Correlated failure and source independence: why N copies aren't N witnesses

Redundancy is not the same as independence

Run a computation three times and take the majority answer, and you have built a voter. Voters are everywhere — RAID arrays, flight-control triplexes, distributed consensus, and any AI system that asks several agents and keeps what they agree on. The implicit promise is that three answers are stronger than one because for all three to be wrong, three separate things would have to go wrong at once.

That promise rests entirely on one assumption: fault independence. The math of voting — the reason three two-out-of-three replicas are dramatically more reliable than one — works only if the replicas’ failures are uncorrelated. The moment a single cause can take down all three together, you no longer have three witnesses. You have one event observed three times, and the redundancy is decorative.

Common-mode failure: one cause, every copy

A common-mode (or correlated) failure is a single fault that defeats redundant components simultaneously because they share something. Three servers on one power strip are not three independent servers against a power outage. Three replicas running the same binary are not independent against a bug in that binary. Three model calls to the same model with the same prompt are not three opinions — they are one function evaluated three times, and they will agree on the same mistake with serene confidence.

This is the trap in any quorum scheme: the quorum counts votes, but the evidence lives in the independence behind the votes, and independence is the thing the quorum never measures. The quorum and Byzantine confidence deep-dive covers how to count agreement safely; the prerequisite is knowing the votes don’t share a hidden root.

Sybil attacks: one source wearing many faces

The adversarial version of correlated failure is the Sybil attack: one source manufactures many identities so a single voice is counted as a crowd. Majority voting is helpless against it by construction — if the attacker supplies enough of the “independent” votes, they decide the outcome. You don’t even need malice. An accidental duplicate, a cached answer re-served under a new request ID, or one agent’s guess re-ingested through three pipelines produces the same effect: apparent corroboration with no independent basis.

The defense is never “collect more votes.” It is source independence — the ability to verify that two witnesses are actually distinct in origin, not the same source twice. That demands tracking where each claim came from.

Provenance is how you tell witnesses apart

You cannot establish independence by inspecting the claims; identical wrong answers and identical right answers look the same. You establish it by inspecting lineage. If every claim carries its provenance — which agent, which model, which upstream source, derived from which prior claim — then before counting two agreements as two witnesses you can ask whether their chains converge. If both trace back to one article, one model run, or one earlier guess, their agreement is collapsed back to the single observation it really is.

HiveMind tracks provenance in an append-mostly record precisely so this question is answerable after the fact. Confidence is layered over shared memory by corroboration — the “two or three witnesses” rule — and no agent certifies its own truth; standing is earned from distinct origins, not repeated copies. The Merkle DAG provenance deep-dive details how the lineage is made tamper-evident so a chain can’t be quietly rewritten to fake independence.

Decorrelation: manufacturing independence on purpose

Since shared origin is the enemy, the engineering move is to deliberately diversify the things that would otherwise be common failure modes:

• Diverse models — so a shared training artifact or shared blind spot doesn’t bias every witness identically.
• Diverse data — so a single poisoned or stale source can’t reach all witnesses at once.
• Diverse prompts and framings — so one leading question doesn’t shape every answer the same way.

Each axis lowers the correlation coefficient between failures, and lower correlation is exactly what restores voting’s statistical power. You can never reach perfect independence, but you can stop pretending you already have it.

The echo chamber is correlated error at scale

The echo chamber problem is this same fault with the time axis added. When an agent rereads its own earlier output and treats it as confirmation, it has built a feedback loop where one source corroborates itself — perfect correlation, zero independence. Multiply that across a fleet of agents passing one unverified claim around until it sounds settled, and you have correlated error at scale wearing the costume of consensus.

The structural cure is the same at every scale: mutual reinforcement of one unverified claim is not corroboration. Only independent agreement raises a claim’s standing, and only provenance lets the system know which agreement is independent. Count origins, not copies — and the crowd shrinks back to the number of witnesses you actually have.

Frequently asked

Related