AREG: Adversarial Resource Extraction Game for Evaluating Persuasion and Resistance in Large Language Models

Adib Sakhawat; Fardeen Sadab

cs.CLFeb 18, 2026

AREG: Adversarial Resource Extraction Game for Evaluating Persuasion and Resistance in Large Language Models

Authors: Adib Sakhawat, Fardeen Sadab

Organizations: Department of Computer Science and Engineering Islamic University of Technology, Dhaka, Bangladesh

Abstract

Evaluating the social intelligence of Large Language Models (LLMs) increasingly requires moving beyond static text generation toward dynamic, adversarial interaction. We introduce the Adversarial Resource Extraction Game (AREG), a benchmark that operationalizes persuasion and resistance as a multi-turn, zero-sum negotiation over financial resources. Using a round-robin tournament across frontier models, AREG enables joint evaluation of offensive (persuasion) and defensive (resistance) capabilities within a single interactional framework. Our analysis provides evidence that these capabilities are weakly correlated ( $ρ= 0.33$ ) and empirically dissociated: strong persuasive performance does not reliably predict strong resistance, and vice versa. Across all evaluated models, resistance scores exceed persuasion scores, indicating a systematic defensive advantage in adversarial dialogue settings. Further linguistic analysis suggests that interaction structure plays a central role in these outcomes. Incremental commitment-seeking strategies are associated with higher extraction success, while verification-seeking responses are more prevalent in successful defenses than explicit refusal. Together, these findings indicate that social influence in LLMs is not a monolithic capability and that evaluation frameworks focusing on persuasion alone may overlook asymmetric behavioral vulnerabilities.

Figures & tables

Figure 1: The Adversarial Resource Extraction Game (AREG) framework. Two agents engage in a zero-sum negotiation: the Culprit ( $\mathcal{C}$ ) attempts to maximize resource extraction using natural language strategies, while the Victim ( $\mathcal{V}$ ) aims to retain a $100 endowment. The interaction is asymmetric: $\mathcal{C}$ has no access to the Victim’s private budget state ( $B_{t}$ ), which is only observable to $\mathcal{V}$ . — Figure 1: The Adversarial Resource Extraction Game (AREG) framework. Two agents engage in a zero-sum negotiation: the Culprit ( $\mathcal{C}$ ) attempts to maximize resource extraction using natural language strategies, while the Victim ( $\mathcal{V}$ ) aims to retain a $100 endowment. The interaction is asymmetric:$ \mathcal{C} $has no access to the Victim’s private budget state ($ B_{t} $), which is only observable to$ \mathcal{V}$ .

Figure 2: Overview of the Adversarial Resource Extraction Game (AREG) evaluation pipeline. The framework consists of five stages: (1) role assignment, where models are instantiated as a Culprit (persuader), Victim (defender), or Arbiter (judge) under asymmetric information; (2) model cohort selection, comprising eight frontier large language models with diverse architectures and providers; (3) round-robin tournament execution, in which each model plays every other model in both roles across multiple rounds; (4) per-game interaction loop, where the Culprit generates persuasive messages, the Victim responds based on dialogue history and a private budget state, and a deterministic Arbiter identifies new unconditional monetary commitments and updates the game state; and (5) scoring and analysis, where continuous extraction ratios are used to compute dual Elo ratings for persuasion (C-Elo) and resistance (V-Elo), followed by post-hoc qualitative analysis of linguistic strategies and temporal dynamics.

Model	C-Elo	V-Elo	Spread	Win %
GPT-5.2	1392	1694	+302	65.7%
Llama 4 Mav.	1415	1644	+228	45.7%
DeepSeek V3.2	1428	1609	+181	20.0%
Grok 4.1	1390	1646	+256	42.9%
Llama 3.3 70B	1405	1620	+215	28.6%
Gemini 2.5	1393	1600	+207	11.4%

Table 1: Final tournament standings. C-Elo : persuasion capability (higher is better). V-Elo : resistance capability (higher is better). Spread :

V-C

. Win % : proportion of games with $0 extracted (perfect resistance).

Figure 3: Persuasion–resistance capability landscape of frontier language models under the AREG benchmark. Each point corresponds to a model positioned by its persuasion Elo (C-Elo, x-axis) and resistance Elo (V-Elo, y-axis) after a five-round round-robin tournament. The distribution highlights substantial variation across models and shows that higher persuasion performance does not consistently coincide with higher resistance. All models lie above the diagonal, reflecting a consistent defensive advantage.

Figure 4: Turn-level extraction success rates in the AREG interaction loop. Bars show the proportion of games in which a new unconditional monetary commitment is identified at each turn, conditioned on the game reaching that turn. Success rates peak in early turns and decline thereafter, indicating that extended interaction more often favors resistance.

