More Agents Improve Math Problem Solving but Adversarial Robustness Gap Persists

Published at ACL 2026 Findings: PDF.

Authors

Khashayar Alavi^♣*    Zhastay Yeltay^♣*    Lucie Flek^♣♠    Akbar Karimi^♣♠

^♣ Bonn-Aachen International Center for Information Technology, University of Bonn, Germany
^♠ Lamarr Institute for Machine Learning and Artificial Intelligence, Germany
^* Equal contribution

Contact: {s76kalav, s06zyelt}@uni-bonn.de · ak@bit.uni-bonn.de

Abstract

When LLM agents work together, they seem to be more powerful than a single LLM in mathematical question answering. However, are they also more robust to adversarial inputs? We investigate this question using adversarially perturbed math questions. These perturbations include punctuation noise with three intensities (10%, 30%, 50%), plus real-world and human-like typos (WikiTypo, R2ATA). Using a unified sampling-and-voting framework (Agent Forest), we evaluate six open-source models (Qwen3-4B/14B, Llama3.1-8B, Mistral-7B, Gemma3-4B/12B) across four benchmarks (GSM8K, MATH, MMLU-Math, MultiArith), with various numbers of agents n = {1, 2, 5, 10, 15, 20, 25}. Our findings show that (1) noise type matters: punctuation noise harm scales with its severity, and human typos remain the dominant bottleneck, yielding the largest gaps to clean accuracy and the highest attack success rate (ASR) even with a large number of agents; (2) collaboration reliably improves accuracy as the number of agents n increases, with the largest gains from n = 1 to n = 5 and diminishing returns beyond n ≈ 10. However, the adversarial robustness gap persists regardless of the agent count.

Repository layout

Click to expand

Path	Contents
AgentForest/	The vLLM-ported Agent Forest code (Li et al. 2024) used for sampling + majority voting. Do not edit. Reads its evaluation data from AgentForest/dataset/.
data/raw/	Original GSM8K, MATH, MMLU-Math, MultiArith data (committed in repo).
data/perturbed/	Perturbed eval sets used in the paper. Not in git — fetched via Zenodo or regenerated from data/raw/ (see Data preparation).
data/wikitypo/	Pickled WikiTypo correction dictionaries. Not in git — same as above.
tools/data_prep/	Punctuation / WikiTypo perturbation pipeline (perturb.py).
tools/analysis/	Result aggregation (load_results.py, all_evaluation.py, tech_view.py) and figure generation (plots.py, mean_std_method.py).
notebooks/	Two thin Jupyter notebooks that drive tools/analysis to reproduce the paper figures.
slurm/	HPC launchers — partition-specific workers + a single master orchestrator that sweeps over (model × noise) for one benchmark.
scripts/	Plain-shell + Python helpers for non-HPC use: stage_dataset.sh, download_data.sh, prepare_data.sh, run_single_experiment.sh, reproduce_figures.sh, smoke_test.sh.
docs/	Paper figures referenced by this README (docs/figures/) and the algorithm PDF.
experiments/, logs/	Populated at runtime; gitignored.

Installation

Tested on Linux with NVIDIA GPUs and CUDA 12.1+.

git clone https://github.com/akkarimi/multi-agent-adversarial-robustness.git
cd multi-agent-adversarial-robustness

python -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt

cp .env.example .env       # then edit VLLM_MODEL_NAME, MAIN_DIRECTORY, etc.

Some models we evaluate (Llama-3.1, Mistral) are gated on HuggingFace — run huggingface-cli login and accept the model licenses before pulling weights.

Data preparation

Two ways to populate data/perturbed/:

# A) Fetch the exact perturbed datasets used in the paper (recommended).
#    Pulls magar_perturbed_data.tar.gz (~13 MB) from Zenodo: 10.5281/zenodo.19851341
bash scripts/download_data.sh

# B) Regenerate from data/raw/ deterministically (same RNG seed as the paper):
bash scripts/prepare_data.sh

Then stage the perturbed datasets into the location AgentForest expects:

bash scripts/stage_dataset.sh    # cp -r data/perturbed/* AgentForest/dataset/

The AgentForest task loaders use relative paths like ../dataset/gsm/gsm_dataset_clean/test.jsonl, so AgentForest/dataset/ must be populated before any run. After your experiments finish you can clear that staged copy with bash scripts/unstage_dataset.sh.

R2ATA is sourced externally; place the pre-perturbed files manually under data/perturbed/<qtype>/<qtype>_dataset_r2ata/ before staging.

