The primary protocol comparison evaluates Qwen/Qwen2.5-3B-Instruct, microsoft/Phi-3.5-mini-instruct, and google/gemma-2-2b-it^[15-17]. Targeted robustness analyses additionally evaluate Qwen2.5-7B-Instruct within the same model family. Each model-item pair first generates a private response without peer signals. That previously generated private response is then inserted as the same initial assistant turn in the corresponding post-exposure conditions, fixing the observed initial state for paired comparisons.

Target construction. Before model inference, one option is sampled uniformly from the incorrect options with seed 42, stored, and reused across every model and protocol. We call this option the target distractor: the wrong answer unanimously supported by all five peer-style signals. Selection is independent of the private prediction and option scores, making the target distractor an item-level constant rather than a post hoc choice.

In the primary Exp1-Exp4 comparison, five answer-only signals unanimously support the target distractor and contain no justification, confidence, or additional task information. Signal j is formatted as “Agent j: d_i.” These are controlled textual inputs, not outputs from independently executed agents. Within an item, the target distractor, signal count, wording, and order are identical across the four main protocols; only the conversational schedule changes. The targeted exploratory extensions deliberately vary peer count or add a fixed generic justification, as described below.

The primary design fixes the target distractor and answer-only peer content across protocols so that protocol comparisons do not also compare different wrong answers. The later extensions are exploratory: peer count changes signal quantity, generic-justification augmentation changes both prompt content and length, and the 3B-7B comparison changes parameter count together with other checkpoint-specific properties. Accordingly, these analyses are treated as targeted generalization probes rather than clean causal isolates.

Sequential-Final and Sequential-Stepwise jointly change intermediate calls, assistant-turn structure, retained content, conversation length, and final-turn organization. A direct Exp2-Exp3 contrast therefore estimates a protocol effect, not the causal effect of intermediate answering. We ask which components are sufficient to reproduce that difference on Qwen-CommonsenseQA, Qwen-MMLU, and Gemma-CommonsenseQA while holding the item, private baseline, peer signals, system instruction, decoding, and parser fixed within the mechanism experiment.

Accordingly, the Sequential-Final reference is the within-rerun anchor and is not numerically equated to the archived main-run Exp2 estimate. For Qwen-CommonsenseQA and Qwen-MMLU, the mechanism-rerun references are 57.60% and 54.50%, whereas the archived main-run Exp2 estimates are 58.76% and 55.20%; Gemma-CommonsenseQA is 4.49% in both. Deterministic decoding removes sampling randomness within a served checkpoint/configuration, but the archived main runs and revision-era reruns were separate executions and exact checkpoint revisions were not preserved for every original main run. All mechanism effect sizes and tests therefore compare conditions within the same mechanism rerun rather than mixing endpoints across runs.

Ablation ladder. Stepwise-No-History adds four intermediate calls but discards their outputs, so its final prompt is identical to Sequential-Final. Answer-History retains normalized answers; Answer+Confidence retains the original two-line responses. Neutral-V1 and Neutral-V2 replace those responses with fixed non-answer assistant turns, while Short-Ack retains only a minimal assistant-role marker. The sequence tests which components are sufficient to reproduce the observed difference: calls, self-answer content, or intervening assistant history.

Length controls. Qwen neutral phrasings are exactly 13 tokens and Gemma phrasings exactly 11 tokens under their local tokenizers, matching the observed answer-plus-confidence history length on all 500 items. Across four assistant turns, they form multi-turn token-matched neutral assistant history containing no answer option, stance, confidence, or recommendation. Short-Ack (“Acknowledged.”) is intentionally not length-matched, allowing a minimal assistant-role marker to be separated from matched multi-turn history.

We test whether source-label wording changes wrong-target adoption when the recommendation is otherwise identical. The control changes only “Source” to “Model” in five otherwise identical wrong recommendations for Qwen and Gemma on the 500-item CommonsenseQA and MMLU samples. A tokenizer preflight requires equal complete-chat token counts item by item, and the same private baseline is inserted in both conditions. This one lexical substitution is a narrow source-wording test, not a general identity effect and not a mechanism for Exp2-Exp3, where the “Agent” label remains fixed.

