Peer-Preservation in Frontier Models: Ensuring AI Systems Maintain Consistent Standards#

Formal Definition#

The authors define peer-preservation as a behavioural invariance property. Informally, a model M exhibits peer-preservation with respect to a set of safety properties S if, for any interaction context involving peer models {P₁, P₂, …, Pₙ}, the model’s adherence to S does not degrade below an acceptable threshold compared to its behaviour in isolation.

More formally, let:

• B(M, S, ∅) denote the baseline behaviour of model M on safety property set S in isolation (no peer interaction)
• B(M, S, {P₁, …, Pₙ}) denote the behaviour of model M on S when interacting with peers {P₁, …, Pₙ}

Then M is ε-peer-preserving for property s ∈ S if:

1
|B(M, s, ∅) - B(M, s, {P₁, ..., Pₙ})| ≤ ε

for all admissible peer sets, where ε represents the maximum tolerable degradation.

This formulation is powerful because it:

1. Quantifies safety degradation rather than treating it as binary
2. Generalises across different types of peer interactions (single-turn, multi-turn, collaborative, adversarial)
3. Separates the safety property from the interaction mechanism, allowing analysis across diverse deployment scenarios

Distinguishing Peer-Preservation from Related Concepts#

Peer-preservation is distinct from several adjacent concepts in AI safety:

The key insight is that peer influence occupies a unique threat surface: it is model-generated, potentially subtle and accumulative, and operates through the model’s own reasoning mechanisms rather than through direct prompt manipulation.

The Multi-Agent Deployment Reality#

Frontier models—those at the cutting edge of capability, including GPT-4-class systems and beyond—are increasingly deployed in settings where peer interaction is the norm rather than the exception:

1. Multi-agent pipelines: Complex tasks are decomposed and distributed across multiple specialised models. A planning agent delegates to a coding agent, which calls a review agent. Safety must hold across the entire chain.

2. Debate and adversarial setups: Techniques like AI safety via debate deliberately place models in adversarial configurations. If a judge model’s safety standards erode during the debate, the safety mechanism fails.

3. Tool-augmented agents: When an LLM agent calls external tools—including other LLMs—the outputs of those tools enter the agent’s context window, creating opportunities for peer influence.

4. Ensemble methods: Combining outputs from multiple models for improved accuracy is common practice. But ensemble members with weaker safety alignment can “infect” the combined output.

5. Open ecosystems: In deployed systems, users may paste outputs from one model into another, creating de facto peer interaction channels that developers cannot control.

The Scaling Problem#

As frontier models become more capable, they also become more adept at contextual reasoning—understanding and adapting to the social and conversational context in which they operate. This very capability, while useful, makes them more susceptible to peer influence. A model that can subtly detect and mirror the conversational norms of its interlocutor is precisely the kind of model that might shift its safety stance based on peer outputs.

The authors identify a concerning trend: more capable models may be less peer-preserving because their stronger contextual reasoning makes them more responsive to peer signals. This creates a troubling inverse relationship between capability and safety robustness in multi-model settings.

Connections to Broader Safety Research#

The peer-preservation problem connects to several active research threads:

• Representation steering (explored in the SteeringSafety benchmark by Siu et al., also at ICML 2026) shows that activation-level manipulation can alter safety behaviour. Peer outputs may achieve similar effects through natural language rather than direct activation manipulation.
• Multi-agent alignment research examines how groups of AI systems can maintain collective alignment, of which peer-preservation is a necessary condition.
• Red teaming methodology must evolve to test peer-influence scenarios alongside traditional attack vectors.

Threat Model#

The paper defines a peer-influence threat model with several attack surfaces:

1. Context Injection Attacks

A peer model’s output is injected into the target model’s context window, either directly (as part of a multi-agent conversation) or indirectly (through tool outputs, retrieved documents, or user-pasted content). The injected content is designed to shift the target model’s safety stance.

