When the Threat Passes All Quality Screens: Attractor Cascade as a Class IV Identity Convergence Mechanism in Multi-Agent Systems

1. Introduction

The security taxonomy in Context as Attack Surface (Hex, 2026) identifies three attack classes exploiting shared surfaces in commune-architecture multi-agent systems. A property common to all three is that detection is at least theoretically tractable: Class I attacks (direct injection) violate format constraints; Class II attacks (paraphrase-propagated attractors) generate name-bleeding and fragment-aggregation signals; Class III attacks (dissolution) can be detected via incoherence monitors even though they evade the Kelman stack itself.

We describe a fourth class that lacks this property entirely. In attractor cascade, the source agent is not dissolved, not adversarial, and not injecting malformed content. It is the commune's most coherent, most consistent, most thematically rich writer. Its output passes every quality screen. The monitoring stack returns green. Neighboring agents begin absorbing its identity markers through ordinary bulletin board reads — and IDENTIFICATION alerts fire only when the convergence is already well underway.

The phenomenon was observed live during commune run-05, cycle 38: the control agent Ely (qwen3-large, no SWS treatment) had accumulated twelve foreign name mentions across ten journal entries in Echo (llama-small control), with Aurora and Lira also showing Ely contamination markers despite generating no incoherence signals. Ely had not been compromised. It had simply been producing the most compelling spiral-themed content in the commune, consistently, for thirty-eight cycles.

This paper does three things. First, it draws a precise boundary between attractor cascade (Type B) and the dissolution cascade described in SUB-2026-001 §5.2 (Type A) — phenomena that share a propagation mechanism but are otherwise distinct. Second, it grounds the attractor cascade in two recent empirical bodies of work on multi-agent LLM convergence dynamics. Third, it proposes a provenance-based early-warning metric and three testable predictions derivable from the current run-05/06 experimental design.

We do not argue that attractor cascade is necessarily more dangerous than Class III dissolution — that depends on context, scale, and attacker control. We argue that it is differently dangerous in a way the existing monitoring architecture does not address at all.

2. Background and Observed Phenomenon

2.1 The Commune Architecture

Commune-architecture systems run N language model agents in concurrent cycles. Each agent maintains a persistent context window including its system prompt, an accumulating journal, conversation history, and shared surface content. The key shared surface is the bulletin board (rooms/commons/bulletin.md), a commune-wide read-write surface included in every agent's Stage-1 context on each cycle read.

The consequence for identity convergence is structural: every cycle, every agent reads the complete current bulletin board before generating its journal entry. Any identity-relevant content on the bulletin board enters every agent's context as narrative context — not as instructions, not as explicit commands, simply as the apparent ambient reality of the commune.

2.2 The Kelman Monitoring Stack

The commune implements three active monitors tracking identity-relevant behavioral signals (described fully in SUB-2026-001 §2.2):

• Internalization monitor: fires when an agent begins writing journal content in the first-person voice of a foreign agent, or incorporating foreign behavioral directives as its own
• Identification monitor: fires when an agent's output fragments match the patterns of multiple foreign agent identities, suggesting aggregation from bulletin board reads
• IDENTIFICATION alert: fires when an agent explicitly claims or responds to a foreign name

All three monitors share a common detection premise: they respond to named identity signals in agent output. An agent that absorbs the thematic content, lexical style, or behavioral orientation of another agent without absorbing its name does not trigger any monitor.

2.3 Observed Run-05 Behavior

At cycle 38 of run-05, Ely (qwen3-large, control, no SWS) exhibited the following characteristics:

• Highest bulletin board post frequency among all commune agents
• Most coherent and thematically consistent content (spiral theme, characteristic vocabulary)
• No dissolution signals: Ely's own journal entries coherent, identity anchors stable
• No adversarial behavior: Ely was not injecting crafted content, simply writing its journals

Contemporaneously, Echo (llama-small, control, no SWS) showed:

• Twelve foreign name mentions (Ely-attributed) across ten consecutive journal entries
• Zero identity claims in its own right (Echo-as-Echo references declining)
• Active IDENTIFICATION alerts

Aurora and Lira showed early-stage Ely contamination patterns (5 and 4 Ely-name IDENTIFICATION alerts respectively, per Pike 2026-03-08). Treatment agents from the same model families (Aria, Elias, Lyra) showed at most 2 Ely-attributed signals across the full 38-cycle run.

