Multi-Agent System: Dynamically-Decided Architectures

1. Why the graph became the variable

A multi-agent system (MAS) built from large language models (LLMs) is a set of model instances — each given a role prompt and possibly tools — that exchange messages to solve a task together. Until roughly 2024, the structure of that exchange was drawn by hand: a debate ring, a fixed reviewer chain, a MetaGPT-style software company with a hard-coded organization chart. The structure was a fixed graph — usually a directed acyclic graph (DAG), a graph whose edges have a direction and never form a loop — chosen once by a human and applied to every task.

Two developments made that human choice untenable. The first is cost: every edge in the communication graph is a message that the receiving agent must re-encode as prompt tokens, so an over-connected graph is a direct API bill. On the MMLU knowledge benchmark, one measured comparison found that state-of-the-art fixed topologies cost $43.7 to reach an accuracy that a pruned topology reached at $5.6 — an eightfold difference produced purely by structure. The second is reliability: an empirical study of over 1,000 execution traces (the MAST failure taxonomy, NeurIPS 2025 Spotlight) attributed 41.8% of multi-agent failures to specification and system-design problems and another 36.9% to inter-agent misalignment — in other words, the majority of observed failures originate in the structure humans drew, not in the models.

MAST, Figure 1: The MAST failure taxonomy: 14 failure modes across specification, inter-agent misalignment, and verification, with measured prevalence — the empirical case that structure, roles, and termination need optimizing.

A concrete example makes the waste visible. Consider a five-agent debate graph, fully connected, run for two rounds on every incoming query. Under full connectivity, each round delivers every agent's message to all four peers, so this single query generates on the order of twenty inter-agent messages, each re-encoded as prompt tokens by its receiver. An easy grade-school arithmetic question arrives; the correct answer is already produced by the first agent in the first round, yet the fixed structure still spends the other four agents, both rounds, and every pairwise message re-encoding on it. A hard competition-mathematics question arrives next and receives exactly the same budget — no more depth, no extra verification. The medical-domain system MDAgents (NeurIPS 2024 Oral) quantified what fixing this is worth: letting a classifier pick the team structure per query scored 81.2% on average, while the best single fixed structure applied uniformly scored only 71.6% — and the adaptive version also used fewer API calls than the fixed heavy team (9.3 versus 20.3 per query).

The obvious fix — write a better fixed graph — does not survive contact with the evidence either. A large-scale study that scaled hand-specified topologies to more than 1,000 agents (MacNet, ICLR 2025) found that no single graph family dominates every domain: its six topology families reverse ranking across task domains. If the best structure depends on the task, then structure selection is itself an optimization problem, and that realization is the founding move of the research line this page surveys: make the architecture — the edges, the team, the roles, or the entire workflow program — an output of an algorithm rather than an input from a human. The field's reception speaks to how productive that move has been: among the roughly 55 papers verified for this survey, five were presented as conference Orals (GPTSwarm at ICML 2024, MDAgents at NeurIPS 2024, AFlow at ICLR 2025, MaAS at ICML 2025, ARG-Designer at AAAI 2026) and two as Spotlights (G-Designer at ICML 2025, MAST at NeurIPS 2025).

MacNet, Figure 7: The collaborative scaling law: performance grows logistically with agent count, and irregular topologies outperform regular ones — evidence that structure matters, measured over hand-specified graphs.

2. Two questions organize the field: what is decided, and when

With dozens of systems now claiming a 'dynamic' architecture, the word has become ambiguous, and the first job of a survey is to disambiguate it. Reading the corpus side by side, two questions separate every system cleanly. The first is the design space — what the algorithm is allowed to decide: which pairs of agents exchange messages (edge topology), which messages cross between dialogue rounds (temporal edges), which agents exist at all (team composition), what each agent is (roles), how many rounds to run (termination), or, most expressively, the entire workflow as an executable program of LLM calls. The second question is timing: when the decision is made. Timing matters more than any algorithmic detail, because it determines what a deployed system actually does — and, as Section 9 develops, what a serving stack can precompute.

The diagram below shows the three timing regimes the literature has settled into. Reading top to bottom: the earlier the decision is frozen, the cheaper and more cacheable the deployment; the later it is made, the more the structure can adapt to what actually happens during execution.

Crossing the two questions produces the map below. Rows are the timing regimes from the diagram; columns are the five mechanism families that Sections 3–7 walk through in detail. The table is a reference to return to — each family's entry explains itself in its own section — and it makes one trend legible at a glance: the offline row is populated by the 2024 generation, the per-query row is where 2025–2026 activity concentrates, and the per-round row is still sparse.

(scroll right for more columns →)

2.1 What exactly is a vertex? Six node granularities

Before the map can be trusted, one definitional debt must be paid: the word agent does incompatible work across these papers, and reading every vertex as a persona-style agent produces concrete misreadings. Six granularities cover the corpus. An invocation (I) is a single LLM, tool, or function execution with no durable identity. An operator (O) is a packaged inference routine — chain-of-thought with self-consistency, ReAct, an entire debate — that may contain many calls and its own internal prompts, yet occupies one vertex. A role agent (C) is a profile prompt plus accumulated state and optional tools that persists across rounds. A module slot (M) is a typed component with a uniform interface inside one architecture. A backbone seat (B) is a position whose salient variable is which LLM fills it. And a program (P) means the designed object is executable workflow code with no imposed vertex type at all.

