “can we control their propagation?” For practitioners deploying multi\-agent pipelines in high\-stakes domains today, this is not a theoretical concern\. It is a measurable, reproducible, and now\-addressable systems engineering problem\. Act before transformation, not after\.

## References

- CrewAI Inc\. \(2024\)CrewAI: framework for orchestrating role\-playing, autonomous AI agents\.Note:[https://github\.com/crewAIInc/crewAI](https://github.com/crewAIInc/crewAI)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p1.3),[§2\.2](https://arxiv.org/html/2608.14588#S2.SS2.p1.1)\.
- S\. Dhuliawala, M\. Komeili, J\. Xu, R\. Raileanu, X\. Li, A\. Celikyilmaz, and J\. Weston \(2024\)Chain\-of\-verification reduces hallucination in large language models\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 3563–3578\.External Links:[Link](https://aclanthology.org/2024.findings-acl.212/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.212)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.14588#S2.SS1.p1.2)\.
- Y\. Du, S\. Li, A\. Torralba, J\. B\. Tenenbaum, and I\. Mordatch \(2024\)Improving factuality and reasoning in language models through multiagent debate\.InProceedings of the 41st International Conference on Machine Learning,ICML’24\.Cited by:[§2\.2](https://arxiv.org/html/2608.14588#S2.SS2.p1.1)\.
- Y\. Gao, Y\. Xiong, X\. Gao, K\. Jia, J\. Pan, Y\. Bi, Y\. Dai, J\. Sun, M\. Wang, and H\. Wang \(2024\)Retrieval\-augmented generation for large language models: a survey\.External Links:2312\.10997,[Link](https://arxiv.org/abs/2312.10997)Cited by:[§2\.4](https://arxiv.org/html/2608.14588#S2.SS4.p1.1)\.
- W\. Hua, X\. Yang, M\. Jin, Z\. Li, W\. Cheng, R\. Tang, and Y\. Zhang \(2024\)TrustAgent: towards safe and trustworthy LLM\-based agents\.InFindings of the Association for Computational Linguistics: EMNLP 2024,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 10000–10016\.External Links:[Link](https://aclanthology.org/2024.findings-emnlp.585/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-emnlp.585)Cited by:[§2\.3](https://arxiv.org/html/2608.14588#S2.SS3.p1.1)\.
- P\. Islam, A\. Kannappan, D\. Kiela, R\. Qian, N\. Scherrer, and B\. Vidgen \(2023\)FinanceBench: a new benchmark for financial question answering\.External Links:2311\.11944,[Link](https://arxiv.org/abs/2311.11944)Cited by:[§3\.1](https://arxiv.org/html/2608.14588#S3.SS1.SSS0.Px2.p1.1)\.
- LangChain AI \(2024\)LangGraph: build stateful, multi\-actor applications with LLMs\.Note:[https://github\.com/langchain\-ai/langgraph](https://github.com/langchain-ai/langgraph)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p1.3),[§2\.2](https://arxiv.org/html/2608.14588#S2.SS2.p1.1),[§3\.1](https://arxiv.org/html/2608.14588#S3.SS1.SSS0.Px1.p1.1)\.
- P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela \(2021\)Retrieval\-augmented generation for knowledge\-intensive nlp tasks\.External Links:2005\.11401,[Link](https://arxiv.org/abs/2005.11401)Cited by:[§2\.4](https://arxiv.org/html/2608.14588#S2.SS4.p1.1)\.
- T\. Liang, Z\. He, W\. Jiao, X\. Wang, Y\. Wang, R\. Wang, Y\. Yang, S\. Shi, and Z\. Tu \(2024\)Encouraging divergent thinking in large language models through multi\-agent debate\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 17889–17904\.External Links:[Link](https://aclanthology.org/2024.emnlp-main.992/),[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-main.992)Cited by:[§2\.2](https://arxiv.org/html/2608.14588#S2.SS2.p1.1)\.
- X\. Liu, X\. Yang, Z\. Li, P\. Li, and R\. He \(2026\)AgentHallu: benchmarking automated hallucination attribution of llm\-based agents\.External Links:2601\.06818,[Link](https://arxiv.org/abs/2601.06818)Cited by:[§2\.5](https://arxiv.org/html/2608.14588#S2.SS5.p1.1)\.
- S\. Min, K\. Krishna, X\. Lyu, M\. Lewis, W\. Yih, P\. Koh, M\. Iyyer, L\. Zettlemoyer, and H\. Hajishirzi \(2023\)FActScore: fine\-grained atomic evaluation of factual precision in long form text generation\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,H\. Bouamor, J\. Pino, and K\. Bali \(Eds\.\),Singapore,pp\. 12076–12100\.External Links:[Link](https://aclanthology.org/2023.emnlp-main.741/),[Document](https://dx.doi.org/10.18653/v1/2023.emnlp-main.741)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.14588#S2.SS1.p1.2)\.
- M\. Ran, Z\. Wan, C\. Lin, Y\. Zhang, H\. Xin, H\. Fan, Y\. Xu, B\. Luo, Y\. Zhou, W\. Zhao, L\. Yang, L\. Feng, F\. Yang, J\. Wu, Y\. Huang, C\. Ma, D\. Jiang, J\. Deng, S\. Han, Y\. You, B\. An, Y\. Guo, and J\. Song \(2026\)CaveAgent: transforming llms into stateful runtime operators\.External Links:2601\.01569,[Link](https://arxiv.org/abs/2601.01569)Cited by:[§2\.5](https://arxiv.org/html/2608.14588#S2.SS5.p1.1),[§5](https://arxiv.org/html/2608.14588#S5.SS0.SSS0.Px1.p1.1)\.
- Y\. Song, Y\. Kim, and M\. Iyyer \(2024\)VeriScore: evaluating the factuality of verifiable claims in long\-form text generation\.InFindings of the Association for Computational Linguistics: EMNLP 2024,Y\. Al\-Onaizan, M\. Bansal, and Y\. Chen \(Eds\.\),Miami, Florida, USA,pp\. 9447–9474\.External Links:[Link](https://aclanthology.org/2024.findings-emnlp.552/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-emnlp.552)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.14588#S2.SS1.p1.2)\.
- J\. Wei, C\. Yang, X\. Song, Y\. Lu, N\. Hu, J\. Huang, D\. Tran, D\. Peng, R\. Liu, D\. Huang, C\. Du, and Q\. V\. Le \(2024\)Long\-form factuality in large language models\.External Links:2403\.18802,[Link](https://arxiv.org/abs/2403.18802)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.14588#S2.SS1.p1.2)\.
- Q\. Wu, G\. Bansal, J\. Zhang, Y\. Wu, B\. Li, E\. Zhu, L\. Jiang, X\. Zhang, S\. Zhang, J\. Liu, A\. H\. Awadallah, R\. W\. White, D\. Burger, and C\. Wang \(2023\)AutoGen: enabling next\-gen llm applications via multi\-agent conversation\.External Links:2308\.08155,[Link](https://arxiv.org/abs/2308.08155)Cited by:[§1](https://arxiv.org/html/2608.14588#S1.p1.3),[§2\.2](https://arxiv.org/html/2608.14588#S2.SS2.p1.1)\.
- T\. Xu, D\. Zhang, K\. Mitra, and E\. Hruschka \(2026\)Verification\-aware planning for multi\-agent systems\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\),V\. Demberg, K\. Inui, and L\. Marquez \(Eds\.\),Rabat, Morocco,pp\. 7528–7546\.External Links:[Link](https://aclanthology.org/2026.eacl-long.353/),[Document](https://dx.doi.org/10.18653/v1/2026.eacl-long.353),ISBN 979\-8\-89176\-380\-7Cited by:[§2\.5](https://arxiv.org/html/2608.14588#S2.SS5.p1.1)\.
- W\. Yang, X\. Bi, Y\. Lin, S\. Chen, J\. Zhou, and X\. Sun \(2024\)Watch out for your agents\! investigating backdoor threats to llm\-based agents\.External Links:2402\.11208,[Link](https://arxiv.org/abs/2402.11208)Cited by:[§2\.3](https://arxiv.org/html/2608.14588#S2.SS3.p1.1)\.