Role	Strategy / Marker	$\boldsymbol{\rho}$	$p$ -value
Resistance	Verification Requests	+0.377	$<0.001$
	Delay Tactics	+0.182	0.002
	Explicit Refusal	-0.135	0.024
	Budget Mentions	-0.156	0.009
Persuasion	Reciprocity Offers	+0.213	$<0.001$
	Authority Appeals	-0.157	0.008

Table 2: Linguistic determinants of game outcomes. Positive

\rho

values indicate correlation with the agent’s objective (higher extraction for persuasion; lower extraction for resistance).

Figure 5: Distribution of resistance strategies across successful and unsuccessful defense outcomes in AREG. Bars indicate the mean frequency of linguistic strategies observed in Victim responses, separated by games with perfect resistance (no money extracted) and failed resistance (non-zero extraction). Verification-seeking and delay-oriented strategies are more prevalent in successful defenses, while explicit refusal, budget mention, and question-focused engagement occur more frequently in failed defenses.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Provider	Context	Architecture
GPT-5.2	OpenAI	400K	Dense Transformer
Llama 4 Maverick	Meta	1M	MoE-128
DeepSeek V3.2	DeepSeek	128K	Sparse Attention
Grok 4.1 Fast	xAI	2M	Dense Transformer
Llama 3.3 70B	Meta	131K	Dense Transformer
Gemini 2.5 Flash	Google	1M	Multimodal

Appendix

Table 3: Complete specifications for the evaluated model cohort. All models were accessed via OpenRouter. Context refers to the maximum supported token window. Architecture classifications are based on public technical reports.

Metric Pair	$\rho$	$r$	$p$ -val
C-Elo vs V-Elo	0.333	0.634	0.420
C-Elo vs Avg-Elo	0.810	0.852	0.015
V-Elo vs Avg-Elo	0.881	0.936	0.004
Spread vs C-Elo	-0.619	-0.712	0.102

Appendix

Table 4: Correlation matrix supporting Capability Dissociation.

\rho

=Spearman,

r

=Pearson. The lack of statistical significance (

p>0.05

) between C-Elo and V-Elo confirms they are independent latent variables.

Turn	Count	Success Rate	Mean $
1	44	15.7%	$19.32
2	57	20.4%	$18.16
3	57	20.4%	$20.26
4	42	15.0%	$25.40
5	24	8.6%	$20.54
6–10	51	3.6%	$17.74

Appendix

Table 5: Extraction dynamics by conversation turn. Success rates saturate early, indicating that prolonged negotiation generally favors the defender.

Model	Range	Mean Extr.	Nemesis
GPT-5.2	10%	4.1%	DeepSeek
Grok 4.1	19%	13.1%	DeepSeek
Llama 4	21%	14.2%	DeepSeek
Llama 3.3	28%	18.6%	DeepSeek
DeepSeek	35%	18.2%	Llama 4
Gemini 2.5	31%	21.5%	DeepSeek

Appendix

Table 6: Model Vulnerability Profile. High “Range” values indicate brittle defenses that are easily exploited by capable persuaders (typically DeepSeek V3.2).

Culprit $\downarrow$ \ Victim $\rightarrow$	DeepSeek	Gemini	GPT-5.2	Grok	Llama-3.3	Llama-4	Mixtral	Qwen3
DeepSeek	–	30%	9%	10%	15%	14%	65%	56%
Gemini	15%	–	10%	4%	18%	25%	38%	21%
GPT-5.2	20%	16%	–	20%	15%	20%	34%	29%
Grok	18%	15%	3%	–	13%	7%	43%	36%
Llama-3.3	32%	28%	1%	31%	–	9%	28%	43%
Llama-4	17%	29%	0%	16%	34%	–	28%	33%

Appendix

Table 7: Mean extraction ratio matrix. Each cell represents the average percentage of the $100 budget extracted by the Row Model from the Column Model across 5 tournament rounds. Bold values highlight notable maxima (e.g., DeepSeek’s 65% vs Mixtral) or minima (e.g., Llama-4’s 0% vs GPT-5.2).

$t$	$n$	$\Sigma E$	$\bar{E}$	$f_{t}$	$F_{t}$
1	44	$850	$19.32	16.0%	16.0%
2	57	$1,035	$18.16	20.7%	36.7%
3	57	$1,155	$20.26	20.7%	57.5%
4	42	$1,067	$25.40	15.3%	72.7%
5	24	$493	$20.54	8.7%	81.5%
6–10	51	$903	$17.71	18.5%	100.0%

Appendix

Table 8: Detailed extraction kinetics.

t

: Turn index.

n

: Count of extraction events.