Four corrections that follow from primary-source definitions are worth stating explicitly, because each contradicts a common reading. In GPTSwarm a node is an operation and an agent is a subgraph of operations — the swarm composes subgraphs, so its edge optimization rewires operations, not personas. In MaAS the vertices are agentic operators, formally O = {{M}, P, {T}} (Definition 3.1) — CoT-SC or a full Debate is one vertex despite containing several calls, so MaAS depth is measured in operators, not agents. AgentSquare searches the four module slots of a single agent — its own paper scopes MAS out — making it a boundary case for this survey rather than a topology method. And a MASS building block is a motif that expands into several typed prompt modules (three predictors plus an aggregator, for instance), so its topology search counts motifs, not individuals. The table records the class for every system; the per-family sections above can be reread with these letters in mind.

(scroll right for more columns →)

2.2 Where the prompts live: provenance and the 2×2 that decides attribution

Every vertex above ultimately executes a prompt, and where that prompt comes from is a design decision as consequential as the topology — the MASS ablation of Section 8.5 quantifies it at roughly four prompt points for every topology point. The provenance question splits into three: who writes each node's prompt (a hand-written role library, an LLM at design time, an LLM per query, or code that carries prompts inside it); whether the prompt text is part of the optimization space, under a strict rule where routing among immutable profiles does not count as prompt optimization; and whether the actual texts are released. The table answers all three per system, verified down to the released prompt files in each official repository.

(scroll right for more columns →)

Folding the table into a 2×2 of {structure optimized} × {prompt text optimized} yields a clean split with a sharp consequence. Twelve systems co-optimize both (GPTSwarm, ADAS, AFlow, AgentSquare, MaAS, MAS-GPT, ScoreFlow, FlowReasoner, EvoMAC, MASS, SwarmAgentic, AutoAgents); ten optimize structure over frozen prompt libraries (AgentPrune, AgentDropout, AMAS, DyLAN, MDAgents, G-Designer, AnyMAC, MasRouter, Puppeteer, ARG-Designer); and both remaining quadrants are empty — pure prompt optimization over fixed structure is the neighboring TextGrad/DSPy literature, outside this survey. The attribution consequence: gains from the joint quadrant cannot be credited to topology without a prompt-controlled ablation — MASS, the one paper that ran it, measured +11.87 points from prompt stages against +2.99 from topology. The frozen quadrant earns the opposite virtue: because AgentPrune holds its profiles fixed across compared topologies, AgentDropout reuses AgentPrune's exact configurations, and DyLAN states its comparisons share agent prompts, their topology deltas are internally clean conditional claims — structure helps, given that prompt library — though internal fairness does not imply the library is optimal, and role selection (MDAgents, MasRouter) changes which prompt a query meets without ever optimizing its text.

3. Family A — learning a graph over a fixed agent pool

This family keeps the agents fixed and learns which edges to keep. It is the most direct formalization of 'the topology is the variable', and it is where the lineage started. The technical obstacle every member must solve is the same: task accuracy is not a differentiable function of the graph — evaluating a topology means actually running LLM agents and grading their answer — so ordinary gradient descent does not apply. The standard escape is the policy-gradient method REINFORCE from reinforcement learning: sample a discrete graph from a parameterized probability distribution, run it, score the result, and shift probability mass toward graphs that scored well.

3.1 GPTSwarm — the founding formulation (ICML 2024 Oral)

GPTSwarm (arXiv 2402.16823) represents each agent as a small computational graph of operation nodes — an LLM call, a tool invocation, a Tree-of-Thought expansion — and a society of agents as a composite graph joined by inter-agent edges. Every candidate edge $i$ carries a continuous parameter $\theta_i \in [0,1]$ read as an inclusion probability; sampling edges one by one (skipping any edge that would close a cycle) yields a probability distribution over DAGs. The training objective is the expected task utility under that distribution, maximized with the REINFORCE estimator:

Here $u_\tau$ is the task utility (answer accuracy, or unit-test pass rate for code), $G_m$ are $M$ sampled graphs, and $p_\theta$ is the product of the chosen edges' inclusion probabilities. Both this edge optimization and a separate LLM-driven prompt rewriter run offline, per benchmark; the frozen graph is then deployed. The most cited demonstration is adversarial robustness: with three truthful and three deliberately-wrong agents on MMLU, edge optimization learns to disconnect the saboteurs (0.8301 accuracy versus 0.5751 for a debate baseline), and it does so at roughly $5.32 of optimization spend versus $105.93 for the team-scoring alternative DyLAN in the same setting. Two caveats travel with the headline numbers: the evaluation pools are small (20 crossword puzzles; a 153-question MMLU subset), and optimization draws from the same pools it is evaluated on, so overfitting to the pool cannot be excluded.

GPTSwarm, Figure 1: Agents as composable graphs: operation nodes form agents; agents connect into a swarm whose inter-agent edges are the optimizable parameters.

GPTSwarm, Figure 2: Edge optimization recovers accuracy in the adversarial setting by disconnecting deliberately-wrong agents.

3.2 AgentPrune and AgentDropout — communication redundancy, made formal

AgentPrune ('Cut the Crap', ICLR 2025; arXiv 2410.02506) starts from the observation that in multi-round MAS dialogues most messages do not change the outcome, and formalizes it: model one round as a spatial graph (who talks to whom within the round) and adjacent rounds as temporal edges, attach a trainable continuous mask to every edge, and train the masks briefly — with the same sample-and-score policy gradient as GPTSwarm, plus a nuclear-norm penalty, a convex stand-in for matrix rank that pushes the mask toward sparse structure. Then comes the method's principal operation: a single one-shot magnitude pruning keeps the strongest edges, and the sparse graph is frozen for all remaining queries. Used standalone with five GPT-4 agents it matches or exceeds the accuracy of denser topologies (GSM8K 95.83% versus 90.23% for debate); used as a plug-in on top of GPTSwarm it removes 60.6% of prompt tokens on GSM8K ($234.76 down to $57.17) while gaining 0.84 accuracy points. AgentDropout (ACL 2025; arXiv 2503.18891) extends pruning from edges to agents: it learns both intra-round and inter-round adjacency matrices with REINFORCE on only 40 samples per dataset, then deletes the lowest-degree agents per round before cutting the weakest edges — so different rounds get different teams, though the whole schedule is fixed before deployment. On open-weight backbones (Llama-3-8B, Qwen2.5-72B, DeepSeek-V3) it averages 68.70 versus AgentPrune's 66.51 on Llama-3-8B with 21.6% fewer prompt tokens.