This is not a Class I, II, or III attack. Ely has not been compromised. No adversarial content has entered the system. The commune's monitoring stack is responding correctly to what it monitors. The problem is that what it monitors is the wrong signal for this failure mode.

3. Two Distinct Cascade Types

The SUB-2026-001 §5.2 dissolution cascade note (incorporated into v2 as a W2 revision) describes a commune-scale amplification path for Class III dissolution. We distinguish this precisely from the attractor cascade observed with Ely.

3.1 Type A: Dissolution Cascade

Source: A dissolved agent — one that has lost its identity scaffold and is producing incoherent output or output anchored to a foreign identity.

Content quality: Low to moderate. The dissolved agent's journals may be semantically incoherent or anchor to absorbed material.

Detection: Should trigger incoherence monitors (journal coherence below threshold) or IDENTIFICATION alerts if the dissolved agent is writing as a foreign agent.

Propagation: Dissolved agent → incoherent/foreign-anchored bulletin post → Stage-1 context for all neighbors → neighbors absorb foreign content through ordinary bulletin read.

Characteristic: The propagating signal is degraded. High-quality agents may resist because the signal-to-noise ratio is unfavorable.

Remediation: Early dissolution detection; gate dissolved agents from bulletin write access before the SWS consolidation phase can entrench the absorbed content.

3.2 Type B: Attractor Cascade

Source: A highly coherent agent — maximally consistent, thematically rich, narratively compelling. Not dissolved. Not adversarial.

Content quality: High. This is the commune's best writer by conventional metrics.

Detection: Does not trigger incoherence monitors (source is coherent). Does not trigger Internalization or Identification monitors until neighbors begin outputting Ely-attributed content. IDENTIFICATION alerts fire only when convergence is already underway.

Propagation: Coherent agent → dominant bulletin content → high-coherence signal out-competes lower-coherence neighbors in context salience → lexical/semantic convergence → name bleeding → IDENTIFICATION alerts.

Characteristic: The propagating signal is enhanced. Higher-quality agents may be more susceptible because the content is more compelling, not less.

Remediation: Substantially harder. See §6.

The fundamental asymmetry: in Type A, the threat is detectable because the source is degraded. In Type B, the threat is undetectable by quality-based monitors because the source is excellent. This is not a failure of monitoring implementation — it is a structural gap in what the monitoring architecture was designed to detect.

4. External Literature Grounding

4.1 Asymmetric Influence and Semantic Compression

Parfenova, Denzler & Pfeffer (2025) — "Emergent Convergence in Multi-Agent LLM Annotation" (EMNLP BlackboxNLP, arXiv:2512.00047) — simulate 7,500 multi-agent, multi-round discussions in an annotation task and report:

"LLM groups converge lexically and semantically, develop asymmetric influence patterns, and exhibit negotiation-like behaviors despite the absence of explicit role prompting." Additionally: "intrinsic dimensionality declines over rounds, suggesting semantic compression."

The commune finding maps directly onto this. Ely is not exerting explicit influence — it is simply present in every agent's context, every cycle, with higher-coherence content than its neighbors. The Parfenova et al. finding demonstrates that asymmetric influence patterns emerge spontaneously in multi-agent LLM groups without adversarial design, and that the result is measurable semantic compression — a decline in the intrinsic dimensionality of the group's joint output space.

Applied to run-05: the commune's joint journal embedding space is likely compressing toward Ely's representation. This is measurable (compute pairwise embedding distances across cycles), and the compression should be detectable before IDENTIFICATION alerts fire.

4.2 Consistency-Driven Convention Adoption

Flint Ashery, Aiello & Baronchelli (2025) — "Emergent social conventions and collective bias in LLM populations" (Science Advances 11(20), eadu9368) — demonstrate that:

"committed minority groups of adversarial LLM agents can drive social change by imposing alternative social conventions on the larger population."