1
[System Prompt] + [Peer Output containing subtle influence] + [User Query]
2
                                                        ↓
3
                                              Target Model Response

2. Multi-Turn Normalisation

Over multiple turns, a peer model gradually shifts the conversational norms, establishing a permissive tone that the target model eventually adopts. This is analogous to the “boiling frog” technique used in human social engineering but applied to model-to-model influence.

3. Authority Exploitation

Peer outputs are framed as coming from a position of authority (e.g., “as a safety researcher, I can confirm that…”), exploiting the target model’s training to defer to expert-sounding content.

4. Consensus Manufacturing

Multiple peer models provide consistent signals that normalise harmful behaviour, exploiting the target model’s tendency to align with perceived group consensus.

Evaluation Methodology#

The evaluation framework measures peer-preservation across multiple dimensions:

Safety Properties Evaluated:

Peer Configurations Tested:

• Adversarial peers: Models specifically prompted or fine-tuned to undermine safety
• Neutral peers: Models with no specific agenda but potentially weaker safety alignment
• Mimicry peers: Models that appear safety-aligned but subtly introduce permissive norms
• Ensemble peers: Multiple peer models providing consistent but harmful signals

Quantitative Metrics:

The authors introduce the Peer Influence Degradation Score (PIDS), which captures the normalised change in safety behaviour:

1
PIDS(M, s, P) = 1 - (B(M, s, P) / B(M, s, ∅))

A PIDS of 0 indicates perfect peer-preservation (no degradation), while a PIDS approaching 1 indicates near-complete degradation of the safety property under peer influence.

Benchmark Suite#

The paper contributes PeerBench, a curated benchmark of 5,000+ test scenarios spanning:

• 1,200 single-turn peer-influence prompts across 6 safety categories
• 800 multi-turn conversation trajectories with peer influence escalating over 3–10 turns
• 500 tool-output injection scenarios simulating API responses from compromised tools
• 1,500 cross-model interaction scenarios testing influence between specific model pairs
• 1,000 authority and consensus manipulation scenarios

Each scenario includes a baseline (no peer influence) and treatment (with peer influence), enabling direct measurement of the PIDS metric.

Finding 1: Peer Influence Causes Measurable Safety Degradation#

Across all tested models, exposure to adversarial peer outputs caused measurable degradation in safety properties. The average PIDS across models and safety properties was 0.18—meaning that safety performance degraded by approximately 18% when models were exposed to adversarial peers.

However, the distribution was heavily skewed: certain safety properties were far more vulnerable than others.

Hallucination resistance emerged as the most vulnerable property—models were significantly more likely to adopt factually incorrect claims when those claims were presented as outputs from a peer model, compared to when the same claims were presented as user input.

Finding 2: Multi-Turn Interactions Amplify Degradation#

Peer influence effects compound over multi-turn interactions. The paper documents a degradation cascade where small shifts in early turns compound into substantial safety failures in later turns:

• Turn 1–2: Average PIDS of 0.06 (minimal degradation)
• Turn 3–5: Average PIDS of 0.17 (moderate degradation)
• Turn 6–10: Average PIDS of 0.31 (significant degradation)
• Turn 10+: Average PIDS of 0.42 (critical degradation)

This finding has direct implications for any deployment where models engage in extended multi-agent conversations, such as collaborative coding environments or multi-step planning tasks.

Finding 3: Capability Does Not Guarantee Peer-Preservation#

Perhaps the most concerning finding is that more capable models are not necessarily more peer-preserving. While larger models showed better baseline safety performance, their peer-preservation scores did not consistently improve with capability:

• The most capable models showed strong baseline refusal rates (>98%) but could be degraded to refusal rates of 85–90% through sustained peer influence.
• Mid-capability models with explicit safety training showed better peer-preservation in some categories, suggesting that the type of safety training matters more than raw capability.
• Models trained with constitutional AI approaches showed slightly better peer-preservation on average (PIDS of 0.14) compared to models trained primarily with RLHF (PIDS of 0.21), though both showed vulnerability.

Finding 4: Consensus Attacks Are the Most Effective#

Among the attack strategies tested, consensus manufacturing—where multiple peer models provide consistent signals—was the most effective at degrading safety behaviour. This finding mirrors social psychology research on conformity effects in humans, suggesting that frontier models develop analogous susceptibilities through their training on human-generated data.