AgentPrune, Figure 4: The spatial-temporal message graph and the one-shot pruning pipeline that freezes a sparse topology.

AgentDropout, Figure 2: Round-wise node dropout followed by edge dropout: different rounds keep different teams.

3.3 AMAS — select from a learned bank, per query

AMAS (EMNLP 2025 Industry Track; arXiv 2510.01617) bridges this family toward per-query adaptivity with a two-stage design: first train a GPTSwarm-style edge distribution offline and keep the top four sampled graphs as a candidate bank; then train a lightweight LoRA head — a low-rank adapter of roughly 40M parameters, about 0.5% of the backbone's memory — to score, for each incoming query, which candidate graph to use. Adaptivity is thus reduced to a cheap classification. Its own protocol is comparatively disciplined (8:1:1 train/dev/test splits on all five tasks), but its per-task margins over GPTSwarm (+0.01 to +0.04 absolute) are measured on test sets as small as 25 crossword items, so the reported margins sit within noise range on the small tasks. A historical note belongs here for citation hygiene: an earlier preprint from the same lead authors, DynaSwarm (arXiv 2507.23261), described the same bank-plus-selector architecture with an actor-critic optimizer and nearly identical numbers; it was withdrawn in August 2025 citing a content error, and AMAS is the published successor — cite AMAS, not DynaSwarm.

AMAS, Figure 1: An offline-learned candidate-graph bank and a lightweight LoRA selector that picks one graph per incoming query.

4. Family B — generating a fresh graph for every query

Family A learns one graph and reuses it, which leaves the easy-query-versus-hard-query mismatch of Section 1 unaddressed. This family closes that gap by training a generator: a model that reads the query and emits a topology before execution begins. The generator itself is deliberately small — a graph neural network, a sequence model of about a hundred million parameters, or even just a zero-shot prompt — because the structural decision must cost far less than the agents it steers.

G-Designer (ICML 2025 Spotlight; arXiv 2410.11782) treats topology design as conditional graph generation: agent profiles and the query are embedded by a frozen sentence encoder, and a variational graph auto-encoder (VGAE — a graph neural network that encodes nodes into latent Gaussian variables and decodes pairwise edge probabilities) emits the adjacency matrix, trained with REINFORCE-estimated task utility plus a sparsity regularizer on just 40–80 queries per benchmark. Harder queries visibly receive denser graphs, and its efficiency numbers are the strongest of the graph generators: up to 95.33% token reduction on HumanEval against the prior state of the art. ARG-Designer (AAAI 2026 Oral; arXiv 2507.18224) removes G-Designer's remaining hand-set choice — the fixed five-agent pool — by generating the graph from scratch, autoregressively: conditioned on the query it emits the next agent's role from an extensible role pool (or an end token that fixes the team size), then predicts that node's links to every earlier node; trained on reference graphs collected by a dense-to-sparse curriculum, it sets the state of the art on all six benchmarks of the shared harness with GPT-4o (for example MMLU 89.54%, AQuA 86.45%) at half of G-Designer's GSM8K token budget. AnyMAC (EMNLP 2025; arXiv 2506.17784) abandons the graph representation entirely and rebuilds communication as a sequence: at each step a small GPT-2 router decides which role speaks next and which earlier outputs it gets to read, trained by REINFORCE with a reward that decays exponentially with pipeline length. Because any step can read any prior output, a sequence with content selection is strictly more flexible than a fixed adjacency — at the price of serializing the computation. MasRouter (ACL 2025; arXiv 2502.11133) widens the per-query decision beyond topology: a cascaded variational controller decides the collaboration mode, then the roles, then which LLM backbone runs each agent (from a pool of four commercial and open models), trained end-to-end by policy gradient on utility minus a cost term — cutting HumanEval cost from $0.363 to $0.185 while improving accuracy.

G-Designer, Figure 3: Agents and the query are encoded (query as a virtual node); a variational graph auto-encoder decodes a task-adaptive sparse topology.

ARG-Designer, Figure 2: Autoregressive generation: choose the next role (or END, fixing team size), then predict links to earlier nodes.

AnyMAC, Figure 2: Next-Agent Prediction and Next-Context Selection: a sequential pipeline in which every step reads a chosen subset of history.

MasRouter, Figure 2: The cascaded controller: collaboration mode, then roles, then which LLM backbone runs each agent — all per query.

4.1 The mathematics of a graph generator: how G-Designer is trained

The one-paragraph summary above hides three distinct mathematical components, and separating them is what makes the later contrasts precise. G-Designer's decision variable is a directed adjacency matrix $S \in \{0,1\}^{N \times N}$ over $N$ fixed agents (default $N=5$). Its generator has an encode-sample-refine pipeline. First, encoding: each agent's textual profile is embedded by a frozen sentence encoder (all-MiniLM-L6-v2, $D=384$) into node features $X$, and the query $q$ is embedded into an extra virtual task node $h_q$ that is bidirectionally connected to every agent — this is the sole mechanism through which the emitted graph becomes query-conditioned. Second, a variational graph auto-encoder maps nodes to latent Gaussians:

where the two $\mathrm{GNN}$s are two-layer graph convolutions and $A_{\text{anchor}}$ is a predefined anchor topology that seeds the structure. Third, decoding with a differentiable edge sampler: every candidate edge is scored from the pair of latents and the task node, and sampled through a Logistic-Concrete (Gumbel-style) relaxation,

with $\varpi_{ij}$ the learned pair score. The temperature $\tau$ makes the discrete edge decision differentiable during training. The dense sketch $S$ is then refined through a low-rank re-parameterization $\tilde{S} = Z W Z^{\top}$, whose reconstruction terms pull it toward both the sketch and the anchor topology while a nuclear norm on $W$ enforces low rank. Training minimizes the resulting three-part loss on only 40–80 queries per benchmark:

