Cited by 3Adversarial Robustness in Machine LearningAI-based Problem Solving and PlanningNetwork Security and Intrusion Detection

The DOI matches its Crossref record; 21 of the 23 references it cites were found in a registry or an index, and 2 are not checked yet; none of the 58 sources its claims cite is checked for support yet.

Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP

Open access
Bogdanov, Igor, Lung, Chung-Horng, Kunz, Thomas, Gao, Jie, Taylor, Adrian, Zaman, Marzia·2026·Proceedings of the ACM Conference on AI and Agentic Systems

Abstract

Deploying compound LLM agents in adversarial, partially observable sequential environments requires navigating several interacting design dimensions: (1) what the agent sees, (2) how it reasons, and (3) how tasks are decomposed across components. Yet practitioners lack guidance on which design choices improve performance versus merely increase inference costs. We present a controlled study of compound LLM agent design in CybORG CAGE-2, a cyber defense environment modeled as a Partially Observable Markov Decision Process (POMDP). Reward is non-positive, so all configurations operate in a failure-mitigation mode and errors compound over time. Our evaluation spans five model families, six models, and twelve configurations (3,475 episodes) with token-level cost accounting. We systematically vary context representation (raw observations vs. a deterministic, programmatic environment state-tracking layer with compressed history), deliberation (self-questioning, self-critique, and self-improvement tools, with optional chain-of-thought prompting), and hierarchical decomposition (monolithic ReAct vs. delegation to specialized sub-agents). We find that: (1) Programmatic state abstraction delivers the largest returns per token spent (RPTS), improving mean return by up to 76% over raw observations. (2) Distributing deliberation tools across a hierarchy degrades performance relative to hierarchy alone for all five model families, reaching up to 3.4 × worse mean return while using 1.8-2.7 × more tokens. We call this destructive interaction pattern a deliberation cascade. (3) Hierarchical decomposition without deliberation tools achieves the best absolute performance for most models, and context engineering is generally more cost-effective than deliberation. These findings suggest a design principle for structured adversarial POMDPs: invest in programmatic infrastructure and clean task decomposition rather than deeper per-agent reasoning, as these strategies can interfere when combined.

Checked 2026-11-10 · 2 references not checked yet

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This paper is a controlled cost-performance study of compound LLM agent design in the adversarial POMDP CybORG CAGE-2, ablating context representation, deliberation, and hierarchy across six models and 3,475 episodes. It finds that deterministic programmatic context gives the largest gains per token, while distributing deliberation tools across a hierarchy causes a “deliberation cascade” that worsens returns and increases token use.

Key findings

  • Programmatic state abstraction delivers the largest returns per token spent (RPTS): adding a deterministic `{network_status}` layer to raw observations improves mean return by up to 76% (Llama: -214.7 → -51.4; Qwen by 71%; Devstral by 53%), and context configurations dominate the cost-performance frontier.
  • Deliberation distributed across the hierarchy degrades performance for all six models relative to hierarchy alone, with up to 3.4× worse mean return (Devstral: -37.8 → -127.4) while using 1.8–2.7× more tokens; the authors call this a deliberation cascade.
  • Hierarchy without deliberation (`hier-base`) achieves the best or near-best absolute performance for four of six models (e.g., G3FP -16.1, Grok -24.0, Qwen -28.6), approaching the top published DRL result of -3.47, while monolithic deliberation is model-dependent and often costly.
  • Context engineering also compresses tail risk: catastrophic failure rates (return < -150) drop from >90% under raw observations to <10% in the strongest cases, whereas `hier-delib` increases variance (e.g., Devstral SD rises from 37 to 72 and catastrophic rate from 2% to 44%).