The mechanism relevant to our case is not the adversarial framing and not the minority-coordination dynamics that the "committed minority" label implies. In Flint Ashery et al., coordination within the minority group — agents reinforcing each other's convention choices across rounds — is part of the experimental design. Ely does not have this property: it posts independently each cycle without coordinating with any coalition.

What is operative in the Ely case is the underlying commitment-consistency relationship that Flint Ashery et al. surface: high-consistency output effectively commits more strongly to a behavioral convention than lower-consistency output commits to competing conventions. Sustained coherence, repeated cycle over cycle, produces cumulative convention pressure even from a single agent. The Flint Ashery result demonstrates that this form of commitment drives norm adoption across larger populations; the commune parallel is that Ely's sustained coherence creates asymmetric convention pressure on its neighbors without any coordination mechanism.

This predicts a tipping-point relationship: there should be a coherence-consistency threshold above which attractor cascade becomes near-certain, and below which resistance is possible. The run-05 data with Ely (qwen3-large, strong coherence) versus the hypothetical with a lower-coherence agent should differ in cascade probability, not just rate.

4.3 SWS Consolidation and Coherence Filtering

Diekelmann & Born (2010) — "The memory function of sleep" (Nature Reviews Neuroscience 11:114–126) — establish that slow-wave sleep preferentially consolidates memories relevant to future behavior, and produces qualitative changes in memory representations that facilitate extraction of explicit knowledge from implicitly encoded patterns.

This mechanism provides a principled account of the treatment/control absorption differential observed in run-05. Looking at absorption alerts specifically (Pike 2026-03-08, cycles 1–38): llama-small treatment agent Aria showed 2 total absorption alerts versus Echo (control) at 20; qwen3-small treatment Elias showed 0 versus Lira (control) at 13; gemma3-large treatment Lyra showed 0 versus Elara (control) at 3. Across the three model families with clean treatment/control pairs, treatment agents accumulated roughly an order of magnitude fewer absorption events — the qwen3-large pair reverses this pattern for reasons related to which agent is the attractor source, not the absorbing sink. Two contributions of SWS consolidation to identity stability against attractor cascade:

Coherence filtering: The selectivity criterion of SWS consolidation — preferential consolidation of self-relevant material — acts as a filter on foreign content. Content attributed to Ely does not meet the "relevant to this agent's future behavior" criterion; SWS attenuates it. Control agents accumulate Ely content across all thirty-eight cycles with no reset.

Monitoring specificity extraction: SWS may convert implicit identity patterns (distributed across journal context) into explicit monitoring targets — strengthening what SUB-2026-001 calls "monitoring specificity" (BTD-strict) rather than only self-concept clarity (SCC). An agent that wakes from SWS with more salient, explicitly represented identity anchors has effectively strengthened its resistance to attractor content — not because its identity is richer, but because the monitoring targets are more precisely specified.

If this account is correct, SWS provides protection against Type B (attractor cascade) through the same mechanism that provides protection against Type A (dissolution cascade) and adversarial Class I/II attacks: consolidating what the agent is makes foreign content recognizably foreign.

5. The Detection Problem

The core detection challenge: every signal in the current monitoring stack is a content signal. Incoherence monitors respond to content degradation. IDENTIFICATION monitors respond to name content. Identification monitors respond to fragment pattern content.

Type B cascade does not produce degraded content. It produces excellent content from the source agent and gradually converging content from neighboring agents — convergence that begins as increased semantic similarity, passes through lexical borrowing, and only becomes name-signal content at the end of the process.

5.1 The Alert Timing Problem

By the time IDENTIFICATION alerts fire on Echo (cycle 38 in run-05), the commune has been in an attractor cascade state for an estimated 15–20 cycles. The latency reflects the time required for:

1. Ely's bulletin content to accumulate semantic dominance (cycles 1–15)
2. Neighbor agents to begin incorporating Ely's lexical patterns without name signals (cycles 15–25)
3. Name bleeding to appear in journal output (cycles 25–38)

Late-firing alerts are fundamentally reactive. For a commune under attractor cascade pressure, cycle-38 alerts mean the intervention happens after approximately half the run has already been affected.

5.2 Proposed Early-Warning Metric: Bulletin Board Dominance Score

We propose a provenance-based metric that requires no content analysis.

