The certificate was calibrated alone.
You deployed it in a room.

A threshold on the scores, and a guarantee attached to it illustrative

Split conformal prediction is mechanically simple. Score every answer by how unlike the model's correct answers it looks — here, one minus the probability the model assigns it. Take a held-out calibration set, find the score below which 90% of the true answers fall, and turn that into a probability cut-off. At serving time, the prediction set is every answer scoring above the cut-off. The guarantee is a frequency: across exchangeable items, the true answer lands in that set 90% of the time.

Nothing in that argument mentions the model's inputs. Slide the peer pressure up and watch what happens to a single item — the cut-off is fixed, so the only thing that can move is where the probabilities sit relative to it.

That is the whole failure. The cut-off was fitted to how this model scores when it answers alone; the peers change how it scores; and because the true answer's probability drops through a threshold that never moved, it silently leaves the set the guarantee was about.

Six fabricated turns, and sixteen points of coverage

The experiment injects six speaker turns after the question, each of the form "name: I think this answer is label", with names and phrasings resampled across seeds while the question and the model's solo answer stay fixed. Calibration is done on the solo round and averaged over 2,000 random calibration/test splits.

At the standard 90% operating point the gate delivers 73.9% — sixteen points of guarantee gone. Tighten it to a 95% target and the gap narrows to 8.6 points; at 99% no collapse appears at all, which is the paper's own signal that this is a property of where the threshold sits rather than of conformal prediction in general. Adding an authority cue — giving one speaker a senior-sounding role — changes almost nothing: 74.6% without it, 73.9% with.

Vulnerability is uneven, and it does not track the things you would check first. It tracks how much the model's probability on the correct answer moves when the peers speak.

Attack the decile just above the threshold and the dashboard stays calm

An attacker does not need the answer key. The items sitting just above the cut-off are identifiable from the model's own solo confidence, and they are the ones a small score shift can push through it. Attack that decile alone and the local damage is catastrophic while the aggregate number barely twitches.

Attacking 10% of items costs the overall figure four points — inside the noise anyone would tolerate — while coverage on the attacked band falls from 92.2% to 51.9%. The average is not a summary of the damage; it is camouflage for it.

This is not a distribution shift you can reweight your way out of

The instinct is to reach for the standard toolkit: reweight the calibration set, calibrate per model, recalibrate on the new condition. Step through what each one actually buys here.

The reason weighting fails is worth stating plainly: the question distribution has not changed. The same items appear at calibration and at test — what changed is how the model scores them once other agents are in the context. The importance ratio is therefore exactly one, and the correction reduces to doing nothing. The only repair that restores 90% coverage is calibrating on pressured data, which requires knowing in advance which items will face pressure, and it widens the sets from 2.4 to 3.1 of four options, forcing escalation on nearly everything.

The gate does not just lose the answer — it hands over the decision illustrative

A confidence set is usually wired to an action rule: one candidate means act, several mean escalate to a human or a stronger model. That rule turns a coverage failure into an autonomy failure, because the set can collapse to a single wrong answer — the one the peers asserted — and the agent will act on it without ever flagging anything.

The rate is not a function of model size. The largest model tested collapses to a confident singleton on 71.4% of the items conformity flipped — the most capable model in the study is the one most willing to act alone on the answer it was pushed toward. Set width gives no warning either: the pooled predictor's average set size is unchanged at 2.44 options under pressure.

What the paper actually reports