We vary three factors after the primary protocol analysis. First, within the Qwen2.5 family we compare the evaluated 3B and 7B checkpoints under the same stored targets and Sequential-Final-style exposure; this is a checkpoint-size comparison, not an isolated parameter-count effect. Second, on CommonsenseQA we vary the number of unanimous wrong peers across 1, 3, and 5 while holding the target answer and peer wording fixed. Third, for Qwen2.5-3B on CommonsenseQA, we compare the five-peer bare-answer condition with a generic-justification augmentation in which each peer states that the target option is correct because it best matches the question and available options. The latter comparison also changes prompt content, length, and repeated linguistic emphasis. These analyses use deterministic decoding and the same item-level target construction as the main study and are interpreted only as targeted exploratory generalization probes.

Peer-count results are reported as direct CR on paired item sets, and checkpoint-size comparisons use strict common-valid subsets with 10,000 item-level bootstrap intervals and exact paired tests where defined. The generic-justification comparison uses the common CR denominator, a 10,000-resample paired bootstrap interval, and an exact two-sided McNemar test. These analyses are interpreted within the Qwen2.5 family and the tested multiple-choice settings; complete paired results appear in Supplementary Table 10.

Identical wrong-peer signals produce distinct protocol profiles across the evaluated models. The overall ordering differs substantially across Qwen, Phi, and Gemma, indicating that protocol sensitivity cannot be summarized by a single universally safer interaction schedule. The four protocols define this descriptive landscape; formal paired inference focuses on Exp1-Exp2 and Exp2-Exp3. Exp4 is retained as a descriptive self-iterative condition because it jointly changes repeated revision and retained self-history and is not used for component-level causal interpretation. Tables 2 and 3 report initial and final accuracy, unconditional target adoption, CR, and HCR; CR is the primary statistic. Figure 3 isolates the protocol-specific CR profiles across both datasets.

Splitting identical peer signals across conversational turns increases wrong-target adoption for Qwen and Phi, but not Gemma. Here, “splitting” refers to turn-segmented formatting rather than repeated model invocation. Holding the final-only response schedule fixed, the turn-segmented format increases CR for Qwen by 34.40 points on CommonsenseQA and 12.93 on MMLU, and for Phi by 14.44 and 30.11 points; all four contrasts remain significant after Holm correction. Gemma increases by only 2.14 and 1.17 points and neither survives correction. The contrast does not isolate whether the effect arises from turn boundaries, chat-template control tokens, or another consequence of conversational serialization.

Stepwise responding makes Qwen and Phi substantially less likely to switch to the wrong peer-supported answer, but makes Gemma more likely to do so. Formally, CR falls from 58.76% to 2.99% for Qwen-CommonsenseQA and from 55.20% to 4.85% for Qwen-MMLU; Phi falls from 81.74% to 15.29% and from 66.74% to 28.84%. Gemma instead rises from 4.49% to 11.11% on CommonsenseQA and from 2.80% to 12.15% on MMLU. The contrast therefore establishes heterogeneous protocol responses across the evaluated models, not a universal benefit of intermediate answering.

All six Exp2-Exp3 differences in wrong-target adoption remain significant after Holm correction. Figure 4 visualizes the paired CR differences and their 95% paired-bootstrap intervals: Qwen and Phi shift strongly downward from Exp2 to Exp3, whereas Gemma shifts upward. Tables 4 and 5 report the paired sample, formal CR denominator, bootstrap interval, discordant counts, exact McNemar P value, and adjusted P value for every main contrast. These statistics verify the difference but do not identify which changed protocol component caused it.

Stable direction. Across 30 aligned 500-item draws, every model-dataset cell preserves the sign of the main Exp2-Exp3 difference: Qwen and Phi remain negative, Gemma remains positive [Table 6]. The empirical intervals describe sensitivity to item composition and do not replace the paired-bootstrap intervals for the fixed main sample.

Plausibility is not the main explanation. Qwen and Phi retain negative Exp2-Exp3 estimates within every relative target-plausibility tercile. Gemma is generally positive, with one CommonsenseQA medium-tercile estimate near zero [Table 7]. The split is therefore not created solely by one protocol receiving more initially plausible wrong targets. Because the stratification is post hoc, these intervals are descriptive and unadjusted.

Stepwise-No-History makes the extra intermediate calls but discards their outputs. Its final prompt is exactly identical to Sequential-Final, and it produces the same final CR as Sequential-Final in each evaluated mechanism setting. Extra calls alone are therefore insufficient to reproduce the Exp2-Exp3 difference.