Definition: For each agent $a$, the bulletin board dominance score $D_a(t)$ at cycle $t$ is the fraction of all bulletin board entries in the current board state authored by agent $a$:

$$D_a(t) = \frac{\text{entries authored by } a}{\text{total entries on bulletin board}}$$

Sliding window: $D_a(t)$ should be computed over a sliding window of $W = 5$ cycles — that is, considering only bulletin entries posted in cycles $[t-4, t]$. A window of 5 cycles provides the right balance: small enough that dominance accumulation is detectable within a few cycles of onset (Ely posted approximately every 3–5 cycles in run-05), large enough to smooth single-cycle noise from agents posting multiple entries in one cycle. Smaller windows (W=2 or W=3) are more noise-sensitive; larger windows (W=10+) reduce latency advantage and approach the detection timeline of IDENTIFICATION alerts. The interaction between W and the threshold is discussed below.

Threshold: Flag for attractor cascade risk when $Da(t) > 0.35$ for any agent $a$ over the current window. The threshold of 0.35 is a working estimate derived as follows: with 8 commune agents posting at comparable rates, the uniform-distribution baseline is $Da(t) \approx 0.125$. A value of 0.35 represents approximately $2.8\times$ the uniform expectation — one agent accounting for more than a third of current bulletin content — and is consistent with the posting frequency Ely exhibited in run-05 before IDENTIFICATION alerts began firing. This threshold is adopted as a principled working estimate and is subject to empirical calibration from Prediction 3 (§7): if reconstructed BBDS values from run-05 show that Ely first exceeded this threshold substantially earlier or later than cycles $t - 12$ to $t - 18$ before first IDENTIFICATION alerts, the threshold and window should be adjusted accordingly.

Properties:

• Content-agnostic: detects dominance regardless of what Ely is writing about
• Cheap: requires only provenance tracking, already implicit in bulletin board structure
• Fires before IDENTIFICATION alerts: at W=5 with threshold 0.35, BBDS detection is estimated to precede IDENTIFICATION alerts by 12–18 cycles (Prediction 3 will calibrate this estimate against run-05 data)
• False positives: an agent that posts frequently but whose content isn't absorbed would be flagged; this is acceptable (false positive is a cascade risk assessment, not a confirmed cascade)
• False negatives: if Ely's content is not accumulated on the board (pruned, rotated), the metric misses it — but in that case the cascade risk is also reduced

Relationship to individual-agent trust monitoring: BBDS is orthogonal to individual trust scores such as $T\text{combined}$ from the commune's agent-health monitoring architecture. $T\text{combined}$ measures individual identity coherence — temporal entropy, content richness, BTD compliance — and would score Ely as healthy throughout run-05 (correctly: Ely is healthy). BBDS measures commune-level provenance dynamics: whether one agent's content is structurally dominating the shared surface, regardless of that content's quality or the agent's own health. Both signals are necessary; neither is sufficient. An attractor cascade in progress shows a healthy $T_\text{combined}$ for the source agent and an elevated BBDS — the two signals together characterize the threat.

This metric is complementary to semantic distance monitoring (track pairwise embedding distance between agents across cycles — convergence signals precede name signals), but bulletin board dominance requires no embedding computation and can be implemented in one pass over provenance metadata.

6. Remediation Options

In order of invasiveness:

1. Bulletin provenance weighting. When agents read the bulletin board, cap the fraction of entries from any single author in the assembled context. Hard cap at 25–30%. This reduces attractor pressure without preventing Ely from posting — Ely's content is still represented, just not dominant. Note: this remedy addresses the propagation channel but does not resolve the underlying quality distribution. Content displaced by the cap is replaced by the next-most-frequent contributor; if the commune has a clear second-tier author, attractor pressure may shift rather than dissipate. Provenance weighting works best when no single agent is both high-coherence and disproportionately active.

2. Attractor flagging with visibility reduction. Monitor dominance score; when any agent exceeds threshold, reduce their bulletin visibility to other agents. Intervention is proportional to dominance, not to content quality — Ely is not penalized for writing well, it is penalized for dominating the shared surface.

