Cited by 3Adversarial Robustness in Machine LearningAI-based Problem Solving and PlanningNetwork Security and Intrusion Detection

The DOI matches its Crossref record; 21 of the 23 references it cites were found in a registry or an index, and 2 are not checked yet; none of the 58 sources its claims cite is checked for support yet.

Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP

Open access
Bogdanov, Igor, Lung, Chung-Horng, Kunz, Thomas, Gao, Jie, Taylor, Adrian, Zaman, Marzia·2026·Proceedings of the ACM Conference on AI and Agentic Systems

Abstract

Deploying compound LLM agents in adversarial, partially observable sequential environments requires navigating several interacting design dimensions: (1) what the agent sees, (2) how it reasons, and (3) how tasks are decomposed across components. Yet practitioners lack guidance on which design choices improve performance versus merely increase inference costs. We present a controlled study of compound LLM agent design in CybORG CAGE-2, a cyber defense environment modeled as a Partially Observable Markov Decision Process (POMDP). Reward is non-positive, so all configurations operate in a failure-mitigation mode and errors compound over time. Our evaluation spans five model families, six models, and twelve configurations (3,475 episodes) with token-level cost accounting. We systematically vary context representation (raw observations vs. a deterministic, programmatic environment state-tracking layer with compressed history), deliberation (self-questioning, self-critique, and self-improvement tools, with optional chain-of-thought prompting), and hierarchical decomposition (monolithic ReAct vs. delegation to specialized sub-agents). We find that: (1) Programmatic state abstraction delivers the largest returns per token spent (RPTS), improving mean return by up to 76% over raw observations. (2) Distributing deliberation tools across a hierarchy degrades performance relative to hierarchy alone for all five model families, reaching up to 3.4 × worse mean return while using 1.8-2.7 × more tokens. We call this destructive interaction pattern a deliberation cascade. (3) Hierarchical decomposition without deliberation tools achieves the best absolute performance for most models, and context engineering is generally more cost-effective than deliberation. These findings suggest a design principle for structured adversarial POMDPs: invest in programmatic infrastructure and clean task decomposition rather than deeper per-agent reasoning, as these strategies can interfere when combined.

Checked 2026-11-10 · 2 references not checked yet

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This paper is a controlled cost-performance study of compound LLM agent design in the adversarial POMDP CybORG CAGE-2, ablating context representation, deliberation, and hierarchy across six models and 3,475 episodes. It finds that deterministic programmatic context gives the largest gains per token, while distributing deliberation tools across a hierarchy causes a “deliberation cascade” that worsens returns and increases token use.

Key findings

  • Programmatic state abstraction delivers the largest returns per token spent (RPTS): adding a deterministic `{network_status}` layer to raw observations improves mean return by up to 76% (Llama: -214.7 → -51.4; Qwen by 71%; Devstral by 53%), and context configurations dominate the cost-performance frontier.
  • Deliberation distributed across the hierarchy degrades performance for all six models relative to hierarchy alone, with up to 3.4× worse mean return (Devstral: -37.8 → -127.4) while using 1.8–2.7× more tokens; the authors call this a deliberation cascade.
  • Hierarchy without deliberation (`hier-base`) achieves the best or near-best absolute performance for four of six models (e.g., G3FP -16.1, Grok -24.0, Qwen -28.6), approaching the top published DRL result of -3.47, while monolithic deliberation is model-dependent and often costly.
  • Context engineering also compresses tail risk: catastrophic failure rates (return < -150) drop from >90% under raw observations to <10% in the strongest cases, whereas `hier-delib` increases variance (e.g., Devstral SD rises from 37 to 72 and catastrophic rate from 2% to 44%).

Methods

  • Controlled three-axis ablation in CybORG CAGE-2, a 30-step adversarial POMDP with a 13-host network, scripted attacker kill chain, five defender actions, and non-positive rewards; configurations vary context (6 configs), deliberation (4 cumulative levels: question, critique, improve, COT), and hierarchy (2 configs: `hier-base`, `hier-delib`).
  • Six models from five families (Grok, Llama, Devstral, Qwen, G2.5FL, G3FP) evaluated on all 12 configurations, yielding 72 model-configuration pairs, 3,475 episodes, and 283.9M tokens; standard allocation is 10 instances × 5 runs = 50 episodes per pair, with some reduced or extended batches.
  • Main metrics are mean episode return (closer to zero better), total tokens per episode (prompt + completion), returns per token spent (RPTS), standard deviation, catastrophic failure rate (< -150), and per-model Pareto frontiers; all models use deterministic decoding (temperature 0) and identical prompts/tools.