Methods

  • Controlled three-axis ablation in CybORG CAGE-2, a 30-step adversarial POMDP with a 13-host network, scripted attacker kill chain, five defender actions, and non-positive rewards; configurations vary context (6 configs), deliberation (4 cumulative levels: question, critique, improve, COT), and hierarchy (2 configs: `hier-base`, `hier-delib`).
  • Six models from five families (Grok, Llama, Devstral, Qwen, G2.5FL, G3FP) evaluated on all 12 configurations, yielding 72 model-configuration pairs, 3,475 episodes, and 283.9M tokens; standard allocation is 10 instances × 5 runs = 50 episodes per pair, with some reduced or extended batches.
  • Main metrics are mean episode return (closer to zero better), total tokens per episode (prompt + completion), returns per token spent (RPTS), standard deviation, catastrophic failure rate (< -150), and per-model Pareto frontiers; all models use deterministic decoding (temperature 0) and identical prompts/tools.

Limitations

  • The paper states claims are scoped to structured adversarial POMDPs where deterministic state abstraction is feasible; it uses a single environment (fixed topology, scripted adversary, 30-step horizon) and a single three-agent hierarchy, so alternative topologies may show different deliberation-cascade dynamics.
  • The paper states token counts proxy cost but do not capture latency or pricing, knowledge-free prompts isolate architectural effects without fully disentangling pretrained priors, deliberation tools are tested only in cumulative activation order, and model selection spans mid-tier/efficiency-focused families rather than frontier-scale models.
  • Evident from the text: G2.5FL fails catastrophically (>48%) across all configurations, suggesting a capability floor, and the authors note positive claims do not depend on it; episode allocations differ across models/configurations (e.g., G3FP uses 25 episodes, some configs use 75–100), though the paper says these differences do not affect qualitative conclusions.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3786335.3813149