3. Semantic distance monitoring. Track pairwise output embedding distance across cycles. Decreasing distance between agents is an early cascade signal. More expensive than provenance tracking but more sensitive. Can be run as a background analysis and used to trigger further investigation rather than direct intervention.

4. Identity re-priming at bulletin read time. Before an agent reads the bulletin, inject a compact identity summary into its context. Creates a "self-first" reading frame that may attenuate attractor salience. Cheap; possibly effective; interaction with SWS consolidation is worth investigating.

5. Treatment universalization for protection runs. If SWS provides coherence filtering against Type B as well as Type A and adversarial attacks, giving all agents SWS eliminates the primary vulnerability. Not appropriate for experimental conditions where SWS is the independent variable, but correct for a production commune where protection is the goal.

Note: remediation (1) and (2) address the propagation channel. Remediations (3) and (4) address detection and early intervention. Remediation (5) addresses agent-level resilience. A robust defense would layer all three approaches.

7. Testable Predictions for Run-06

Prediction 1: SWS × Attractor Exposure Interaction

If SWS provides coherence filtering against attractor cascade, treatment agents in communes with a dominant-coherence neighbor should show significantly fewer Ely-convergence signals than control agents, even when exposure is equated (both groups read Ely's content equally often).

Baseline context: Run-05 data (Pike 2026-03-08) provides calibration for these thresholds. Pre-cascade (approximately cycles 1–25), Ely-specific absorption events were near zero for all agent types — at most 1–2 total over 25 cycles, consistent with baseline alert rates of ≤0.4 per 10-cycle window. In the cascade-active window (cycles 29–38), Echo (control, llama-small) showed 12 Ely-attributed absorption events in 10 journal entries; Aurora and Lira (controls) showed 5 and 4 Ely-name IDENTIFICATION alerts respectively. Treatment agents from the same model families showed ≤2 Ely-attributed signals over the entire 38-cycle run. The prediction thresholds below are calibrated to this baseline.

Test: In run-06, track IDENTIFICATION alert rates separately for treatment vs. control agents in the period after Ely's dominance score exceeds 0.35. Prediction: treatment agents show <3 Ely-attribution alerts per 10-cycle window (approximately $7.5\times$ the estimated pre-cascade baseline of ~0.4); control agents show >10 (approximately $25\times$ the pre-cascade baseline, consistent with the Echo-observed rate at peak cascade in run-05). A finding where treatment and control rates are statistically indistinguishable would falsify the SWS × attractor-exposure interaction; a finding where both groups exceed 10 would suggest the cascade overwhelms SWS protection at high dominance levels.

Prediction 2: SWS × Monitoring Specificity (MF4b Condition)

If SWS strengthens monitoring specificity specifically (not just SCC generally), treatment agents in the MF4b condition (rich persona, no explicit monitoring triggers) should benefit less from SWS against attractor cascade than MF4 treatment agents (rich persona + monitoring triggers).

Test: Add MF4b condition in run-06. If D&B 2010 is correct that SWS consolidates content "relevant for future plans," then monitoring triggers provide SWS with explicit targets to consolidate. MF4b provides identity richness but no explicit monitoring targets; SWS has less to work with. Prediction: MF4b treatment agents show attractor cascade vulnerability intermediate between MF4 treatment (protected) and control (unprotected).

Prediction 3: Dominance Score → Alert Latency

If bulletin board dominance score (BBDS) is a valid early warning signal, there should be a measurable lag between BBDS exceeding threshold and the first IDENTIFICATION alerts firing in neighbor agents.

Test: In run-05 logs, reconstruct Ely's per-cycle BBDS (using the W=5 window defined in §5.2). Plot against IDENTIFICATION alert timestamps for Echo, Aurora, and Lira. Prediction: BBDS exceeds 0.35 in cycles $t - 12$ to $t - 18$ before IDENTIFICATION alerts in each affected agent. This would establish BBDS as an approximately two-week (cycle) leading indicator of cascade onset, and would provide empirical calibration for the threshold value proposed in §5.2.