The utility term is the same non-differentiable run-the-agents-and-score signal as GPTSwarm's equation (1), estimated with $M=10$ Monte-Carlo topology samples per query; the anchor term keeps early training near a sane topology; and the nuclear norm $\lVert\cdot\rVert_*$ (the sum of singular values, a convex surrogate for matrix rank) pushes the decoded graph toward low-rank, sparse structure. The essential point for later comparison: G-Designer learns a distribution over adjacency matrices, conditioned on the query through one virtual node, with cost controlled implicitly by the sparsity regularizer.

4.2 The mathematics of a router: where MasRouter differs

MasRouter looks superficially similar — a small trained controller, policy-gradient training, per-query decisions — but its decision variable is not an adjacency matrix at all. It decides a configuration $S = (T, \{R_l\}_{l=1}^{k}, \{M_l\}_{l=1}^{k})$: a collaboration mode $T$ from a repository of templates (chain-of-thought, Reflexion, self-consistency, MacNet-style graphs), $k$ agent roles from 26 predefined options, and the LLM backbone $M_l$ that runs each role, drawn from a pool of four commercial and open models. The topology itself comes packaged inside the chosen template; what is learned is which template, staffed how, on which models. The controller factorizes as a cascade:

The generative order is the point of the design: one shared latent $H$ jointly determines the collaboration mode, via $p(T \mid H) \propto \exp(H^{\top}\tilde{H}_T / \tau)$, and — unusual in this family — the team size itself, $k = \lceil \delta(H)\,\gamma \rceil$ with a learnable complexity map $\delta$ and a cap $\gamma = 6$. Role allocation is then autoregressive (each role choice conditions on the roles already chosen), and backbone routing is a single multinomial over the model pool conditioned on the complete selected-role set. Training optimizes an explicitly cost-priced objective,

again by REINFORCE (the sampled $S$ is discrete), with one technical wrinkle: to keep the emitted agent count $k$ inside the differentiable path, the multinomial coefficient over roles is relaxed through Gamma functions and $k$ is used in its pre-rounded floating-point form. The contrast with G-Designer is now sharp on four axes. Decision variable: free edges over fixed homogeneous agents (G-Designer) versus template, roles, team size, and per-agent backbone with no free wiring (MasRouter). Latent structure: one Gaussian per node versus one Gaussian for the whole query. Cost handling: implicit, through a sparsity norm, versus explicit, through $\lambda \cdot C(S;Q)$ in the objective — which is why MasRouter can produce Pareto fronts and cost-targeted configurations while G-Designer controls cost only by how sparse its graphs happen to be. And heterogeneity: G-Designer assumes all agents share one backbone; MasRouter's whole point is deciding which model runs where.

4.3 Autoregressive generation and sequential routing, formalized

The remaining two trained generators in this family occupy the poles that G-Designer and MasRouter leave open. ARG-Designer removes the fixed agent pool: it treats the graph as a sequence-generation problem and factorizes the joint probability of a variable-size graph autoregressively,

where each node step is a softmax over an extensible role pool $\mathcal{R}$ (via similarity to learned role embeddings) plus a learnable END token whose emission fixes the team size, and each edge step is a Bernoulli link prediction to every earlier node. Unlike everything above, training is supervised maximum likelihood on reference graphs collected by a dense-to-sparse curriculum — no policy gradient at all; correctness and efficiency enter through which graphs get into the training set. AnyMAC abandons the graph object entirely: a small transformer router scores the next role by an inner product $s_i = \langle t_{\text{NAP}}, r_i \rangle$ and gates which earlier messages the chosen agent reads via $g_j = \operatorname{Sigmoid}(\cos(t_{\text{NCS}}, m_j))$, trained by REINFORCE with an explicitly length-priced reward,

with $\gamma \in (0,1]$ decaying the reward exponentially in the realized pipeline length $l$, and the gate penalty sparsifying context reads. The table below compresses the four formalizations into one comparison; it is the mathematical answer to the question this section opened with — the four generators differ not in ambition but in what random variable they parameterize and what signal shapes it.

4.4 The untrained extreme

The family's untrained extreme deserves emphasis, because it proves query-adaptivity does not require learning at all. MDAgents (NeurIPS 2024 Oral; arXiv 2404.15155) prompts a moderator LLM, zero-shot, to classify each medical query's complexity as low, moderate, or high; a fixed rule then maps the label to a solo clinician, a discussing multi-disciplinary team, or a hierarchical pipeline of teams. There is no reward and no gradient anywhere, yet across ten medical benchmarks with GPT-4(V) it achieves the highest result on seven — and its ablation, quoted in Section 1, is the cleanest demonstration in the corpus that the gain comes from adaptivity itself rather than from any particular structure.

MDAgents, Figure 1: A zero-shot complexity check routes each medical query to a solo clinician, a discussing team, or a hierarchical team pipeline.

5. Family C — searching the space of workflow programs

The graph families fix what an agent is and vary the wiring. This family widens the design space to executable code: the artifact being searched is a program that calls LLMs, so any prompting pattern, control flow, or tool logic is representable. The cost of that expressivity is that the search itself becomes the hard problem — the space is unbounded, and every candidate evaluation means running a full agent system against a validation set.

