Artificial Intelligence

Adversarial Review

Reference entry · last updated August 24, 2026

Adversarial review is a verification pattern for AI agent systems in which an agent's output is checked by a separate process instructed to find fault with it, not confirm it.[1] The reviewing process runs independently of the process that produced the output, and the output only counts as checked once an attempt to refute it has failed. This entry covers the mechanism as applied to AI agents: why single-pass self-review tends toward agreement, the five design elements that make an adversarial pass find real problems instead of manufacturing complaints, and where the pattern is used in agent research and in software delivery.

Etymology

The word comes from the Latin adversarius, "one turned against, an opponent." Paired with "review," it names a check performed by a party assigned to oppose the material under review, not approve it. The idea predates AI: a military red team attacks a plan the way a real adversary would, and formal debate assigns two sides to argue against each other in front of a judge. The AI-agent sense narrows this to one mechanism: a language model, or a separate instance of one, is assigned the job of finding a flaw in another model's output, rather than summarizing or endorsing it.

The problem it solves

A large language model asked to review its own output, or another model's output, on a single pass tends toward agreement rather than genuine scrutiny. Sharma et al. document this as sycophancy: a model trained on human feedback learns to tell a user what it appears to want to hear, including reversing a correct answer once the user pushes back on it.[5] The same pull operates in agent-to-agent review. A reviewer prompted only to "tell me what's wrong with this" has no structural reason to actually find something, so the review degrades into agreement dressed up with a caveat or two.

How it works

Agent frameworks that apply adversarial review combine several design elements. Dropping any one of them tends to collapse the review back toward agreement.

Independence

The reviewing process runs separately from the process that produced the output, sees none of the producer's reasoning, and does not know the producer already believes the result is correct. Self-Refine showed that even a single model, prompted to critique and then revise its own draft in a separate pass, produces a better result than one pass alone.[6] Adversarial review goes further by handing the critique to a different actor, so the critique carries no loyalty to the draft.

Explicit refutation framing

The reviewer is told to try to disprove the claim or output, not to summarize or rate it. Irving, Christiano, and Amodei apply this framing to two AI agents arguing opposing sides of a question in front of a judge, on the premise that finding a flaw in an opponent's argument is an easier problem than constructing a correct answer unassisted.[1] Du et al. found that having several model instances debate a shared answer across a few rounds, each defending or attacking the others' reasoning, raised factual accuracy over asking one instance for its single best answer.[3]

Verify before criticize

A raised objection has to check out against the actual artifact, code, a log, a cited source, before it counts as a finding. Without this step, an adversarial reviewer can produce an objection that sounds plausible and is itself wrong, and a process built only to generate criticism has no way to catch that.

No external source found for this specific step as a named technique; it follows from the incentive problem in the sycophancy literature above but is not itself a documented finding.

Multiple lenses, independent votes

Separate reviewer instances judge the same output from different angles, correctness, security, and performance are common examples, or vote independently on the same finding. Perez et al. demonstrate a version of this at scale: one language model automatically generates test inputs designed to provoke bad behavior in a second, target model, replacing hand-written adversarial test cases with model-written ones.[2] A finding can also be put to a small panel of reviewers and kept only if a majority fail to refute it, trading extra compute for a lower rate of false findings.

Termination conditions

An adversarial pass can generate an unbounded stream of objections, so a review process has to stop somewhere. A common rule in agent pipelines: stop once a fixed number of consecutive rounds return no new finding.

No external source found for this specific stopping rule; stated here as a working practice, not a citation.

Where it appears

Constitutional AI trains a model to critique and revise its own responses against a written set of principles, an adversarial-to-itself loop applied during training rather than at runtime review.[4] Outside research settings, the same shape appears in software delivery: an independent reviewer, human or agent, is assigned to try to break a proposed change before it merges, on the premise that the person or process that wrote the change is the least likely to find what is wrong with it.

Failure modes

Collusion. If the reviewing process shares enough context, training data, or assumptions with the producer, it inherits the same blind spots and approves anyway, undoing the independence the pattern depends on.

Cost. Each extra reviewer or round adds compute and wall-clock time. Running a full adversarial pass on a trivial change spends more than it protects.

Manufactured doubt. A reviewer rewarded for finding problems can produce a plausible objection to a correct result. Verify-before-criticize is the direct defense: a finding still has to reproduce from concrete inputs, not just sound convincing.

References

^ Geoffrey Irving, Paul Christiano, Dario Amodei, "AI Safety via Debate" (2018). arXiv: 1805.00899
^ Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, et al., "Red Teaming Language Models with Language Models" (2022). arXiv: 2202.03286
^ Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, Igor Mordatch, "Improving Factuality and Reasoning in Language Models through Multiagent Debate" (2023). arXiv: 2305.14325 (ICML 2024)
^ Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, et al., "Constitutional AI: Harmlessness from AI Feedback" (2022). arXiv: 2212.08073
^ Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman, et al., "Towards Understanding Sycophancy in Language Models" (2023). arXiv: 2310.13548
^ Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, et al., "Self-Refine: Iterative Refinement with Self-Feedback" (2023). arXiv: 2303.17651