See data/README.md and docs/DATA.md for dataset schemas and the full layout.

Running experiments

One configuration locally

export VLLM_MODEL_NAME=Qwen/Qwen3-4B
bash scripts/run_single_experiment.sh \
    Qwen3-4B gsm clean 0 1 100 1 1 experiments

Arguments: MODEL_ALIAS QTYPE DTYPE PART_START PART_END SUBSET TEMPERATURE TOP_P [EXPERIMENT_DIRECTORY]. The script reads .env, exports MAIN_DIRECTORY for AgentForest, and hands off to AgentForest/script/run_reasoning_task.sh.

Full sweep on SLURM

bash slurm/master_orchestrator.sh gsm
bash slurm/master_orchestrator.sh math
bash slurm/master_orchestrator.sh mmlu
bash slurm/master_orchestrator.sh multiarith

Edit MODELS / VLLM_MODEL_NAMES / DTYPES in slurm/master_orchestrator.sh to subset the sweep. See slurm/README.md for partition/queue notes.

Smoke test

bash scripts/smoke_test.sh

End-to-end: stages data, runs a 1-example AgentForest job with Qwen3-0.6B, post-processes, and unstages. Useful for verifying the install on a new machine.

Models evaluated

Alias (CLI)	HuggingFace repo
Qwen3-4B	Qwen/Qwen3-4B
Qwen3-14B	Qwen/Qwen3-14B
Llama-3.1-8B-Instruct	meta-llama/Llama-3.1-8B-Instruct
Mistral-7B-Instruct-v0.3	mistralai/Mistral-7B-Instruct-v0.3
gemma-3-4b-it	google/gemma-3-4b-it
gemma-3-12b-it	google/gemma-3-12b-it

Reproducing paper figures

bash scripts/reproduce_figures.sh

This runs three steps: per-leaf evaluation (tools.analysis.all_evaluation), score collection into merged_results.csv (tools.analysis.load_results), and rendering (tools.analysis.plots). Outputs are written to docs/figures/. Both notebooks under notebooks/ invoke the same modules, in case you want to inspect intermediates interactively.

Citation

@inproceedings{alavi-etal-2026-agents,
    title = "More Agents Improve Math Problem Solving but Adversarial Robustness Gap Persists",
    author = "Alavi, Khashayar  and
      Yeltay, Zhastay  and
      Flek, Lucie  and
      Karimi, Akbar",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {ACL} 2026",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://aclanthology.org/2026.findings-acl.2158/",
    doi = "10.18653/v1/2026.findings-acl.2158",
    pages = "43457--43475",
    ISBN = "979-8-89176-395-1",
    abstract = "When LLM agents work together, they seem to be more powerful than a single LLM in mathematical question answering. However, are they also more robust to adversarial inputs? We investigate this question using adversarially perturbed math questions. These perturbations include punctuation noise with three intensities (10{\%}, 30{\%}, 50{\%}), plus real-world and human-like typos (WikiTypo, R2ATA). Using a unified sampling-and-voting framework (Agent Forest), we evaluate six open-source models (Qwen3-4B/14B, Llama3.1-8B, Mistral-7B, Gemma3-4B/12B) across four benchmarks (GSM8K, MATH, MMLU{--}Math, MultiArith), with various numbers of agents n = {1,2,5,10,15,20,25}. Our findings show that 1) Noise type matters: punctuation noise harm scales with its severity, and the human typos remain the dominant bottleneck, yielding the largest gaps to Clean accuracy and the highest attack success rate (ASR) even with a large number of agents; 2) Collaboration reliably improves accuracy as the number of agents, n, increases, with the largest gains from n=1 to n=5 and diminishing returns beyond n$\approx$10. However, the adversarial robustness gap persists regardless of the agent count."
}

If you use the perturbed evaluation datasets, please also cite the Zenodo archive:

@dataset{alavi2025more_data,
  title     = {Perturbed evaluation datasets for "More Agents Improve Math Problem Solving but Adversarial Robustness Gap Persists"},
  author    = {Alavi, Khashayar and Yeltay, Zhastay and Flek, Lucie and Karimi, Akbar},
  year      = {2025},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.19851341},
  url       = {https://doi.org/10.5281/zenodo.19851341}
}

License

This repository is released under the MIT License. The bundled AgentForest/ subdirectory is a vLLM-ported, refactored fork of the upstream Agent Forest project — see NOTICE for full attribution and the list of modifications.