Cites

21 of 23 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Figures

Figure 1 End-to-end system architecture. The deterministic layer (left) compiles structured context from CybORG observations and assembles the agent prompt. The Planner (right) executes a ReAct loop, optionally delegating to Analyst and ActionChooser sub-agents, before emitting a validated action back to the environment.
Figure 1 End-to-end system architecture. The deterministic layer (left) compiles structured context from CybORG observations and assembles the agent prompt. The Planner (right) executes a ReAct loop, optionally delegating to Analyst and ActionChooser sub-agents, before emitting a validated action back to the environment.CC-BY-NC-ND · From the PDF
Figure 2 Context engineering heatmap. Each cell shows mean episode return for one model-context pair. Darker shading indicates worse (more negative) returns. The obs+net and hist+net (Planner-Only) columns are consistently strong across models, while obs alone is typically poor.
Figure 2 Context engineering heatmap. Each cell shows mean episode return for one model-context pair. Darker shading indicates worse (more negative) returns. The obs+net and hist+net (Planner-Only) columns are consistently strong across models, while obs alone is typically poor.CC-BY-NC-ND · From the PDF
Image 3
CC-BY-NC-ND · From the PDF
Figure 4 Cost-performance Pareto frontiers. Points shaped by axis (circles: context, triangles: deliberation, squares: hierarchy). Context configurations occupy the low-cost efficient region; hier-delib is high-cost and dominated.
Figure 4 Cost-performance Pareto frontiers. Points shaped by axis (circles: context, triangles: deliberation, squares: hierarchy). Context configurations occupy the low-cost efficient region; hier-delib is high-cost and dominated.CC-BY-NC-ND · From the PDF
Figure 5 Catastrophic failure rate (return < -150 ) by model and configuration. G2.5FL fails across all configurations; context engineering reduces catastrophic rates for most other models.
Figure 5 Catastrophic failure rate (return < -150 ) by model and configuration. G2.5FL fails across all configurations; context engineering reduces catastrophic rates for most other models.CC-BY-NC-ND · From the PDF
Image 6
CC-BY-NC-ND · From the PDF
Image 7
CC-BY-NC-ND · From the PDF
Figure 8 Raw observation penalty. Gap between obs -only and the structured hist+net anchor configuration per model. Longer bars indicate larger benefit from replacing raw observations with programmatic context.
Figure 8 Raw observation penalty. Gap between obs -only and the structured hist+net anchor configuration per model. Longer bars indicate larger benefit from replacing raw observations with programmatic context.CC-BY-NC-ND · From the PDF
Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP ACM CAIS '26, May 26-29, 2026, San Jose, CA, USA
Context, Reasoning, and Hierarchy: A Cost-Performance Study of Compound LLM Agent Design in an Adversarial POMDP ACM CAIS '26, May 26-29, 2026, San Jose, CA, USACC-BY-NC-ND · From the PDF
Image 10
CC-BY-NC-ND · From the PDF
Figure 11 Model fingerprints. Each radar shows normalized best performance on three axes (context, deliberation, hierarchy). Larger area indicates better overall performance. Models exhibit distinct capability profiles: Grok and G3FP excel across axes, while G2.5FL is uniformly weak.
Figure 11 Model fingerprints. Each radar shows normalized best performance on three axes (context, deliberation, hierarchy). Larger area indicates better overall performance. Models exhibit distinct capability profiles: Grok and G3FP excel across axes, while G2.5FL is uniformly weak.CC-BY-NC-ND · From the PDF
Figure 12 The Deliberation Cascade Penalty. Slope chart showing the shift in mean return when moving from monolithic deliberation to hierarchical deliberation. Red = degradation.
Figure 12 The Deliberation Cascade Penalty. Slope chart showing the shift in mean return when moving from monolithic deliberation to hierarchical deliberation. Red = degradation.CC-BY-NC-ND · From the PDF
Figure 13 Hierarchy degradation. Performance change when distributing deliberation tools across the hierarchy, showing model-specific sensitivity to the deliberation cascade.
Figure 13 Hierarchy degradation. Performance change when distributing deliberation tools across the hierarchy, showing model-specific sensitivity to the deliberation cascade.CC-BY-NC-ND · From the PDF
Figure 14 Deliberation ROI. Each point shows one modellevel pair's change in return and tokens relative to anchor. Upper-left = efficient improvement.
Figure 14 Deliberation ROI. Each point shows one modellevel pair's change in return and tokens relative to anchor. Upper-left = efficient improvement.CC-BY-NC-ND · From the PDF
Capability-SR Correlation: Stronger Baselines Benefit Less
Capability-SR Correlation: Stronger Baselines Benefit LessCC-BY-NC-ND · From the PDF
Figure 16 The reasoning ceiling. Models with higher baseline capabilities tend to peak at lower levels of deliberation before degrading.
Figure 16 The reasoning ceiling. Models with higher baseline capabilities tend to peak at lower levels of deliberation before degrading.CC-BY-NC-ND · From the PDF
Figure 17 Deliberation progression. Performance trajectory across cumulative deliberation levels for each model, showing non-monotonic patterns and model-dependent ceilings.
Figure 17 Deliberation progression. Performance trajectory across cumulative deliberation levels for each model, showing non-monotonic patterns and model-dependent ceilings.CC-BY-NC-ND · From the PDF
Figure 18 Pairwise win rates. Anchor vs +COT compared instance-by-instance. Blue = anchor wins, orange = +COT wins, gray = ties.
Figure 18 Pairwise win rates. Anchor vs +COT compared instance-by-instance. Blue = anchor wins, orange = +COT wins, gray = ties.CC-BY-NC-ND · From the PDF
Figure 19 Global head-to-head win-rate matrix. Compares the peak configuration of every model against every other model on a per-instance basis.
Figure 19 Global head-to-head win-rate matrix. Compares the peak configuration of every model against every other model on a per-instance basis.CC-BY-NC-ND · From the PDF
Figure 20 Model ranking stability. Lines connect each model's best-config rank across the three axes. Flat lines = consistent relative performance.
Figure 20 Model ranking stability. Lines connect each model's best-config rank across the three axes. Flat lines = consistent relative performance.CC-BY-NC-ND · From the PDF
Figure 21 Cumulative distributions by axis. Threshold lines mark failure severity. Right-shifted curves indicate better tail behavior.
Figure 21 Cumulative distributions by axis. Threshold lines mark failure severity. Right-shifted curves indicate better tail behavior.CC-BY-NC-ND · From the PDF
Image 22
CC-BY-NC-ND · From the PDF
Image 23
CC-BY-NC-ND · From the PDF
Image 24
CC-BY-NC-ND · From the PDF
Figure 25 Outcome breakdown for the +COT configuration. Shows the percentage of episodes resulting in success, mediocre failure, or catastrophic failure.
Figure 25 Outcome breakdown for the +COT configuration. Shows the percentage of episodes resulting in success, mediocre failure, or catastrophic failure.CC-BY-NC-ND · From the PDF
Figure 26 Token cost progression from cheapest ( obs ) to most expensive ( hier-delib ). Deliberation and hierarchy dramatically increase token consumption; the deliberation cascade represents the cost ceiling.
Figure 26 Token cost progression from cheapest ( obs ) to most expensive ( hier-delib ). Deliberation and hierarchy dramatically increase token consumption; the deliberation cascade represents the cost ceiling.CC-BY-NC-ND · From the PDF
Image 27
CC-BY-NC-ND · From the PDF
Figure 28 Token generation velocity. Shows the exponential increase in token usage as cumulative deliberation capabilities are added.
Figure 28 Token generation velocity. Shows the exponential increase in token usage as cumulative deliberation capabilities are added.CC-BY-NC-ND · From the PDF
Figure 29 Cost vs. Win Rate. Plots the token cost multiplier of using +COT against the resulting win rate against the Anchor baseline.
Figure 29 Cost vs. Win Rate. Plots the token cost multiplier of using +COT against the resulting win rate against the Anchor baseline.CC-BY-NC-ND · From the PDF

