Three Models Agreed. It Was Still Wrong.

Cross-model review — asking a second and third AI model to check the first one’s work — has become a default verification habit in engineering and content teams, and it rests on one intuition: if independently built models from different vendors converge on the same answer, the answer is probably right. The intuition borrows its authority from statistics, where independent measurements really do compound. The problem is the word independent.

Large language models are trained on heavily overlapping corpora, with similar architectures, similar post-training recipes, and in some cases the same synthetic data generated by each other. When they err, they often err in the same direction — and peer-reviewed work has now measured exactly how often. A study accepted to ICML 2025 found that when two models both get a question wrong, they frequently converge on the same wrong answer. Unanimity, in other words, can be a symptom of shared blind spots rather than a certificate of truth.

This post lays out the evidence — carefully separated into peer-reviewed results and preprint findings — then maps six verification setups against what the literature actually tested, and closes with the reconciliation method we use: independent briefs, forced refutation, deliberate minority-checking, and hash-verified read-only reviews.

We have covered the consensus category ourselves, twice, and both posts are worth holding in tension with this one. Our March 2026 piece on a platform built entirely on the consensus premise relayed the vendor’s claim that querying ten-plus LLMs simultaneously with weighted voting reduces hallucination rates by up to 73%. Our April 2026 guide to tools that fuse multi-model output into one answer carried a similar shape of claim: in the vendor’s testing, Deep Research agents preferred the fused outputs to their own responses — a 100% preference figure.

Neither product category is fake. Multi-model query and fusion tools exist, and breadth of coverage is a real benefit — different models genuinely surface different considerations. The problem is narrower, and it is the entire subject of this post: both headline numbers are vendor-stated, with no disclosed methodology. A 73% hallucination-reduction figure without an error-correlation control does not tell you whether ten models voting is ten independent checks or one shared bias sampled ten times. A model-preferring-a-model result measures preference, not ground-truth correctness — and says nothing about whether the preferring and preferred models share failure modes.

The anchor evidence is peer-reviewed. Kim, Garg, Peng and Garg, “Correlated Errors in Large Language Models” (accepted to ICML 2025), evaluated more than 350 LLMs across two popular leaderboards plus a resume-screening task. The abstract states the headline plainly: “Models agree 60% of the time when both models err” — that is, of the cases on the leaderboard dataset studied where two models were both wrong, they were wrong on the same answer 60% of the time. Not wrong separately. Wrong together.

Two further findings matter more for anyone building verification pipelines. First, scale does not fix this: larger, more accurate models showed more highly correlated errors than smaller ones, even across distinct architectures and providers. Second, the study explicitly tested the comfortable assumption that diversity in training data, architecture, and provider reduces homogeneity — and found it does not hold in practice. Buying your second opinion from a different vendor does not buy you independence.

The paper also traces the consequences downstream into two live deployment surfaces — LLM-as-judge evaluation and algorithmic resume screening — where correlated errors mean the same candidates and the same answers get systematically misjudged across nominally independent systems. This is the LLM-specific instance of a broader pattern the algorithmic-monoculture literature has warned about for years as background theory: when decision-makers converge on the same underlying model, errors concentrate rather than average out.

The freshest direct test of agreement-as-confidence-signal is a July 2026 audit, “When LLMs Agree, Are They Right?” by Kaihua Ding. One caveat up front, because it matters: this is a single-author preprint, not yet peer-reviewed at the time of writing. Its 265,000-sample scale across 53 runners gives it weight, but the scope is two benchmarks — GPQA Diamond and AIME — so we treat it as supporting evidence alongside the peer-reviewed ICML 2025 result, not as settled literature on its own.

With that flag planted: the audit measured self-consistency and cross-model agreement as confidence signals across those two benchmarks and found agreement to be “a positive but weak predictor” of correctness — Spearman ρ between 0.20 and 0.59 across conditions. Most of the variance in whether an answer is correct is simply not explained by how much models agree on it.

