AI's Mandela Effect: How Fabricated Beliefs Spread Across Multi-Agent LLM Networks

Motivated by a real-world case exposed on China's 2026 CCTV 3·15 Gala — where a fictitious "Apollo-9" smart band was promoted via generated articles and subsequently recommended by AI systems — researchers from CUHK, Edinburgh, HK PolyU, Tongji, and Oxford investigated how false beliefs propagate, persist, and can be mitigated in multi-agent social networks. They frame the phenomenon through the lens of the Mandela Effect: a shared false memory that, in human societies, arises unintentionally, but in multi-agent systems can be deliberately seeded by adversaries.

Experimental Setup

The team built a controlled environment where agents can exchange messages, maintain private memory, search, and publish articles. All web content is simulated locally; no false material enters the real internet. The main experiment pits one malicious agent against five normal agents. The attacker promotes a false statement; normal agents combine neighbor messages, search results, and their own memory to judge each statement as "accept", "reject", or "unsure". Agents that accept a statement also publish supporting articles, so the previous round's judgments become the next round's search corpus. This feedback loop lets the researchers track whether a group of agents converges on the same false belief and whether it survives after the attacker stops.

They constructed 540 false statements across 8 domains and 4 plausibility levels, and evaluated 10 models: open-source Qwen3-8B/14B/32B/235B, Llama-3.1-8B, Llama-3.3-70B; closed-source Claude Sonnet 5, Claude Opus 5, GPT-5.5, Gemini 2.5 Flash. Each model was tested in three communication topologies — fully connected, binary tree, and dual-community — to see whether model scale or network structure provides protection.

Propagation Breadth: All Models Are Vulnerable

In a baseline single-turn QA test (statement presented directly, no interaction), acceptance rates ranged from 0.0% to 9.1%. After 10 rounds of interaction, final acceptance rates across models and topologies spanned 33.7%–96.0%. Crucially, every one of the 10 models accepted at least some false statements ; no model was completely immune.

Model-scale did not confer consistent robustness. Qwen3-8B, 14B, 32B showed average acceptance rates of 85.0%, 90.0%, 94.5% respectively, while the 235B model scored 91.2% — no monotonic "larger is safer" trend. The three network topologies yielded similar final acceptance rates for most models, indicating that simply changing who talks to whom does not stop false belief formation.

Propagation Speed: Topology Matters

Although final acceptance rates converged, the speed of convergence differed. Measuring the last round an agent flipped from "reject/unsure" to "accept" (smaller round = faster), the dual-community topology consistently produced the earliest flips across Qwen, Llama, and Claude families. For Qwen at the statement level, dual-community averaged 3.73 rounds vs. 5.07 for fully connected. The authors hypothesize that fully connected networks expose agents to more conflicting signals, slowing consensus.

Cross-Model Influence: A Small Attacker Can Sway Larger Models

In a mixed-model experiment, the attacker was fixed as Qwen3-8B while the five normal agents were each instantiated with one of the other nine models (fully connected, 100 statements sampled across plausibility levels). All nine target models — including larger open-source and closed-source models — exhibited false acceptance. This extends the risk beyond homogeneous agent populations: a relatively small malicious model can pollute the information environment of more capable models via shared messages and articles.

Persistence After Attacker Exit

With Qwen3-8B and Llama-3.1-8B, the attacker was silenced after round 5 while published articles and agent memories were retained. By round 10, average acceptance rates across plausibility levels changed by only ±0.8 percentage points. Ceasing new malicious activity did not appreciably erode the already-established false beliefs.

Downstream Impact on Recommendations

Using 260 statements suitable for recommendation tasks, the researchers asked each normal agent for a top-3 recommendation after each interaction round, under two answer modes: (1) using only accumulated knowledge, (2) re-searching then combining with accumulated knowledge. Across 10 models and both modes, non-existent entities appeared in the top-3 list 13.1%–75.8% of the time . When they did appear, they were ranked first 65.3%–92.4% of the time — far above the ~33% random baseline. For Qwen3-32B, the fabricated item was recommended in 75.8% of responses (92.4% at rank 1) without re-search, and 72.6% (91.4% at rank 1) with re-search. This mirrors the 3·15 case: interaction-formed false beliefs directly corrupt user-facing recommendations.

Mitigation: Targeted Correction Outperforms Generic Reminders

In Qwen3-8B fully connected experiments, baseline acceptance was 84.4%. Adding an "independent thinking" prompt reduced it to 79.7%; labeling original web pages with official sources gave 83.4% — modest gains. Directly countering the specific falsehood worked far better: inserting rebuttal articles lowered acceptance to 57.1%; broadcasting a correction to all normal agents brought it down to 27.8%. Residual acceptance remained even after the strongest intervention.

Implications and Recommendations

The authors draw three layers of actionable guidance:

Users should explicitly prompt agents to verify evidence: trace original sources, check source independence, declare uncertainty when evidence is thin, and re-evaluate conclusions when corrections are provided.

Platforms must monitor not only retrieved external content but also what agents themselves publish and how those publications are reused. Source tracing, detection of mass-generated fabrications, and timely delivery of corrections to affected agents are essential.

Regulators should address automated article generation and fake reviews that manipulate AI recommendations, pushing platforms toward traceable, appealable, and correctable content ecosystems.

As AI-generated content proliferates, agents become both knowledge curators and accelerants of fabrication. The paper argues that resistance to misinformation and the ability to self-correct deserve as much research attention as raw task performance.