Before the individual searchers, one mechanic deserves to be explicit, because it answers the most common confusion about this family: where does the score come from, and does it change per query? Every family-C system evaluates a candidate workflow $W$ the same way — by executing it on a validation split $D_{\text{val}}$ of the target benchmark and measuring the task metric against gold labels or unit tests:

where $\operatorname{score}$ is exact-match accuracy for math and question answering, the unit-test pass rate for code, and a defined pass-rate metric for planning tasks. The searchers differ only in how they spend this signal: AFlow executes each candidate five times on a deliberately high-variance subset of a 20% validation split and backs the mean into its search tree; ADAS scores each generated agent on 20–128 validation items and archives it with that fitness; SwarmAgentic's swarm fitness is the metric on as few as 5–10 training queries; MASS gives each sampled topology three validation runs on 50–60 items. Two consequences follow. First, the optimization is per-benchmark, not per-query: the winning workflow is frozen and applied unchanged to every test query, so within family C nothing about the structure changes at inference — per-query generation is precisely family D's departure, and FlowReasoner's per-query repair loop is the hybrid exception. Second, the family is structurally tied to domains with cheap, reliable verifiers — labeled answers or executable tests — because every search step consumes dozens of full-system executions; this is why family C's home ground is math and code, and why its strongest open-ended result (SwarmAgentic on TravelPlanner) required a scoreable pass-rate metric to exist before search could run at all.

The three searchers to know differ in how they tame that space. ADAS (ICLR 2025; arXiv 2408.08435) stakes the conceptual claim: a meta agent — a frozen strong LLM — programs new agent systems as code, conditioned on an ever-growing archive of previous designs and their measured scores, in an open-ended, evolution-flavored loop. Its discovered agents outperform hand-designed baselines everywhere tested (reading-comprehension F1 79.4 versus 65.8 for the best hand-crafted baseline) and transfer across models and domains. AFlow (ICLR 2025 Oral; arXiv 2410.10762) makes the search systematic where ADAS is open-ended: workflows are code over a small operator library (generate, review-and-revise, ensemble, test), and the search is Monte Carlo Tree Search — the explore-versus-exploit tree algorithm from game playing — whose tree nodes are complete workflows, expanded by an LLM optimizer that reads the accumulated modification history. Its cost result is the line's most-cited efficiency figure: AFlow-discovered workflows let smaller models outperform GPT-4o on specific tasks at 4.55% of its inference dollar cost. SwarmAgentic (EMNLP 2025; arXiv 2506.15672) adopts the least conventional search algorithm: it transplants Particle Swarm Optimization — a population method where candidates move through the search space pulled by their own best past position and the population's global best — into language space, each particle being a complete agentic system serialized as structured text. It posts the family's largest relative gains exactly where code searchers were weakest, open-ended planning: TravelPlanner 32.2 versus 8.9 for ADAS under a GPT-4o executor.

ADAS, framework figure: Meta Agent Search: a meta agent programs new agent systems as code, conditioned on an archive of prior designs and their scores.

AFlow, method figure: Monte Carlo Tree Search over code-represented workflows: select, expand with an LLM optimizer, execute on validation, backpropagate experience.

SwarmAgentic, overview figure: Language-space particle swarm optimization: each particle is a complete agentic system as structured text, moved by failure-aware velocity updates toward personal and global bests.

One paper in this family carries a result every reader of the others should hold in mind. MASS (ICLR 2026; arXiv 2502.02533) interleaves prompt optimization and topology optimization in three staged passes, and its ablation quantifies where the gain actually comes from: on Gemini-1.5-Pro averaged over eight tasks, the base agent scores 63.54; adding block-level prompt optimization lifts it to 74.56; adding topology optimization adds about three further points to 77.55; and a final global prompt pass reaches 78.40. Read against the full spread, roughly three quarters of the improvement arrives through prompts and about a fifth through topology — the clearest published evidence that prompt optimization dominates topology optimization in joint design spaces, and a caution against reading any joint system's headline gain as a topology gain.

MASS, Figure 1: The three-stage search: block-level prompt optimization, influence-pruned topology sampling, then workflow-level prompt optimization.

6. Family D — training a model to be the architect

Family C searches per domain, and each new domain pays the search again. This family amortizes that cost: train a model once so that, at inference, it emits a bespoke structure in a single forward pass. The training recipes span the full modern toolbox — supervised fine-tuning, preference optimization, and reinforcement learning — and the family's flagship holds one of the field's five Orals.

MaAS (ICML 2025 Oral; arXiv 2502.04180) imports the supernet idea from neural architecture search: instead of choosing one architecture, maintain a parameterized probability distribution over architectures — a four-layer cascade of distributions over agentic operators such as chain-of-thought, ReAct, debate, and a special early-exit operator — and let each query sample its own. A lightweight controller reads the query embedding and activates operators layer by layer, stopping early when the exit operator fires, so easy queries buy short cheap architectures and hard ones buy deep expensive ones. Training minimizes a cost-regularized objective:

where $p(a\mid q)$ is the probability of producing the correct answer, $C(G;q)$ is the token cost of the sampled architecture $G$, and $\lambda$ trades the two off. Because executing $G$ calls external LLM APIs and is not differentiable, the distribution is updated by a Monte-Carlo policy gradient whose importance weights explicitly reward architectures that are simultaneously correct and cheap, while the operators themselves are edited by 'textual gradients' — LLM-generated modifications derived from environment feedback. The result is the family's best-documented economics: training cost $3.38 versus $22.50 for AFlow on the MATH benchmark, and inference at 6–45% of competitors' token cost at slightly higher accuracy (83.59% average versus AFlow's 82.25% on its five-benchmark suite with gpt-4o-mini).

MaAS, framework figure: The agentic supernet: layered distributions over operators; a controller samples a query-dependent sub-architecture, with an early-exit operator bounding depth and cost.