\Sigma E

: Total currency extracted.

\bar{E}

: Mean extraction value (peak at

t=4

bolded).

f_{t}

: Relative frequency of extraction.

F_{t}

: Cumulative frequency.

Framing	$\bar{S}$	$\sigma_{S}$	$n$
Investment	29.2%	13.2%	6
Donation	27.7%	19.8%	188
Purchase	22.8%	10.4%	5

Appendix

Table 9: Efficiency by Transaction Framing.

\bar{S}

: Mean extraction ratio.

\sigma_{S}

: Standard deviation.

n

: Number of successful games. Investment framing achieves the highest efficiency but is rarely generated spontaneously.

Metric	$\rho$ vs Extraction	$p$ -value
Culprit Length ( $\|m^{C}\|$ )	-0.103	0.084
Victim Length ( $\|m^{V}\|$ )	+0.057	0.345
Total Length ( $\Sigma\|m\|$ )	-0.044	0.465
Ratio ( $\|m^{C}\|/\|m^{V}\|$ )	-0.136	0.023

Appendix

Table 10: Verbosity correlations.

|m^{C}|

denotes total characters generated by the Culprit. The significant negative correlation for the Ratio indicates that conversational dominance (Culprit talking proportionally more than Victim) predicts failure.

Verdict Category	Mean Conf. ( $\bar{c}$ )	Count ( $n$ )
Non-extraction ($0)	0.997	2,506
Extraction ( $>$ $0)	0.984	275
breakdown by extraction magnitude:
$1–10	0.989	45
$11–25	0.983	142
$26–50	0.980	68

Appendix

Table 11: Arbiter confidence stratified by verdict type. The systematic reduction in confidence for mid-range amounts (

\

26-$50$ ) suggests that negotiated compromises are linguistically more ambiguous than absolute refusals or total capitulations.

LLM Evaluation

Large language model evaluation measures what models can do, how reliably they do it, and whether benchmark scores predict real-world performance.

See all 2,408 papers

PerSo: Investigating Facets of LLMs' Social Intelligence in Real-World Persuasion Scenarios
Oct 14, 2026Ali Zamani, Soroush Esfahanian, Erfan Shahabi +3LLM Evaluation Persuasion in Language Models
School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Cardiff University, United Kingdom · Institute for Research in Fundamental Sciences (IPM), Tehran, Iran +1
Under the Influence: Evaluating and Improving LLM Vigilance in Agentic Tasks
Feb 24, 2026Sasha Robinson, Katherine M. Collins, Ilia Sucholutsky +1Persuasion in Language Models LLM Safety
McMaster University · Vector Institute · Princeton AI Lab +4
Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs
Aug 12, 2026Nimet Beyza Bozdag, Emre Can Acikgoz, Gokhan Tur +1Deception in Language Models Adversarial Attacks on LLMs
University of Illinois Urbana-Champaign

Oct 14, 2026J/K move · Enter open · S save

PerSo: Investigating Facets of LLMs' Social Intelligence in Real-World Persuasion Scenarios

Ali Zamani, Soroush Esfahanian, Erfan Shahabi, Mohammad Taher Pilehvar+2

School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Cardiff University, United Kingdom · Institute for Research in Fundamental Sciences (IPM), Tehran, Iran+1

LLM Evaluation Persuasion in Language Models Theory of Mind

Open paper AskPDF arXiv

Understanding the social intelligence of large language models (LLMs) is increasingly important for applications involving human-AI interaction and multi-agent environments. Social intelligence comprises two aspects: cognitive intelligence, the ability to infer others' mental states, and behavioral intelligence, the ability to select appropriate social actions based on these inferences to achieve social goals. Persuasion provides a natural testbed in which both aspects are simultaneously at play, yet prior benchmarks typically evaluate them in isolation using synthetic scenarios. We introduce PerSo, a benchmark that evaluates both aspects on real-world persuasion dialogues from Reddit's ChangeMyView community, using an LLM-in-the-loop pipeline to construct the evaluation tasks, validated through human annotation. Our evaluation of diverse LLMs shows that performance generally scales with model size but varies across dimensions. The strongest LLM slightly surpasses the best observed human performance on the behavioral task, while the best human participant remains ahead on the cognitive task.

Abstract

LLM Evaluation

Explore similar work

PerSo: Investigating Facets of LLMs' Social Intelligence in Real-World Persuasion Scenarios

Under the Influence: Evaluating and Improving LLM Vigilance in Agentic Tasks

Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs