← ELI5 · Nestor G Pestelos Jr

Adversarial Review

One agent should not grade its own homework.

Have a second agent try to prove it wrong instead.

Same agent, same blind spot.

self-review
Agent Answer Same agent checks its own work Always: "looks good"
adversarial review
Agent Answer A different agent told to disagree Found: off-by-one

The agent that wrote the answer already believes it. Asking it to check its own work rarely finds anything.

Why the same agent misses it
  • The agent's own reasoning produced the answer, so that same reasoning tends to approve it.
  • A second agent brings a fresh pass with no stake in the first answer being right.
  • The bug above is a made-up example, to show the shape of the idea, not a real incident.

Tell it to disagree, not to summarize.

vague ask

"Check this."

Result: "Looks fine."

adversarial ask

"Try to break this. Only report what you can prove."

Result: "Off-by-one on the last row."

A reviewer only asked to check something tends to agree. A reviewer told to break it tends to try.

What the instruction has to do
  • The reviewer needs a job that only succeeds if it finds something wrong.
  • Agreement with no real problem found should feel like a failed search, not a pass.

A complaint only counts once it's checked.

Claim: off-by-one on row 5 Run it. Does it break? Yes, it broke. No, it held.

Sounding right and being right are not the same thing. Verify before you count it.

Why this step exists
  • An adversarial reviewer can write a plausible objection that turns out to be wrong.
  • Only a checked objection, run against the actual code, log, or source, is a real finding.

Ask a few skeptics, not one.

1 2 3 ✓ ✓ ✗ 2 of 3 say real. Keep it.

One skeptic can be wrong. A few agreeing is harder to fool.

How many rounds is enough
  • An adversarial pass can generate objections forever if nothing tells it to stop.
  • A common rule: stop once a few rounds in a row turn up nothing new.
  • Each extra skeptic or round costs time and compute, so this only pays off for a change worth the scrutiny.

Sources: Ethan Perez et al., "Red Teaming Language Models with Language Models," 2022 (using one model to find failures in another). Mrinank Sharma et al., "Towards Understanding Sycophancy in Language Models," 2023 (why a single reviewing pass tends to agree; more at Reference: Sycophancy). Longer, more technical version: Reference: Adversarial Review (Agents).

Back to top