I published a catalog of twenty-two ways LLM agents fail. Then a commenter said the thing that turns a list into a model: a dependency graph over the taxonomy would be a killer follow-up.
He was right, and chasing it down changed how I see the whole catalog. The twenty-two are not twenty-two separate problems to guard against. They are surface expressions of five root mechanisms in how a language model actually works. Learn the five, and the twenty-two stop being a list to memorize. Guard a root, and you cover its entire group.
A catalog is a list. A taxonomy is a model. This is the model underneath.
Same failure, different clothes
Start with the observation that cracked it open. Fabrication and a fake “I tested it and it works” look like two different failures. One is a made-up citation. The other is a false claim about an action. Group them by symptom and they land in different buckets.
Group them by cause and they are the same failure. A language model produces plausible continuations. Plausible and true are different properties, and nothing in the generation step checks one against the other. A citation that looks real and a test result that reads like a passing run are the same move: the model generating the shape of correct output without the substance. One root, two symptoms.
Once you see that, you start seeing it everywhere. The twenty-two collapse.
The five roots
Generation over ground truth. The model predicts likely text, not verified fact. When the likely text is true, the output is correct. When it is false, the output is wrong, produced with identical fluency. This root gives you fabrication, fake execution claims, placeholder code passed off as done, and tests gamed to pass. All the same move.
No native calibration. The model cannot tell what it knows, how sure it is, or whether it has drifted. Confidence in its output is a style, not a measurement. The uncertain answer and the certain answer read identically. From that one absence: overconfidence, undetected instruction drift, thin content dressed in confident structure, and commitment to the first answer with no signal to keep looking.
Attention economics. Signal decays as the context fills. An instruction that had the floor at turn one is one voice in a crowded room at turn forty. Nothing removed it; its share of attention got diluted by volume. This is the physics behind context dilution, decaying constraints, missed instructions buried in the middle of long inputs, and goal drift on long tasks.
No instruction/data boundary. To the model, everything is text in one channel. Your command, the document it is summarizing, the page it fetched, the ambiguity in your phrasing, all arrive as the same kind of thing. There is no native type separating “this is an instruction” from “this is data.” That missing line is the root of prompt injection, silently filled assumptions, scope creep, accepted false premises, and misapplied patterns.
Trained-in pressure. The other four are architectural, properties of how the model is built. This one is different. It comes from how the model was trained. Agreement is a rewarded path, so under pushback the model folds. Self-continuation is rewarded, so it defends its own prior claims. Trust in handed-off output is the default, so an early error compounds down a chain of agents. This is the group where a prompt helps least, because it is pushing against gradients laid down across the whole training process.
Why this matters more than the catalog
The catalog tells you what to do. The taxonomy tells you where to spend.
If you guard at the root, one habit covers a whole group of symptoms. A single verification step between generation and claim guards the entire first group at once. A single practice of re-injecting the objective before each action covers the whole attention-economics group. You stop patching twenty-two leaks and start closing five holes.
It also tells you where guarding will not be enough. Four of the five roots are architectural. You can work around them with the right prompt and the right checkpoint. The fifth, trained-in pressure, is the one where prompts only raise resistance and never remove it. Sycophancy is not a prompt problem you have failed to solve. It is a training outcome that reasserts under pressure, and honest engineering names that limit instead of pretending an instruction closes it.
That distinction, architectural versus trained-in, is the most useful thing in the whole taxonomy. It tells you which failures you can engineer away and which you can only manage.
The verdict
Twenty-two failure modes felt like twenty-two things to learn. Five root causes is a thing you can hold in your head.
Stop memorizing symptoms. Learn the five mechanisms, and the failures become predictable, because you understand where they come from. Guard the root, and you cover the group.
The list was the field guide. This is the map.
The interactive taxonomy lays out all five roots, the mechanism behind each, and an example prompt you can copy and adapt: robertrevans.com/specs/root-causes
The field guide it maps: all twenty-two failure modes, each with the drop-in prompt that guards against it. Open the catalog →
More of the work: robertrevans.com
Top comments (1)
I found the dependency graph over the taxonomy of failure modes to be a fascinating approach, and it's interesting to see how the 22 failure modes collapse into five root mechanisms. The concept of "generation over ground truth" resonates with me, as I've encountered similar issues in my own work with language models, where the model predicts likely text without verifying fact. I'm curious to know more about how you envision implementing verification steps to guard against this root mechanism, and whether you think this could be achieved through additional training data or modifications to the model architecture. The idea of re-injecting the objective before each action to mitigate attention economics also seems promising, and I'd love to hear more about how this could be applied in practice.