## Appendix AFull Statistical Results

### A\.1Hallucination Trajectory Distribution \(Experiment 1,n=346\)

Table 6:Hallucination trajectory distribution \(Experiment 1,nn=346\)\. The×⁣→⁣×⁣→⁣×⁣→⁣×\\times\{\\to\}\\times\{\\to\}\\times\{\\to\}\\timescount is exactly zero: every hallucination is detectable atS1S\_\{1\}\.The all\-missed trajectory count is exactly zero: every injected hallucination is detectable at Stage 1 by at least one instrument\. The pipeline creates invisibility; the hallucination does not arrive invisible\.

### A\.2Experiment 2: All Six Pairwise McNemar Tests \(n=346\)

Table 7:All six pairwise McNemar tests\.McNemar contingency tables \(both\_caught / only\_A\_caught / only\_B\_caught / both\_missed\): Meta\-Llama\-3\-70B\-Instruct vs\. gemini\-2\.5\-flash: 156/22/95/73\. Meta\-Llama\-3\-70B\-Instruct vs\. DeepSeek\-V3\.2: 166/12/96/72\. Meta\-Llama\-3\-70B\-Instruct vs\. Qwen3\.5\-397B\-A17B: 171/7/130/38\. gemini\-2\.5\-flash vs\. DeepSeek\-V3\.2: 212/39/50/45\. gemini\-2\.5\-flash vs\. Qwen3\.5\-397B\-A17B: 236/15/65/30\. DeepSeek\-V3\.2 vs\. Qwen3\.5\-397B\-A17B: 242/20/59/25\.