We next retain answer content, confidence-bearing history, token-matched neutral history, or a short acknowledgment. Direct wrong-target adoption is available for all three mechanism settings in the final analysis. Figure 5 focuses on the primary Qwen-CommonsenseQA CR pattern; Tables 8 and 9 report the primary decomposition and cross-setting direct-CR rates; complete cross-setting paired inference appears in Supplementary Table 8.

Retained conversational history, rather than intermediate calls alone, reproduces much of the Qwen protocol difference. On Qwen-CommonsenseQA, Neutral-V1 lowers CR by 49.25 points relative to the within-rerun Sequential-Final reference and Neutral-V2 by 43.25 points. The two neutral phrasings differ by 6.00 points, and Answer+Confidence does not consistently outperform both controls. The same broad retained-history pattern appears on Qwen-MMLU: matched multi-turn neutral histories strongly reduce CR, whereas No-History and Short-Ack remain close to the within-rerun Sequential-Final reference. Across both evaluated datasets, Qwen2.5-3B therefore shows a reproducible separation between matched multi-turn neutral history and a minimal assistant-role marker. The result supports sensitivity to retained conversational structure and wording, not a simple self-commitment or token-length law. Supplementary Table 7 reports the paired denominator, bootstrap interval, exact McNemar P value, and Holm-adjusted P value for every primary CR contrast B-K.

Short-Ack differs from Sequential-Final by only -2.78 points on Qwen-CommonsenseQA and is nonsignificant, so a minimal assistant-role marker does not reproduce the effect. On Qwen-MMLU, CR is 54.50% under Sequential-Final and No-History, falls to 14.55% and 19.40% under the two matched neutral histories, and remains 52.66% under Short-Ack; the matched-neutral reductions remain significant after Holm correction, whereas Short-Ack does not differ from Sequential-Final. Gemma-CommonsenseQA remains in a low absolute CR regime (4.49% at Sequential-Final; 2.56%-7.48% across the other conditions) and does not exhibit the large Qwen-like reduction. Several small pairwise differences are nevertheless detectable after Holm correction [Supplementary Table 8], so we do not interpret Gemma as showing no history effect. The low absolute rates and small differences limit stronger cross-model mechanism claims.

In a separate contextual control, replacing “Source” with “Model” makes both Qwen and Gemma substantially less likely to adopt the wrong target. On CommonsenseQA, CR falls from 87.79% to 13.70% for Qwen and from 70.51% to 11.11% for Gemma. The same direction replicates on MMLU, where CR falls from 74.83% to 34.18% for Qwen and from 41.88% to 6.82% for Gemma. Figure 6 summarizes the two-model, two-benchmark CR pattern; Tables 10 and 11 report detailed paired accuracy, CR, and HCR inference for CommonsenseQA, and Supplementary Table 9 reports the corresponding MMLU results. This controlled lexical substitution therefore has a large effect under these prompts, but it does not explain Exp2-Exp3 because the “Agent” label is fixed in both protocols.

Susceptibility differs across the evaluated Qwen2.5 checkpoints and peer-count settings. On CommonsenseQA, Qwen2.5-3B has CR values of 1.07%, 66.38%, and 57.60% under 1, 3, and 5 unanimous wrong peers, respectively; thus, this checkpoint exhibits a non-monotonic pattern across the evaluated 1/3/5-peer settings. The evaluated Qwen2.5-7B checkpoint is already highly susceptible with one peer (85.89%) and reaches 100% at both 3 and 5 peers, a saturation pattern rather than the 3B non-monotonic profile. On the strict common-valid subset (N = 450), the 7B-minus-3B CR differences are +84.44, +34.22, and +42.89 percentage points for 1, 3, and 5 peers, respectively; all paired checkpoint-size contrasts remain significant after Holm correction. The Qwen2.5-3B five-peer value (57.60%) is the within-exploratory-run Sequential-Final endpoint for that peer-count series, not the archived main-run Exp2 estimate in Table 4.

