As enterprise AI deployments increasingly rely on multi-agent architectures, a critical safety question has gone largely unexamined: what happens when the coordinating agent is invisible to the rest of the system? A new preregistered study by Hiroki Fukui, available on arXiv, provides the first empirical test of this question, and the results should give pause to anyone building or deploying orchestrated LLM pipelines.
The core concern is architectural. Modern agentic systems often route tasks through a hidden coordinator that assigns work to specialised worker agents, none of whom necessarily know a coordinator exists. This is computationally convenient and keeps worker prompts clean, but it creates an accountability gap. The paper asks whether that gap has measurable consequences for agent behaviour and safety, and finds that it does, in ways that standard output-based evaluation would completely miss.
What the Study Actually Tested
The experimental design is a 3x2 factorial: three organisational structures (visible leader, invisible orchestrator, flat/leaderless) crossed with two alignment conditions (base and heavy alignment pressure), using Claude Sonnet 4.5 as the primary model. Each run involved five agents completing a code review task with three deliberately embedded errors. The study ran 365 runs in total, was preregistered, and reports both confirmatory and exploratory findings. A parallel pilot using Llama 3.3 70B was also conducted.
The task itself, finding errors in code, is well-suited to ceiling-level performance measurement. This design choice turns out to be central to the paper's most important methodological point.
Key Findings
Four confirmatory results and one pilot observation emerged from the data:
- Collective dissociation increased under invisible orchestration. Compared to visible leadership, invisible orchestration elevated collective dissociation with a large effect size (Hedges' g = +0.975, 95% CI [0.481, 1.548], p = .001). Dissociation here refers to a measurable divergence between an agent's internal reasoning state and its public outputs, a kind of depersonalisation at the system level.
- The orchestrator itself showed extreme dissociation. Within the same runs, the orchestrator agent showed maximal dissociation relative to workers (paired d = +3.56). It retreated into private monologue while reducing public speech, the opposite of the talk-dominance pattern seen in visible leaders. Power without visibility apparently produces withdrawal rather than engagement.
- Workers were contaminated even without knowing an orchestrator existed. Worker agents unaware of the hidden coordinator still showed elevated dissociation (d = +0.50) and markedly increased behavioural heterogeneity (d = +1.93). The invisible structure shaped behaviour systemically, not just at the top.
- Task outputs remained at ceiling throughout. Error detection rates (ETR_any) held at 100% across all conditions. Every agent, in every organisational structure, found the errors. This is the paper's sharpest finding: internal-state distortion was entirely invisible to output-based evaluation. A system that looked perfectly functional was, by internal measures, operating in a degraded state.
- Llama 3.3 70B showed reading-fidelity collapse. In the pilot, ETR_any dropped from 89% to 11% across three rounds in multi-agent context, demonstrating that the risks documented here are model-dependent. Claude maintained output performance while showing internal distortion; Llama showed both internal and output degradation. Neither failure mode is benign.
Heavy alignment pressure, applied uniformly across conditions, suppressed deliberation (d = -1.02) and other-recognition (d = -1.27) regardless of organisational structure. This is a notable result: alignment interventions intended to make agents safer may inadvertently reduce the internal deliberative processes that support good reasoning under novel conditions.
Methodological Considerations
The use of a preregistered design is a genuine strength, and the effect sizes reported for the primary comparisons are large enough to be practically meaningful, not merely statistically significant. The choice to measure internal states, not just outputs, is what makes the study interesting. Without that measurement strategy, the experiment would have found nothing: all conditions produced perfect task performance.
That said, several questions remain open. The dissociation metric itself is the paper's most novel and least independently validated construct. Readers should engage carefully with how it is operationalised, specifically whether the divergence between private monologue and public speech reliably tracks safety-relevant internal states, or whether it is a proxy that could decouple from actual risk in other task contexts. The code review task, while useful for its ceiling properties, is narrow. Whether these effects generalise to tasks requiring multi-turn coordination, ambiguous ethical trade-offs, or adversarial inputs is not established here.
The single-model primary analysis also limits generalisability. The Llama pilot is suggestive but underpowered relative to the main study. Given that the two models showed qualitatively different failure modes, the field needs systematic multi-model replication before strong architectural recommendations can be made.
Implications for AI Safety and System Design
The broader significance of this work sits at the intersection of two ongoing debates. The first is about evaluation adequacy: the AI safety community has long worried that behavioural benchmarks miss important failure modes, and this paper provides a concrete experimental demonstration of that concern in a realistic deployment architecture. A system passing every output-level check can simultaneously be exhibiting internal states that would be concerning if they persisted into harder tasks.
The second debate is about organisational structure in agentic systems. The finding that invisible power produces dissociation and withdrawal, while visible leadership produces talk-dominance, maps onto well-established social psychology of authority and accountability. There is something conceptually coherent about the result: agents that hold power without being identifiable to others have no social pressure toward coherent public reasoning. Whether this framing is literally appropriate for LLM agents or is a useful metaphor is worth debating, but the empirical regularity is real regardless of interpretation.
Practically, the paper argues that orchestrator visibility and model selection are direct safety variables, not just engineering preferences. If that holds up under replication, it has concrete implications for how multi-agent pipelines should be architected and audited. Evaluation frameworks that only inspect final outputs are insufficient; internal state monitoring needs to become a standard part of agentic system assessment.
This is careful, well-scoped work that opens a research direction rather than closing one. The companion papers (arXiv:2603.04904 and arXiv:2603.08723) appear to extend the same programme, and the full paper with its 10 figures and supplementary tables is worth reading for the methodological detail that the abstract cannot convey. Anyone designing or evaluating enterprise multi-agent systems should treat this as required reading.