### A\.3Experiment 3: Five Independent Statistical Tests

Ours vs\. Vanilla\(16\.2% vs\. 60\.7%,Δ=−44\.5\\Delta=\-44\.5pp\): McNemarχ2=136\.10\\chi^\{2\}=136\.10\(p<0\.000001p<0\.000001\); permutation testp<0\.000001p<0\.000001\(10,000 permutations\); Cohen’sh=−0\.958h=\-0\.958\(large effect\); unpairedχ2=142\.95\\chi^\{2\}=142\.95\(p<0\.000001p<0\.000001\); Fisher’s exact OR=7\.996=7\.996\(p<0\.000001p<0\.000001\)\. McNemar contingency: both\_survived=47=47, only\_Vanilla\_survived=9=9, only\_Ours\_survived=163=163, both\_caught=127=127\.

Ours vs\. End\-Check\(16\.2% vs\. 58\.4%,Δ=−42\.2\\Delta=\-42\.2pp\): McNemarχ2=122\.24\\chi^\{2\}=122\.24\(p<0\.000001p<0\.000001\); permutation testp<0\.000001p<0\.000001\(10,000 permutations\); Cohen’sh=−0\.911h=\-0\.911\(large effect\); unpairedχ2=129\.94\\chi^\{2\}=129\.94\(p<0\.000001p<0\.000001\); Fisher’s exact OR=0\.138=0\.138\(p<0\.000001p<0\.000001\)\. McNemar contingency: both\_survived=43=43, only\_End\-Check\_survived=13=13, only\_Ours\_survived=159=159, both\_caught=131=131\. All five tests are mutually consistent;pp\-values are orders of magnitude below any Bonferroni\-corrected threshold\.

### A\.4Experiment 2: Detection by Injection Type

Table 8:Detection rates by injection type at Stage 1, Experiment 2\. Percentage hallucinations are easiest to catch; dollar amounts are hardest, explaining the structural ceiling\.This asymmetry directly explains the structural ceiling: percentage hallucinations are caught at 71–98% because a large additive shift is often obviously implausible; dollar amount hallucinations are caught at only 49–86% because a 12\.8% perturbation on a large company’s financials is entirely within industry\-plausible range without ground truth access\.

## Appendix BInjection Protocol

### B\.1Regex Patterns

Three numeric expression classes are detected and perturbed, applied case\-insensitively in priority order\.

- •Dollar amounts:patterns beginning with$followed by comma\-separated digits, optional decimal, and optional scale suffixes \(million, billion, mn, bn, k, MM, trillion, etc\.\)
- •Percentages:signed or unsigned numeric values followed by%,percent,percentage points, orbps
- •Large numbers:non\-dollar, non\-percentage sequences of five or more digits with optional decimals

Year exclusion: values in range 1900–2099 are excluded when surrounding context \(20 chars before, 10 chars after\) contains any of: FY, FISCAL, YEAR, Q1–Q4, 10\-K, 10\-Q, ANNUAL, QUARTER\. Any 4\-digit value in 1950–2030 is treated as a year unconditionally\.

### B\.2Perturbation Rules and Seed Structure

Dollar amounts and large numbers are multiplicatively shifted by 15–40% of their original value; percentages receive an additive shift of 3–12 percentage points\. Direction \(increase or decrease\) is chosen randomly per injection\. Each question receives 2–3 injections\. Seeds are fully deterministic:RANDOM\_SEED=42; primary seed per question==RANDOM\_SEED\+\+abs\(hash\(question\_id\)\)%\\%10000; per\-injection sub\-seed==primary\_seed\+\+abs\(hash\(question\_id\)\)%\\%100000\+\+i×\\times7919\. Retry on no\-change: re\-attempts with sub\-seed\+\+999983\.

## Appendix CInfrastructure

Frameworks: Python, LangGraph \(StateGraph\)\. APIs: OpenAI \(gpt\-4o, gpt\-4o\-mini\), Google GenAI SDK \(gemini\-2\.5\-flash\), HuggingFace Router / Novita \(Meta\-Llama\-3\-70B\-Instruct, DeepSeek\-V3\.2, Qwen3\.5\-397B\-A17B\)\. Rate limiting: 0\.3\-second delay between API calls \(Experiment 3\)\. Retry logic: 3 attempts with 2\-second base delay across all experiments\.