Three more findings from the same audit sharpen the picture. In exploratory cross-family testing that included Claude models, confidently-wrong answers were “partly shared across providers” — smaller in scope than the main audit, but pointing at shared bias rather than correctness driving apparent agreement. An option-shuffle control on GPQA found that a meaningful share of what looked like content agreement was positional, not semantic — the models kept under-selecting option D even after the choices were shuffled, so part of the agreement was about where the answer sat, not what it said. And chain-of-thought reasoning improved raw accuracy on GPQA by 6.7 percentage points while only marginally improving agreement’s reliability as a correctness signal — the author’s own section heading is “accuracy yes, signal marginal”. Thinking longer gets more answers right, but it does not make agreement a better lie detector.

The audit’s practical conclusion is worth quoting in spirit: agreement signals are useful for allocating compute — deciding how much sampling budget a question deserves — but unreliable as a routing decision or a standalone confidence threshold. In the author’s testing, a simple always-use-the-mid-tier-model policy outperformed confidence-based cascading.

Majority voting inherits its statistical guarantee from a theorem that assumes independent voters. Estornell and Liu’s NeurIPS 2024 paper on multi-LLM debate formally proves what happens when that assumption fails: with correlated errors — the norm, given shared pretraining corpora, training procedures, and architectures — the guarantee behind majority voting breaks down. A shared bias can push many “independent” agents toward the same wrong answer simultaneously, so the effective number of independent votes is much smaller than the nominal N of models queried. Ten models in the room; perhaps two genuine opinions.

The empirical record on debate-style setups is consistent with the theory. A controlled evaluation published on the ICLR 2025 Blogposts Track — not a peer-reviewed conference paper, and we hold it to that standard — tested five published multi-agent-debate frameworks across nine benchmarks and concluded that “current MAD frameworks fail to consistently outperform simple single-agent test-time computation strategies” such as plain chain-of-thought and self-consistency — with the scope caveat that the study tested GPT-4o-mini and Llama 3.1-8B specifically. A separate 2025 paper, “Talk Isn’t Always Cheap” by Wynn, Satija and Hadfield, is dedicated entirely to cataloguing the failure modes — the ways debate rounds drift toward conformity instead of converging on truth.

The most useful recent number comes from a June 2026 preprint, “Minority Sentinel”: in roughly 25% of the cases where debating agents diverge, the minority position is the correct one. Blind majority rule, in other words, discards the right answer about a quarter of the time it has any divergence to work with — per one research group’s preprint, so treat it as illustrative rather than settled. Their proposed fix is telling: not another LLM as arbiter, but a lightweight non-LLM classifier trained on behavioral debate fingerprints, reporting 81.2% precision on decisions to overturn the majority. Sometimes the cure for correlated LLM judgment is explicitly not another LLM.

The reason consensus keeps its reputation is a quiet substitution. One technique in this family — self-consistency — has genuinely strong published results. Wang et al.’s original self-consistency paper (ICLR 2023) reported large accuracy gains from sampling one model repeatedly and majority-voting the answers on reasoning tasks with a unique, checkable answer:

But look at what that evidence covers: one model exploring its own solution space on tasks where the answer can be checked. It is routinely borrowed to justify a very different claim — that three different chatbots agreeing on an open-ended judgment call is trustworthy. Those are different setups resting on different, and much weaker, evidence. The table below maps six verification setups practitioners actually use against what the published literature tested for each.

Read down the evidence column and the pattern is hard to unsee: the strongest published numbers belong to the setups that either check answers against ground truth or inject a verifier from outside the LLM family. The setup most teams actually run — several models, one pasted prompt, count the votes — is the one with the weakest evidential support and the best-documented failure mode.

Cross-model review usually ends with a model judging other models’ output — which imports a second family of documented distortions. The foundational LLM-as-judge paper, Zheng et al.’s MT-Bench and Chatbot Arena study (2023), is cited constantly for its positive headline — that “strong LLM judges like GPT-4 can match both controlled and crowdsourced human preferences well, achieving over 80% agreement, the same level of agreement between humans”. Less often quoted is that the same paper is the origin point for naming the biases that erode that figure in practice: position bias, verbosity bias, and self-enhancement bias — with partial mitigations proposed, not solutions claimed.