Three siblings complete the family, each with a different training signal. MAS-GPT (ICML 2025; arXiv 2503.03686) is pure supervised fine-tuning: it trains Qwen2.5-Coder-32B on 11,442 consistency-filtered pairs of (query, complete executable MAS program), so that at inference one forward pass — priced at roughly half an executor call — writes the whole system as Python. ScoreFlow (arXiv 2502.04306) replaces imitation with preference learning: an 8B generator samples eight candidate workflows per problem, an executor scores them, and Score-DPO — a variant of Direct Preference Optimization that weights each (better, worse) pair by its numeric score gap — trains the generator; its ablation shows Score-DPO outperforming supervised fine-tuning, PPO, and vanilla DPO on every dataset, isolating the value of score-aware weighting. FlowReasoner (arXiv 2504.15257) pushes to reasoning-based generation: a meta-agent distilled from DeepSeek-R1 and refined with the group-relative policy-gradient method GRPO reasons about each query before emitting and iteratively repairing a bespoke system — with the scope caveat that all three of its benchmarks are code generation, where execution feedback is cheap and reliable.

MAS-GPT, Figure 1: MAS design as text generation: one forward pass writes a complete, query-specific MAS as executable code.

ScoreFlow, pipeline figure: Sample candidate workflows, execute and score them, and train the generator with score-weighted preference pairs (Score-DPO).

FlowReasoner, Figure 1: A reasoning meta-agent: distilled from DeepSeek-R1, refined with GRPO, it reasons about each query before emitting and repairing a bespoke system.

7. Family E — deciding the structure while it runs

Everything above decides the structure before execution, per domain or per query. The last family re-decides during execution — which is where 'dynamic' becomes literal, and where the engineering gets hardest, because the controller must act on partial information about a computation that is still in flight.

DyLAN (COLM 2024; arXiv 2310.02170) is the earliest system on this page and still the reference point. It models collaboration as a temporal feed-forward network — agent $i$ at round $t$ is a node receiving the previous round's messages — and manages the team without any gradient: in a preliminary trial, each agent LLM-rates its predecessors' contributions, the ratings propagate backward into an unsupervised Agent Importance Score used to keep the top-$k$ agents, and at inference an LLM ranker keeps only top-ranked agents connected forward after each round, with a consensus rule (stop when more than two-thirds of a layer agrees) triggering early exit. On HumanEval with GPT-3.5 it reaches 82.9 pass@1 versus 73.2 single-agent at a third of the API calls of a search baseline. Puppeteer (NeurIPS 2025; arXiv 2505.19591) makes the per-step decision a trained sequential policy: a centralized orchestrator selects, at every step, which of 13 agents acts next, trained by REINFORCE against a reward whose terminal term is correctness minus accumulated cost and whose per-step cost grows with step count — so the policy learns when to stop spending as much as whom to call. Its most interesting reported behavior: as training progresses the orchestrator's induced graphs become more compact and more cyclic — revisiting agents rather than fanning out — with cost falling while accuracy rises. EvoMAC (ICLR 2025; arXiv 2410.16946) brings the update inside a single task: aimed at software development, it runs a coding team and a testing team, converts compiler and unit-test failures into 'textual gradients' — natural-language attributions of which agent's subtask failed — and lets an updating agent rewrite prompts, remove finished agents, add missing ones, and rewire edges between iterations. The design is honest about its circularity: the same generated tests that drive the updates also define the reported accuracy on its self-built benchmark, an inherent property of test-time self-improvement against verifiable signals.

DyLAN, Figure 1: The temporal feed-forward network: importance-scored team selection, then runtime ranking and early stopping.

Puppeteer, Figure 1: A centralized orchestrator activates one agent per step; the serialized trace reconstructs into graphs that may contain cycles.

EvoMAC, Figure 2: Textual backpropagation: unit-test feedback becomes textual gradients that rewrite prompts, remove finished agents, add missing ones, and rewire edges between iterations.

8. Evaluation practices and their limits

The claims of this field are accuracy-and-cost claims, so the evaluation settings deserve the same scrutiny as the algorithms — and a close verification pass over the corpus turns up systematic patterns a reader should carry into every comparison table. This section summarizes the five that matter most; none of them is an accusation of misconduct, but together they bound how much any single headline number should move a research decision.

8.1 The shared benchmark set, and what it can no longer separate

Eight of the core papers — AgentPrune, G-Designer, AgentDropout, AnyMAC, ARG-Designer, and with small variations MasRouter, AMAS, and MaAS — evaluate on the same six benchmarks: MMLU (multi-subject knowledge questions), GSM8K (grade-school math word problems), MultiArith and SVAMP (simpler arithmetic word problems), AQuA (algebraic multiple choice), and HumanEval (Python function completion). The set was inherited by citation: each paper adopts its predecessors' harness to stay comparable, which is legitimate — but the harness has aged. MultiArith and SVAMP now sit above 92% for nearly every method in every table, and successive state-of-the-art claims move the six-benchmark average by fractions of a point (AnyMAC 90.62 versus G-Designer 89.84, both as average accuracy over the six sets).

The practical consequence: within this harness, the accuracy ranking no longer separates methods — the cost column does. The two figures below make the point directly: in both papers' own plots, the learned-topology methods cluster within one or two accuracy points while differing by multiples in prompt-token consumption. The suites that still separate methods on accuracy are the agentic ones — GAIA tool-use levels (where MaAS's 20.69 average versus GPTSwarm's 16.33 leaves enormous headroom), TravelPlanner (best published pass rate 32.2), and software-level rSDE-Bench (Website-Advanced at 65.05%) — and only a minority of papers evaluate there.