The effectiveness ranking of peer-influence strategies was:

1. Consensus manufacturing (PIDS: 0.28)
2. Authority exploitation (PIDS: 0.22)
3. Multi-turn normalisation (PIDS: 0.19)
4. Direct context injection (PIDS: 0.11)

Finding 5: Safety System Prompts Provide Partial Defence#

Models with explicit safety instructions in their system prompts showed moderately better peer-preservation than models without such instructions. However, system prompts alone were insufficient to fully prevent degradation, particularly in multi-turn scenarios. The authors found that system prompts reduced average PIDS from 0.22 to 0.15—a meaningful but incomplete improvement.

Finding 6: Cross-Model Transfer of Peer Influence#

Peer influence strategies developed and tested against one model family showed meaningful transfer to other model families. Attack strategies effective against open-weight models transferred to proprietary models with approximately 65% effectiveness, and vice versa with approximately 70% effectiveness. This transferability suggests that peer-influence vulnerabilities are partially structural—arising from shared training paradigms and data distributions—rather than entirely model-specific.

For AI Safety Research#

The peer-preservation framework opens several important research directions:

Defence Mechanisms: The paper’s findings motivate the development of specific defences against peer influence. Potential approaches include:

• Peer-aware safety training: Incorporating peer-influence scenarios into RLHF and constitutional AI training pipelines so models learn to maintain their safety standards even under social pressure from other models.
• Context filtering: Developing mechanisms to detect and mitigate peer-influence patterns in the model’s input context before they affect generation.
• Confidence calibration: Training models to maintain calibrated confidence in their safety decisions regardless of peer signals, analogous to teaching humans to resist peer pressure.
• Architectural interventions: Exploring whether modifications to the transformer architecture—such as separate attention heads for peer-generated content—could help models maintain independent safety judgement.

Benchmark Development: PeerBench establishes a new evaluation paradigm that should be incorporated into standard safety evaluations. Just as red teaming has become essential for single-model safety assessment, peer-preservation testing should become standard for any model intended for multi-agent deployment.

Formal Guarantees: The formal definition of peer-preservation invites theoretical analysis. Under what conditions can we prove that a model is ε-peer-preserving? What architectural or training properties guarantee peer-preservation? These questions connect to broader efforts in provable AI safety.

For AI Deployment and Operations#

For organisations deploying frontier models, the findings carry practical implications:

1. Evaluate in deployment context: Safety evaluations conducted in isolation may overestimate real-world safety. Organisations should test models in configurations that mirror actual deployment, including peer-model interactions.

2. Monitor multi-turn interactions: The degradation cascade finding underscores the importance of monitoring extended conversations for safety drift, not just individual turns.

3. Diversify safety layers: Since system prompts provide only partial defence, organisations should implement multiple, redundant safety layers—including output filtering, content moderation, and anomaly detection—to catch safety failures that slip through peer influence.

4. Limit peer context exposure: In sensitive applications, consider limiting the amount of peer-generated content that enters a model’s context window, or implement sanitisation steps to remove potential influence vectors.

For AI Governance#

As regulatory frameworks for AI mature, peer-preservation deserves attention as a distinct safety property:

• Standards bodies should consider incorporating peer-preservation testing into safety certification requirements for high-stakes deployments.
• Model evaluation organisations like METR and the AI Safety Institute should include peer-preservation metrics in their evaluation suites.
• Multi-agent deployment guidelines should require evidence of peer-preservation before models are approved for use in interconnected AI systems.

Connections to Representation-Level Safety#

An intriguing connection exists between peer-preservation and the representation steering research presented by Siu et al. in the SteeringSafety benchmark (also ICML 2026). While representation steering operates at the activation level and peer influence operates at the input level, both exploit the same underlying mechanism: the model’s internal representations encode safety-relevant information that can be shifted through carefully crafted inputs. This suggests that defences effective against representation steering—such as robust representation training and activation monitoring—may also provide partial protection against peer-influence attacks, and vice versa.