Limitations

  • The paper states claims are scoped to structured adversarial POMDPs where deterministic state abstraction is feasible; it uses a single environment (fixed topology, scripted adversary, 30-step horizon) and a single three-agent hierarchy, so alternative topologies may show different deliberation-cascade dynamics.
  • The paper states token counts proxy cost but do not capture latency or pricing, knowledge-free prompts isolate architectural effects without fully disentangling pretrained priors, deliberation tools are tested only in cumulative activation order, and model selection spans mid-tier/efficiency-focused families rather than frontier-scale models.
  • Evident from the text: G2.5FL fails catastrophically (>48%) across all configurations, suggesting a capability floor, and the authors note positive claims do not depend on it; episode allocations differ across models/configurations (e.g., G3FP uses 25 episodes, some configs use 75–100), though the paper says these differences do not affect qualitative conclusions.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3786335.3813149

Cites

21 of 23 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 58 cited sources checked · 0 supported · 0 flagged

Show all 43 claims

  • It may state two separate claims as one. 85
  • The quote only partly states this claim. 7
  • Probably not a substantial claim. 69
134 of 134
  • The authors state this as an assumption.

    Models' internal knowledge may include information about CAGE-2 acquired during pre-training.

    “Models' internal knowledge may include information about CAGE-2 acquired during pre-training.”
  • The paper relies on this without support.

    Token count correlates with latency.

    “We use total number of tokens per episode (prompt + completion) as the primary cost metric, mapping directly to billed usage and correlating with latency.”
  • The paper relies on this without support.

    The public CAGE-2 leaderboard reference values are comparable to the study's setting.

    “To ground the reward scale, we reference the public CAGE-2 leaderboard [22] (30-step, B_line setting).”
  • The authors state this as an assumption.

    Token counts are a valid proxy for cost in comparing configurations.

    “Token counts proxy cost but do not capture latency or pricing”
  • The authors state this as an assumption.

    Knowledge-free prompts isolate architectural effects from pretrained priors.

    “knowledge-free prompts isolate architectural effects without fully disentangling pretrained priors.”
  • The authors state this as an assumption.

    The cumulative activation order of deliberation tools is a valid representation of deliberation depth.

    “Deliberation tools are tested only in cumulative activation order; independent activation may yield different interaction patterns.”
6 of 6

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • A 48% catastrophic rate is described as greater than 48%

    Minor

    The claim that G2.5FL exceeds 48% in every configuration conflicts with its reported 48.0% rate under +critique.

  • Shifted defense score is not always non-negative

    Minor

    Table 22 reports an episode return of -229.5. Under the paper's stated shift, that episode has a defense score of 225 − 229.5 = -4.5, not a non-negative score.

2 of 2

Citations

Cites

Flagged first, then by citations

Show all 21 references

Cited by

Sorted by citations

See all 3

Metadata

Authors
Bogdanov, I., Lung, C.-H., Kunz, T., Gao, J., Taylor, A., & Zaman, M.
Affiliations
  • Carleton University (CA)
  • Defence Research and Development Canada (CA)
  • Cistel Technology (Canada) (CA)
Venue
Proceedings of the ACM Conference on AI and Agentic Systems
Publisher
ACM
Published
2026-05-26
Pages
17-45
OpenAlex
W7161646776
Cited by
3
References
21
Citations by year
2026: 3
FWCI
4.08
Type
conference paper
Language
en
Open access
Licence
cc-by-nc-nd
Locations
  • ACM Conference on AI and Agentic Systems (CAIS) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › AI-based Problem Solving and Planning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
cyber defense, context representation, self-criticism, chain-of-thought prompting, hierarchical task decomposition, React, token cost, cost-performance trade-off, failure mitigation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-10, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-10 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review