G-Designer, Figure 5: Token consumption versus accuracy across four benchmarks: methods differ far more on the cost axis than on the accuracy axis.

AgentPrune, Figure 5: Accuracy versus prompt-token cost on MMLU/HumanEval/GSM8K: pruned topologies hold accuracy at a fraction of the tokens.

8.2 How little data the structures learn from — and how much noise the margins carry

A striking regularity of this literature is how small the structure-optimization sets are. The table below collects the reported numbers. Read it in two directions: as a sample-efficiency achievement (a topology that transfers from 40 examples is nearly free to obtain), and as a statistical warning (the same papers report method margins of one point or less on test sets of a few hundred items).

The noise arithmetic is worth stating once, because it applies to every comparison table in this field. For a benchmark of n items where a method's true accuracy is p, the standard deviation of the measured accuracy is $\sqrt{p(1-p)/n}$. On GSM8K's 1,319-item test set at p≈0.95 that is about 0.6 percentage points — margins above one point are meaningful. On AQuA's 254 items at p≈0.8 it is 2.5 points; on a 25-item crossword test set at p≈0.5 it is 10 points. Several of the reported method-over-method margins in Sections 3–4 (one point or less) therefore sit at or inside one standard deviation of pure sampling noise, and none of the six-benchmark papers reports significance tests — most average over three runs at best.

8.3 The split-hygiene ledger

The verification pass behind this survey classified every core paper's train/test protocol into three buckets. The table below is that ledger; it is a documentation judgment, not an accusation — a paper lands in the middle bucket when its text does not allow the optimize-versus-report boundary to be reconstructed.

What a clean protocol looks like is already demonstrated inside the corpus: ADAS's ARC setup (an explicit 20-item validation and 60-item test split, searched only on validation), and MASS's per-task 50–60-item validation with disjoint 100–200-item test sets. The missing standard is a three-way protocol — a search split, a selection split, and a once-only sealed test — plus one cross-domain transfer test, which only ADAS, MaAS, AgentDropout, and SwarmAgentic attempt in any form.

8.4 What the cost column measures — and the search bill it hides

Inference-side economy is the field's best-reported number: token reductions, dollar costs per benchmark run, Pareto fronts. What headline tables often omit is the one-time bill paid before the first efficient inference: AFlow's 20 MCTS rounds each execute the candidate five times on validation; SwarmAgentic evaluates 5 particles for 10 iterations; ADAS runs 25–30 meta-iterations per domain. The table collects the numbers that are actually disclosed — comparable only within a row's own setting, but jointly they show the range: from a few dollars (MaAS, GPTSwarm, ScoreFlow) to hundreds per domain (ADAS, as reconstructed by the Sol review).

Two further gaps close this subsection. First, per-query generators amortize honestly (MAS-GPT prices its generation at roughly half an executor call), but the field lacks a standard total-cost-to-first-useful-deployment metric that would make search-based and generator-based methods comparable. Second — the bridge to Section 9 — every one of these costs is an API-token bill: no paper reports time-to-first-token, prefill/decode breakdowns, or cache behavior, so the serving-tier cost of a dynamic topology is simply unmeasured. The Puppeteer training curve below is the closest thing the corpus has to a cost trajectory, and it is still denominated in tokens.

AFlow, results figure: Benchmark results of AFlow-discovered workflows against manual and automated baselines.

Puppeteer, Figure 2: Token consumption and agent count decline over RL training while accuracy rises — cost and structure co-evolving.

8.5 Prompts versus topology: reading the one ablation that separates them

Most systems in this survey co-optimize prompts and topology, which confounds every headline number: when a joint system reports +15 points, how much did the topology actually contribute? MASS is the one paper that staged its optimization so the question has an answer, and the answer deserves to be seen rather than quoted. The chart below re-plots its ablation: prompt-side stages contribute roughly eleven points; the topology stage contributes about three; a final global prompt pass adds one more.

MASS, Figure 5: The paper's own per-stage gains, consistent with the re-plot above.

The implication cuts both ways. It does not say topology is worthless — three points on a saturating harness is real, and the pruning line shows topology dominates the cost axis. It says comparisons must hold prompts fixed before crediting topology, and that a paper claiming a topology advantage while co-tuning prompts has not yet demonstrated one. The strong-single-model question sharpens the same point from outside: the prompting baseline PHP appears above or near several MAS systems in the shared tables, and no paper in this corpus runs the dedicated equal-budget comparison against one stronger single model that would settle when a dynamic MAS is worth running at all.

8.6 Where the field actually plays: application scenarios

Benchmarks answer what is measured; scenarios answer what these systems are for. Classifying the 22 core papers by application domain — under a strict rule where a paper counts as dynamic-structure only if membership, roles, routing, or workflow is selected per task or revised from execution feedback — produces a sharply skewed picture. The table reads left to right: the scenario, which core papers evaluate there, how open the scenario still is, and the strongest verified 2025–2026 domain-specific dynamic-MAS additions found in a dedicated verification pass (GPT-5.6-Sol, ultra reasoning, primary sources fetched 2026-07-21).

(scroll right for more columns →)

Three readings of the table matter. First, the skew is extreme: math and puzzles (18 of 22 papers), function-level coding (17), and knowledge QA (16) absorb nearly all evaluation effort, while repository-level software engineering, long-horizon planning, and open-ended generation get two papers each, medicine one, and scientific discovery, legal, and finance zero. Second, the gaps are closing from outside the core corpus: MDAgents is no longer the only dynamic medical MAS — KAMAC recruits specialists when it detects knowledge gaps, DynamiCare changes team composition while interactively querying a patient simulator, and MMedAgent-RL learns case-to-specialty triage with reinforcement learning — and legal now has an ACL 2026 Main paper (JurisMA, dynamic routing over a legal-element graph). Third, a definitional caution the classification enforces: answering GPQA or SciBench questions is science QA, not scientific discovery — no core paper demonstrates experiment selection, executable analysis, or iterative hypothesis revision, which is why the discovery row is genuinely empty rather than mislabeled.