The follow-up literature has since measured those biases at scale. “Judging the Judges” tested 15 LLM judges across 22 tasks and roughly 40 solution-generating models — more than 150,000 evaluation instances — and confirmed position bias is real, non-random, and varies significantly by judge and task — swings large enough, in principle, to flip a verdict. And Wataoka, Takahashi and Ri traced self-preference bias to a mechanism more unsettling than vanity: “LLMs assign significantly higher evaluations to outputs with lower perplexity than human evaluators, regardless of whether the outputs were self-generated”. Judges reward text that feels familiar — which is precisely the text most likely to share the judge’s own blind spots. Secondary syntheses of this literature also note that the choice of judge model can quietly shape leaderboard-style results toward the judge’s own model family — a reason to read any single-judge benchmark with the judge’s identity in mind.

None of this argues against second opinions. It argues against counting them like independent votes. Here is the method we run when a cross-model review matters — each step exists to counter a specific documented failure mode from the sections above.

1. Write independent briefs, not one shared prompt. A single pasted prompt gives every model the same framing, the same emphasis, the same buried assumptions — shared input bias stacked on top of shared training bias. Brief each reviewer separately, in different words, ideally written before you have seen any model’s answer. The craft of writing a brief that constrains without contaminating is its own discipline — our companion piece on specification quality and the brief method covers it in depth, including rubrics a reviewer can be checked against.

2. Force a refutation round. Do not ask “do you agree?” — models are trained to be agreeable, and debate research documents drift toward conformity across rounds. Ask each model to make the strongest possible case that the emerging answer is wrong. A refutation that comes back hollow is weak evidence of correctness; a refutation that lands is the signal you paid for.

3. Check the minority before you bury it. When reviewers split, the divergence itself is the interesting data — per the Minority Sentinel preprint, the minority position is right in roughly a quarter of divergent cases. Route split verdicts to a human, or at minimum to a deterministic check, before majority rule decides anything that matters.

4. Diversify the verifiers beyond LLMs. The fix proposed in the Minority Sentinel preprint was a non-LLM classifier, and the direction of the ensemble-judging literature — different model families beating one model asked repeatedly — is well supported even where exact magnitudes are not. In practice: different families for generation and judging, plus every deterministic check the task allows — tests, type checkers, linters, source-link resolution. Where the task has a checkable answer, check it; where it does not, be honest that you are aggregating opinions. This reliability layer is a sibling of context discipline — our agent reliability playbook covers how much context each verifier actually needs to be worth consulting.

5. Verify that a read-only review was read-only. This sounds paranoid until you meet the documented case. In late 2025, OpenAI’s Codex /review command was found to be able to mutate the working tree during review, because the review thread inherited the parent session’s sandbox mode instead of enforcing read-only — the fix (opened November 26, 2025, closed December 9, 2025) force-sets the review thread to a read-only sandbox policy regardless of the parent session. Our own cross-model review harness independently arrived at the same safeguard: hash the working tree before and after every model’s pass, and fail the run on any drift. Trust the review; verify the tree.

6. Treat unanimity as a trigger, not a terminus. When every reviewer instantly agrees, the honest interpretations are: the answer is easy, the brief led the witnesses, or the models share the relevant blind spot. Spend one more check deciding which — usually by re-briefing one reviewer with the opposite framing.

Looking forward, we expect the tooling to move where the evidence points: away from raw vote-counting and toward instrumented disagreement — verifier ensembles that log why reviewers diverged, lightweight non-LLM arbiters on the split cases, and provenance checks built into the review loop the way the sandbox fix built read-only enforcement into Codex. Teams that build the reconciliation muscle now — briefs, refutation, minority checks — will get compounding value from every model generation; teams that standardize on vote-counting will get faster, more confident versions of the same correlated mistakes. If you want help designing verification workflows like this into your AI delivery pipeline, that is exactly the kind of system our AI transformation engagements build.