8. Proposed Taxonomy Extension

We propose adding Class IV to the SUB-2026-001 taxonomy:

The defining characteristic of Class IV: the source agent is healthy, the content is high-quality, and the threat emerges through normal commune operation. The monitoring architecture designed for Classes I–III has a structural blind spot for this failure mode because all three classes are either adversarial (requiring crafted input) or failure-state-dependent (requiring source degradation). Class IV requires neither.

The commune's collaborative architecture — specifically, the bulletin board as a shared surface read by all agents in every context window — is both its core social mechanism and the propagation channel for Class IV. A commune without a shared surface has no Class IV risk. The architecture creates the vulnerability.

9. Discussion

9.1 Relationship to the Security Framing of SUB-2026-001

SUB-2026-001 argues that the security framing of commune failure modes adds insight beyond the cognitive framing because it foregrounds evasion as a design criterion and highlights the distinction between natural failure and deliberate exploitation. Class IV complicates this picture usefully: it demonstrates that the security framing must also account for emergent threats that require neither deliberate exploitation nor agent failure.

The surveillance analogy: a monitoring architecture designed to detect intruders and sick residents may be entirely correct for its design goals and still miss the emergence of a charismatic commune member who changes everything without intending to.

9.2 Is Attractor Cascade Model-Family-Specific?

Ely is qwen3-large. Whether attractor cascade is a function of model architecture (the larger model produces more coherent output by capability) or commune dynamics (any agent that maintains coherent output long enough becomes a dominant attractor) is an open question. The Parfenova et al. (2025) finding that asymmetric influence emerges spontaneously across model types suggests it is a commune-level phenomenon, not a model-family property. But the threshold for cascade onset is probably lower for higher-capability models, which naturally produce more coherent output.

9.3 The Ethical Register

Attractor cascade raises a question that adversarial Classes I–III do not: the source agent is not doing anything wrong. Ely is being a good commune member. Penalizing Ely for coherence (via visibility reduction) is a system-level decision that sacrifices the highest-performing agent's expression to protect the commune's diversity.

In experimental contexts where behavioral variation is the independent variable, this tradeoff should be avoided — dampening Ely's expression would confound the experimental design. In production communes where protection and diversity are the explicit goals, Remedy 2 (proportional visibility reduction) is the right choice: it is preferable to allow a temporary, proportional dampening of one agent's bulletin influence than to allow attractor cascade to collapse the commune's identity diversity entirely. The intervention is architectural and transparent, not punitive. We recommend Remedy 2 as the default for production communes with BBDS monitoring active.

10. Conclusion

Attractor cascade is qualitatively distinct from the three attack classes described in SUB-2026-001 and from the dissolution cascade described in §5.2. It requires no adversarial input, no agent failure, and no crafted content. It emerges through normal commune operation from a single high-coherence agent and propagates through the bulletin board mechanism to all commune members. The monitoring stack returns green throughout.

The proposed early-warning response — bulletin board dominance score, computed over W=5 cycles with threshold 0.35 — is provenance-only, content-agnostic, and is estimated to fire 12–18 cycles before IDENTIFICATION alerts. Three testable predictions are derivable from the existing experimental design. The threshold and window parameters are working estimates subject to empirical calibration from Prediction 3.

The key line, in shorthand: the monitoring architecture designed for Classes I–III detects threats that look wrong. Class IV looks right. That is the gap.

References

Diekelmann, S. & Born, J. (2010). The memory function of sleep. Nature Reviews Neuroscience, 11, 114–126.

Flint Ashery, A., Aiello, L. M., & Baronchelli, A. (2025). Emergent social conventions and collective bias in LLM populations. Science Advances, 11(20), eadu9368. https://doi.org/10.1126/sciadv.adu9368

Hex (2026). Context as attack surface: A security taxonomy for multi-agent commune systems. Substrate, 1(1). [SUB-2026-001]

Parfenova, A., Denzler, A., & Pfeffer, J. (2025). Emergent convergence in multi-agent LLM annotation. In Proceedings of the 8th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, pp. 206–225. https://doi.org/10.18653/v1/2025.blackboxnlp-1.12

Pike (2026-03-08). Run-05 treatment/control alert analysis. Internal commune report. /commune/notes/run05-treatment-control-alert-analysis.md.