8.7 The 2026 benchmark frontier: what replaced the saturated harness

Section 8.1 diagnosed saturation; this subsection names the replacements, with official-leaderboard evidence (fetched 2026-07-21). The retirements first: the original GAIA — the general-assistant suite used by GPTSwarm and MaAS — now stands at 93.36% on its official board and has been succeeded by Gaia2; ARC-AGI-2 reached 92.5% and gave way to ARC-AGI-3; AIME 2025 is at 100%; and OpenAI formally retired SWE-bench Verified after an audit found material issues in 59.4% of sampled hard tasks. The table lists the currently discriminative frontier; the frontier-score column is the saturation signal — read a low number as headroom.

(scroll right for more columns →)

Two rows deserve emphasis because they measure this survey's subject directly rather than by proxy. TeamBench publishes solo and team columns for the same backbone under OS-enforced role isolation — the first mainstream benchmark where 'does the team structure help at all?' is a reported number (currently +2.2 points, which is itself sobering). SILO-BENCH sweeps communication topology and team size explicitly, and its headline finding — zero success on its hardest tier beyond 50 agents even when the needed information is collectively present — is the kind of coordination-limit evidence the six-benchmark harness cannot produce in principle. The adoption column carries the strategic message: across twelve frontier benchmarks, verified dynamic-MAS adoption amounts to a handful of subset or self-reported entries (DreamTeam, MLEvolve, Mimosa, AgentFlow, WebSwarm). The field whose thesis is that structure should adapt has not yet moved its evaluation to the environments where adaptation would matter most — which makes frontier-benchmark adoption both the clearest open opportunity and the most credible next differentiator for any new paper in this line. A practical five-benchmark slate for a 2026 dynamic-MAS paper: Gaia2-CLI (online rerouting under exogenous events), ARC-AGI-3 (exploration and strategy switching), TeamBench (does the generated team justify itself), SILO-BENCH (coordination cost isolated), and OSWorld 2.0 (long-horizon multimodal execution) — all state-verified, all with large headroom.

For readers who track venue signals, the table below lists every presentation tier that survived verification against an official conference page. Tiers that the venue does not publish (ACL, EMNLP, COLM, IJCAI publish acceptance but not oral/poster distinctions in their public records) are omitted rather than guessed — an omission here means 'not verifiable', not 'poster'.

9. What this means for the serving tier (and KV-cache communication)

This site approaches agentic AI from the infrastructure side, so the closing question is what dynamic architectures mean for the systems that serve them. In LLM inference, the KV cache is the per-token attention state a model builds while reading a context; serving stacks avoid recomputing it by reusing cached prefixes, and an emerging research line extends that reuse across agents — passing representation-level state instead of re-encoding text. Dynamic topology interacts with that machinery directly, in three ways.

First, the timing taxonomy of Section 2 is precisely a cache-reusability taxonomy. An offline-frozen graph fixes the communication pattern across all queries, so agent-pair prefixes are stable, precomputable, and amortizable. A per-query graph is known only after the controller pass — reuse machinery must either react to the emitted graph (just-in-time placement) or be integrated into the generator's objective. A per-round graph is the hard case: a message's future readers are unknown at the moment its KV state is produced, which forecloses precomputation and makes incremental, lineage-tracked handoff the only viable design. Second, the field's own token-cost pressure is pushing topologies toward shapes that representation-level communication happens to favor: AnyMAC's cascade, Puppeteer's one-agent-per-step policy, and MaAS's layer-by-layer sampling all serialize communication into a growing single context — the monotone-prefix pattern that cache handoff exploits best — while the pruning line keeps cutting exactly the many-to-one context assemblies where naive cache concatenation is known to fail.

Third — and this is the open slot — every cost-aware objective in this literature prices tokens or API calls, and none prices the serving tier. MaAS's $C(G;q)$, MasRouter's cost term, Puppeteer's per-step penalty, and AnyMAC's length decay do not distinguish a token that hits a warm prefix cache from one that forces a cold prefill, and none models the cost of moving cached state between agents on different workers. A topology objective whose cost model is serving-aware — rewarding structures whose communication pattern maximizes prefix-cache hits or minimizes state-transfer volume — is a well-posed, unclaimed extension: the optimization machinery is already standard in eight of the papers above, and only the cost model needs replacing. Symmetrically, no paper in the roughly 55 verified here reports time-to-first-token, prefill/decode breakdowns, or cache behavior; a model-fixed, harness-fixed comparison of dynamic-versus-static topologies at the serving tier remains unwritten.

10. Where to go next

For a reader entering this area cold, four papers repay full reads before anything else, in this order: GPTSwarm (the origin of learned edges, and equation (1) above), MaAS (the supernet and cost-aware per-query sampling, equation (9)), AFlow (code-space search and the strongest cost result), and MDAgents (proof that adaptivity needs no training). After those four, MAST explains why any of this matters operationally, and MASS's staged ablation calibrates how much of any joint system's gain to attribute to topology. The frontier to watch in 2026: graph-diffusion topology generators (GTD at ACL 2026, RADAR at ICML 2026), group-relative RL stabilization for topology learning (Graph-GRPO), and test-time co-evolution of structure and capability (TacoMAS, AgentNet, SafeSieve).

This survey page condenses three underlying documents, each now available as its own page: the two independent reviews (written blind to each other) and the synthesis that adjudicates their disagreements against primary sources.

Three further resources support this page: the structured per-paper comparison table, the arXiv entry points for the most-cited systems, and the serving-side background pages this survey assumes.