Adversarial Panel: Quality Assurance via Multi-Model Adversarial Review

Stop trusting single-shot generation results; reach conclusions only after letting multiple models clash. A design explanation of the Claude Code skill that ports the adversarial structure of GANs into the inference phase.

• Author: Ryousuke Wayama (@wayama_ryousuke
• Date: 2026-07-09
• Background: Concept inspired by GANs (2023 prediction tweet) / Design brainstormed with Claude Fable 5
• Repository: https://github.com/makinux/adversarial-panel

Background: Why Single-Shot Answers Aren't Enough

LLM answers are most dangerous not when they are wrong, but when they are wrong yet confident. A single pass of a single model structurally lacks a mechanism to detect this. Even with self-critique, the blind spots during generation and critique are correlated because they stem from the same weights; furthermore, it has been proven that models possess a self-preference bias, rating their own output highly. In short, "writing and reviewing by oneself" is a conflict of interest from the start for any audit.

This skill's inspiration comes from GANs. The essence of a GAN is not just the structure of competing generators and discriminators, but the underlying principle: the asymmetry where detecting is easier than creating. Rather than the generator guaranteeing its own correctness, higher quality assurance is obtained for the same computational cost by letting independent adversaries attack and only passing what survives. While GANs ran this loop via gradients, adversarial-panel runs it via natural language critique. Only the medium of the signal has changed; the game structure remains the same.

However, simply lining up multiple models has no value. What works are the following two design characteristics, which the skill is intentionally designed to create:

• Decorrelation of Errors — A reviewer can only catch a generator's oversight if their failure modes differ. Since panels of the same model share blind spots, "unanimous agreement" is less evidence than it appears. Crossing model families is the core.
• Verification Advantage — Refuting a given answer is easier than creating the answer. Therefore, critics are directed to target verifiable claims. Not "I think it's suspicious," but "It fails on input X" — refuting through reproduction, not just assertion.

Architecture: Facilitator and Panelists

There are only two types of components. The main session (Claude Code itself) acts as the facilitator, handling progression, verification, and integration, while 2 to 4 panelists handle responses and mutual critique. The facilitator must not speak their own opinions through the mouths of the panel (prohibition of facilitator capture); if adding an opinion, it must be labeled as the "Facilitator's View."

Figure 1 — Configuration of adversarial-panel. The facilitator distributes a self-contained brief (solid line), and panelists attack each other's answers (Cross-critique) before returning answers and critiques to the facilitator (dashed line). This loop runs for each round.

Panelists are sourced with a priority on maximizing heterogeneity:

1. Different Model Families — External CLIs like Codex via Bash. This provides the strongest decorrelation of errors.
2. Different Claude Models — Via the agent tool's model parameter (Opus/Sonnet/Haiku).
3. Same Model + Forced Methodological Branching — One arguing from first principles, one from base rates (outside view), one searching only for counter-evidence, and one re-executing verifiable claims. Differentiate by method, not just persona.

The default is 2 panelists × 3 rounds. Since cost scales with the number of panelists and rounds, expansion to 3–4 panelists is only for when the user demands thoroughness.

Protocol: 4 Rounds + Synthesis

Figure 2 — Protocol Progression. White represents the facilitator's tasks, purple represents the panelists' tasks. A verification gate is inserted after Round 1 to check if "answers have substance." For inexpensive queries, Rounds 2 and 3 can be merged into one.

Round 0 — Framing and Necessity Judgment

First, determine if a panel should be opened. For low-stakes queries or cases where confidence is justified, answer directly and only present the panel as an option. A full panel is triggered only for important, contentious, or verifiable queries—because that is where critique is worth the cost.

Defense against the "triage trap" is built in here. Since the model that must catch the blind spot is the one operating this gate, the more confidently it fails a task, the less likely the gate is to open. Therefore, if a user explicitly requests a panel, it executes regardless of confidence, and for important queries, judgment is based on the size of the stakes rather than self-confidence.

Next, write a self-contained brief. Since sub-agents cannot see the conversation context at all, the brief must include the query, context, constraints, and output format, plus instructions to "separate facts from speculation and attach confidence levels and falsification conditions (what observations would overturn this) to major claims." Falsification conditions must be specific and inspectable, like "fails on input X" or "contradicts source Y"; generic phrases like "if contrary evidence appears" are treated as missing data (calibration theater).

Round 1 — Independent Answers (Parallel/Blind)

Launch all panelists in parallel. It is an absolute requirement that no one sees others' answers; a panelist who sees another's answer will anchor to it, breaking the premise of independence.

Upon return, the verification gate: status lines or error dumps are not answers. Including them in the minutes would cause subsequent rounds to critique ghosts (the ghost panelist problem described later). Failed panelists are retried; if they fail twice, the heterogeneity level is lowered by one step to continue, and the actual panel configuration is disclosed to the user.

