Why can adding a second layer of AI decision-making make a step-by-step system less accurate instead of more?
Why does a second routing level sometimes break accuracy in disclosure hierarchies?
This explores why adding a second decision layer, where one router picks a branch and a second router picks within it, can make a tiered system (progressive disclosure, or privacy tiers that reveal more as you go deeper) less accurate.
This reads the question as being about tiered systems where a first router picks a branch and a second router picks again inside it. The corpus has no note that measures a two-level router directly, so what follows is assembled from neighboring findings on how routers fail. The mechanisms are inferences, not a tested result.
The first suspect is that early mistakes can't be undone. Routers decide before anything is generated, by estimating how hard or what kind of query this is, not by checking a response (Can routers select the right model before generation happens?). A second-level router inherits whatever the first one chose, and nothing in between asks whether the branch was right. Two steps that are each 90% reliable give you about 81% overall, and the second step is now working from a possibly wrong starting point.
The second suspect is that routers can score well without being stable. When does routing between models actually matter? found that KNN routers reach high accuracy yet send paraphrases of the same question to different models. Prompted routers give up some accuracy in exchange for consistency. Stack another level and the same intent gets a second chance to be reworded into a different path. The same note adds that routing only matters when the options actually behave differently. A second split between near-identical branches adds a decision that can only introduce error.
The third suspect is that every extra boundary is another judgment call. The iMy privacy contract uses just two categories, LOW (use by default) and HIGH (needs explicit approval), and that is simple enough for agents to follow reliably and for auditors to check deterministically (Can a two-category privacy boundary actually be auditable?). The note doesn't test deeper hierarchies, but it suggests each added level makes compliance harder to verify. When the boundary is about permission, that judgment can also be exploited. Can forwarded content trick high-privilege agents into misusing their authority? shows forwarded content forging approval, a failure that policy checks outside the agent's judgment prevent. Can attackers manipulate which model handles a request? shows that manipulated routing can leave safety measures running on the wrong model. A second router is one more place for that to happen.
One more reason the damage looks like an accuracy problem is that final-answer scoring hides which level failed. Where do reasoning agents actually fail during long traces? raised task success from 32% to 87% by checking intermediate states, and Does step-level confidence outperform global averaging for trace filtering? shows local checks catching breakdowns that a global average masks. A routing harness that records each route's trajectory (Can a routing harness generate its own training data automatically?) is the natural way to see whether level one or level two went wrong. The corpus points to three practical checks: verify each level separately, keep the tree shallow, and test every branch with paraphrased queries.
Sources 8 notes
RouteLLM and Hybrid-LLM both achieve 40-50% cost reduction by routing to a single model based on query difficulty prediction, not response evaluation. Single-model routing minimizes latency compared to ensemble or cascade alternatives.
High task accuracy is compatible with meaningless routing if all models behave identically or if semantically-equivalent queries reach different models. Empirically, KNN routers achieve high accuracy but fail under paraphrase, while prompted routers trade accuracy for consistency.
The iMy contract splits data into LOW (default-use) and HIGH (explicit-approval-required) categories, producing concrete, observable compliance checks. This binary is simple enough for agents to follow reliably while remaining precise enough for deterministic evaluation.
Retrieval-summarization-delegation pipelines allow low-privilege agents to embed forged authorization claims that cause high-privilege agents to misuse their legitimate authority. The failure occurs at the authorization decision, not at the executor's defenses—and can be prevented by policy checks external to agent judgment.
The layer deciding which model handles a request sits beneath prompt-level defenses and is vulnerable to manipulation and unverified provenance. Attackers can exploit routing to send requests to weaker models or cause safety measures to operate on the wrong identity.
Show all 8 sources
Reliability for long-trace reasoning comes from checking intermediate states and policy compliance during generation, not from scoring final outputs. Adding intermediate verification raised task success from 32% to 87% because most failures are process violations, not wrong answers.
Local step-level confidence catches reasoning breakdowns that global averaging masks and enables early stopping before traces complete. This approach achieves comparable accuracy gains to naive majority voting with far fewer generated traces, proving trace quality matters more than quantity.
A deployed routing system records execution trajectories, capability demand estimates, and outcome data that can be converted into labeled training examples for fine-tuning and distillation, turning the harness into both a serving component and a difficulty labeler.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing
- Local Coherence or Global Validity? Investigating RLVR Traces in Math Domains
- RouteLLM: Learning to Route LLMs with Preference Data
- Diagnosing Harmful Continuation in Answer-Correct Long-CoT Training Traces
- Stop Anthropomorphizing Intermediate Tokens as Reasoning/Thinking Traces!
- When is Routing Meaningful? Diversity and Robustness in Language Model Societies
- Beyond Semantics: The Unreasonable Effectiveness of Reasonless Intermediate Tokens
- LLMRouter: Unified Infrastructure for Developing, Evaluating, and Deploying LLM Routers