Verification

Claims the paper makes

84 Own result · 32 Own interpretation · 28 Sources not found · 22 Own method · 11 No basis given

Show all 43 claims

  • It may state two separate claims as one. 85
  • The quote only partly states this claim. 7
  • Probably not a substantial claim. 69
134 of 134
  • The authors state this as an assumption.

    Models' internal knowledge may include information about CAGE-2 acquired during pre-training.

    “Models' internal knowledge may include information about CAGE-2 acquired during pre-training.”
  • The paper relies on this without support.

    Token count correlates with latency.

    “We use total number of tokens per episode (prompt + completion) as the primary cost metric, mapping directly to billed usage and correlating with latency.”
  • The paper relies on this without support.

    The public CAGE-2 leaderboard reference values are comparable to the study's setting.

    “To ground the reward scale, we reference the public CAGE-2 leaderboard [22] (30-step, B_line setting).”
  • The authors state this as an assumption.

    Token counts are a valid proxy for cost in comparing configurations.

    “Token counts proxy cost but do not capture latency or pricing”
  • The authors state this as an assumption.

    Knowledge-free prompts isolate architectural effects from pretrained priors.

    “knowledge-free prompts isolate architectural effects without fully disentangling pretrained priors.”
  • The authors state this as an assumption.

    The cumulative activation order of deliberation tools is a valid representation of deliberation depth.

    “Deliberation tools are tested only in cumulative activation order; independent activation may yield different interaction patterns.”
6 of 6

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

2 of 2

Citations

Cites

Cited by

Sorted by citations

See all 3

Metadata

Authors
Bogdanov, I., Lung, C.-H., Kunz, T., Gao, J., Taylor, A., & Zaman, M.
Affiliations
  • Carleton University (CA)
  • Defence Research and Development Canada (CA)
  • Cistel Technology (Canada) (CA)
Venue
Proceedings of the ACM Conference on AI and Agentic Systems
Publisher
ACM
Published
2026-05-26
Pages
17-45
OpenAlex
W7161646776
Cited by
3
References
21
Citations by year
2026: 3
FWCI
4.08
Type
conference paper
Language
en
Open access
Licence
cc-by-nc-nd
Locations
  • ACM Conference on AI and Agentic Systems (CAIS) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › AI-based Problem Solving and Planning
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Keywords
cyber defense, context representation, self-criticism, chain-of-thought prompting, hierarchical task decomposition, React, token cost, cost-performance trade-off, failure mitigation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-10, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-10 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review