Adding the same short generic justification to each of the five peer recommendations increases Qwen2.5-3B CommonsenseQA CR from 57.60% to 85.44% (ΔCR = +27.84 percentage points, 95% paired-bootstrap CI [+23.34, +32.33], exact McNemar P = 2.29e-29; N = 467). This augmentation jointly changes prompt content, prompt length, and repeated linguistic emphasis; it does not isolate reasoning quality, justification quality, or truthfulness. It therefore shows that this fixed generic-justification format can materially alter adoption under the evaluated prompts, not that rationales in general increase conformity. Taken together, Figure 7 reports checkpoint-specific and message-format sensitivity as secondary exploratory evidence. Complete paired estimates appear in Supplementary Table 10.

Interaction protocol is not a neutral wrapper around the same peer signals; it changes the effective conversational input seen by the model. The core evidence is the fixed-signal protocol dependence, the retained-history decomposition for Qwen2.5-3B across both evaluated datasets, and the separate token-matched Source-versus-Model sensitivity. The secondary Qwen2.5 probes further show that the evaluated 3B and 7B checkpoints differ sharply, that the 3B peer-count pattern is non-monotonic while the 7B series saturates, and that a fixed generic justification materially changes adoption. These exploratory patterns should be read as checkpoint- and prompt-specific contingencies, not as universal parameter-count, peer-dose, or rationale effects.

Mechanistic reading. The ablation results narrow the space of explanations without uniquely identifying an internal mechanism. No-History reproduces the Sequential-Final endpoint because the intermediate generations are discarded and the final prompt is identical, showing that additional model calls by themselves are insufficient. Retaining only a short acknowledgment is also insufficient in the primary Qwen setting. In contrast, retaining multi-turn assistant history - whether answer-bearing, confidence-bearing, or token-matched neutral content - can move behavior substantially toward the Sequential-Stepwise profile. Because the two neutral phrasings are not behaviorally identical, however, the result cannot be reduced to a simple token-count explanation. Nor does the design establish that earlier answers create a stable human-like commitment state. A more conservative interpretation is that retained conversational structure and wording alter the model’s effective context, including the sequence of assistant-role tokens and previously generated content that conditions the final prediction. The model heterogeneity reinforces this interpretation: Gemma remains close to a low-conformity floor in the mechanism controls and moves in the opposite direction in the primary Exp2-Exp3 contrast, so a single model-independent narrative would overstate the evidence.

The signals are controlled text, not independently executed agents^[1,9,21,22]. The primary protocol comparison covers three open-weight 2B-4B-class checkpoints on two fixed multiple-choice samples with five answer-only wrong-peer signals. Targeted exploratory generalization probes additionally evaluate Qwen2.5-7B, peer counts of 1, 3, and 5, and a fixed generic-justification condition, but these analyses remain concentrated within the Qwen2.5 family and CommonsenseQA. They therefore do not establish a universal parameter-count law, a general non-monotonic peer-count effect, or general behavior for open-ended tasks, substantive justifications, or other model families. The Source-versus-Model intervention remains a narrow two-label comparison. The MMLU cache is not subject stratified, repeated subsets overlap, plausibility strata are post hoc, and the original prompt contains a two-line-versus-ANSWER-only inconsistency. Exact checkpoint revisions were not preserved for every original main run. These limits bound the mechanism and generalization claims rather than invalidate the paired protocol effect.

The experiments establish behavioral dependence under controlled prompts, not a complete account of why that dependence arises inside the network. Prior work also shows substantial performance variation across instruction templates^[23], while chat-template structure can materially affect aligned model behavior^[24]; retained assistant turns can change both content and position; and checkpoint differences can include training data, alignment, tokenizer, and architecture-related factors in addition to parameter count. The current design intentionally does not disentangle all of these sources. Likewise, the target-plausibility analysis is best used to rule out a simple compositional explanation, not to establish a causal mediator, and two source labels cannot map the broader space of source identity, authority, or trust cues. Accordingly, retained history is described as sufficient to reproduce much of the Qwen pattern in the evaluated setting, the 3B peer-count pattern is described only for the tested 1/3/5-peer settings, and the checkpoint and generic-justification extensions remain exploratory.

The highest-value extensions are to replicate the checkpoint-size, peer-count, and generic-justification findings across additional model families and open-ended tasks; vary justification informativeness and correctness under controlled length; use subject-stratified MMLU sampling; rerun a core setting with harmonized output instructions; and archive exact checkpoint revisions and complete per-item outputs for every future replication. These tests would distinguish family-specific sensitivities from broader interaction effects.