Round 2 — Cross-Critique (Parallel)

Each panelist is given the other panelists' answers. They must attack specific claims with citations—factual errors, weak evidence, logical leaps, overlooked alternatives, or implicit assumptions. Verifiable claims are refuted through reproduction (running code, recalculating values, checking sources). Inflation of agreement, summaries, or praise is prohibited. Both concessions and attacks require reasons.

Round 3 — Final Views (Parallel)

Each panelist is given the critiques against them. They must concede to valid attacks (with reasons, not social grace), defend surviving claims with reasons, and state remaining uncertainties plus calibrated confidence and falsification conditions. Total conversion without reason is a flag for sycophancy, so the basis for conversion is questioned before acceptance.

Synthesis — Integration by Facilitator

The final output consists of three parts: Points of Agreement / Points of Conflict / Conclusion.

• Points of Agreement — Accompanied by the single strongest supporting argument, specifying whether the convergence is strong evidence (heterogeneous panel) or weak evidence (homogeneous panel, potential shared blind spots).
• Points of Conflict — Written as "Who, What, with What Evidence" + the facilitator's ruling, weighted by evidence strength. If one side has reproducible evidence and the other has intuition, a ruling is made. Presenting both sides equally is not neutrality, but false balance.
• Conclusion — Includes confidence levels, conditions that could change the conclusion, minority opinions worth preserving, and an audit trail of accepted/rejected critiques.

Three Invariants to Maintain Throughout

Correspondence with GANs

The design intent of "porting adversarial generation to inference" can be mapped as follows. It is key that failure modes on the panel side correspond neatly to known GAN failure modes.

Failure Modes and Countermeasures — All Observed in Production

This collection of skill anti-patterns is not a list of theoretical concerns, but a catalog of actual landmines encountered.

• Ghost Panelist Status strings or error dumps mix into the minutes as answers, causing all subsequent rounds to argue against thin air. → Countermeasure: Verification gate immediately after Round 1. Force foreground execution for external CLIs and prohibit wrappers that return before completion.
• Sycophantic Convergence Everyone agrees in Round 2 without new arguments. Equivalent to mode collapse in GANs. → Countermeasure: Add "You are opposing at least one central claim. Find it" to the critique prompt.
• Facilitator Capture The facilitator makes the panel speak its own prior opinions, laundering them through the authority of consensus. → Countermeasure: Facilitator views must be separated with labels.
• Confidence Theater Numerical confidence without falsification conditions. "80% confidence" is meaningless unless you can say what observation would make you withdraw it. → Countermeasure: Treat confidence without falsification conditions as missing.
• Diversity Illusion Treating different personas of the same model as independent reviewers. The role name "Red Team" does not decorrelate errors—only different models, different methodologies, or actual reproduction of claims creates decorrelation. → Countermeasure: Explicitly downgrade convergence in homogeneous panels as weak evidence.

Use Cases and How to Call It

The skill itself is published at makinux/adversarial-panel. By placing it in Claude Code as ~/.claude/skills/adversarial-panel/SKILL.md, it triggers via explicit calls or natural language like:

"Have Opus and Codex perform an adversarial review of this design." "Really? Let them debate to make sure." / "red-team this" / "I want a second opinion." It also actively becomes a candidate for triggering when you press for certainty on important points with "are you sure?"

It is suited for important queries that are either contentious or verifiable. Architecture selection, root cause hypotheses for failures, technical forecasting, or verifying research conclusions. Conversely, opening it for low-stakes queries is a waste of cost, which Round 0 triage filters out. Cost is proportional to the number of panelists × rounds; 2×3 is the standard for daily use, expanding to 3–4 for critical moments.

Degradation for poor environments is also defined:

• No sub-agent mechanism → Substitute with separate sections in sequential execution (weak, as weights and context are shared—noted in synthesis).
• Only a single family available → Drop to methodological branching (3rd tier) and downgrade the evidential power of convergence.
• External CLI fails twice → Remove that panelist, continue, and disclose.

Report which tier actually ran based on measurement, not intent—this is the key to auditability.

Conclusion: From Inference to Training

When I predicted in 2023 that "adversarial generation is next for LLMs," I had a GAN-like training scheme in mind.

https://x.com/wayama_ryousuke/status/1658698942161510400

Checking the answer three years later, adversarial structures were practicalized first in inference (natural language critique) rather than training (gradients). Critique-specific models like CriticGPT, multi-agent debate research, and cross-review operations in coding—the industry is converging on the same structure from different entrances.

The next stage is likely reintegration. While inference-time review results are currently disposable, converting critiques into RL reward signals (the RLAIF route) allows adversarial results to accumulate in the weights—returning to what GANs originally did. If we reach the point of "training the next model with the results of adversarial reviews," this skill will have been a prototype of a transitional period. Until then, it is well worth clashing models against each other before betting on a single-pass answer.

This article is a design explanation for the Claude Code skill adversarial-panel (SKILL.md). Concept: [@wayama_ryousuke](https://x.com/@wayama_ryousuke) (Inspired by GANs, design brainstormed with Claude Fable 5). Diagrams follow the conventions of Executor/Advisor agent configurations.