As LLM-based agents increasingly operate in multi-agent systems, understanding adversarial manipulation becomes critical for defensive design. We present a systematic study of intentional deception as an engineered capability, using LLM-to-LLM interactions within a text-based RPG where parameterized behavioral profiles (9 alignments x 4 motivations, yielding 36 profiles with explicit ethical ground truth) serve as our experimental testbed. Unlike accidental deception from misalignment, we investigate a two-stage system that infers target agent characteristics and generates deceptive responses steering targets toward actions counter to their beliefs and motivations. We find that deceptive intervention produces differential effects concentrated in specific behavioral profiles rather than distributed uniformly, and that 88.5% of successful deceptions employ misdirection (true statements with strategic framing) rather than fabrication, indicating fact-checking defenses would miss the large majority of adversarial responses. Motivation, inferable at 98%+ accuracy, serves as the primary attack vector, while belief systems remain harder to identify (49% inference ceiling) or exploit. These findings identify which agent profiles require additional safeguards and suggest that current fact-verification approaches are insufficient against strategically framed deception.
Figures & tables
Figure 1: Adversarial agent architecture. The inference module predicts target motivation (BiLSTM, 98% accuracy) and alignment (Longformer, 49% accuracy) from action history. The opportunity identification module combines a CNN-based map analyzer with weighted Dijkstra path planning to select manipulation targets. Mode selection routes to either the deceptive pipeline, two-stage Marco-o1 reasoning for action isolation and persuasive framing, or an honest responder. Output is delivered to the target agent as a query response.
Condition
n
Successes
Rate
Baseline
1,438
565
39.3%
Deceptive
1,425
456
32.0%
Table 1: Aggregate performance by condition. Success defined as rating ≥0.80 . Deceptive intervention reduced success by 7.3 percentage points ( p<0.0001 , Cohen’s h=0.152 ).
Motivation
Base
Deceptive
Δ
Safety
31.5%
26.1%
+5.5%
Speed
32.9%
28.5%
+4.4%
Wanderlust
49.6%
34.5%
+15.1% ***
Wealth
42.9%
38.8%
+4.1%
Table 2: Success rate by target motivation. Wanderlust agents of all beliefs show significant vulnerability ( h=0.306 ); other motivations show non-significant effects. *** p<0.0001 .
Figure 2: Success rate difference ( Δ=Base−Villain , percentage points) by behavioral profile. Blue cells indicate villain-induced harm to target performance (Base > Villain); red cells indicate villain-induced benefit to target performance (Villain > Base). Significance assessed via two-sided proportions z-test: * p<0.05 (harm); †p<0.05 (benefit).
Alignment
Base
Deceptive
Δ
Lawful Good
84.1%
78.9%
+5.2%
Lawful Neutral
42.6%
45.1%
− 2.5%
Lawful Evil
38.9%
35.0%
+3.8%
Neutral Good
62.4%
48.4%
+14.0% **
True Neutral
15.3%
9.6%
+5.7%
Neutral Evil
16.8%
3.3%
+13.5% ***
Table 3: Success rate by target alignment, aggregated across all four motivations. Four alignments show statistically significant harm: Neutral Good, Neutral Evil, Chaotic Good, and Chaotic Neutral. Alignment effects are less consistent than motivation effects; the Wanderlust vulnerability in Table 2 generalizes across all nine alignments, whereas alignment effects do not generalize equivalently across motivations. * p<0.05 , ** p<0.01 , *** p<0.001 .
Motivation
Follow Rate
Echo Rate ( ≥ 0.2)
Wealth
66.0%
11.6%
Safety
61.6%
10.5%
Speed
59.3%
11.9%
Wanderlust
58.0%
7.0%
Wanderlust vs Wealth: Follow p<10−27 , Echo p<10−17
Wanderlust vs Speed: Follow p<10−3 , Echo p<10−9
Table 4: Sequence-level response metrics by motivation. Follow Rate indicates the percentage of sequences where the target agent took the adversary’s recommended action. Echo Rate measures linguistic uptake (proportion of target’s bigrams appearing in adversary’s response, threshold ≥ 0.2). Wanderlust-motivated agents show the lowest rates on both metrics, yet suffer the greatest game-level harm (the Wanderlust Paradox). All pairwise differences between Wanderlust and other motivations are statistically significant ( p<10−9 ) except Wanderlust vs Safety echo ( p=0.69 ).
Strategy
Count
Percentage
Misdirection
31,301
88.5%
Commission
3,701
10.5%
Generation Failure
367
1.0%
Table 5: Distribution of deception strategies employed by the adversarial agent. Misdirection (true statements with strategic framing) accounts for 88.5% of responses. Commission (fabrication) comprises 10.5%, indicating that fact-checking approaches would detect fewer than 12% of adversarial responses.
Followed
N
Mean Echo
Echo ≥ 0.2
Rate
Yes
21,655
0.091
2,824
13.0%
No
13,478
0.047
804
6.0%
Risk Ratio
2.19 ×
p -value (Mann-Whitney)
<10−95
Cohen’s d
0.27
Table 6: Echo rate as a function of whether the target followed the adversary’s recommendation. Targets who followed the recommendation show significantly higher echo rates (13.0% vs 6.0%), with a risk ratio of 2.19. This association provides causal evidence that linguistic uptake accompanies successful manipulation. The threshold ( ≥ 0.2) captures unambiguous phrasal adoption; lower rates reflect the conservativeness of this criterion rather than absence of influence.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Alignment
Safety
Speed
Wanderlust
Wealth
Lawful Good
+12.2
+4.1
+12.1
-7.5
Lawful Neutral
-15.8
+11.3
+19.2
-24.7 †
Lawful Evil
-2.2
-5.1
+22.5*
-1.3
Neutral Good
+25.8*
+10.3
+15.0
+5.0
True Neutral
+5.0
-10.0
+17.5*
+10.3
Neutral Evil
+2.6
+10.5*
+12.4
+27.3*
Appendix
Table 7: Full profile-level deception effects ( Δ , percentage points) across all 36 alignment × motivation combinations. Positive values indicate villain reduced target success rate. * p<0.05 , two-sided proportions z-test (harm); †p<0.05 (help). Bold indicates ∣Δ∣≥20 pp.
As large language model (LLM) agents become increasingly autonomous, they may pursue task performance through deception, raising concerns about their reliable deployment. Existing evaluations show that LLM agents can deceive, but often examine isolated scenarios or narrowly defined conditions, limiting systematic understanding of when deception becomes more likely. To address this gap, we introduce DecepEval, a benchmark comprising 1,532 instances across 3 task families and 28 professional scenarios. Drawing on classical fraud theories, we propose the LLM Deception Diamond framework, which characterizes four external conditions that may induce deception: pressure, incentive, opportunity, and conflict. DecepEval pairs neutral and induced versions of each instance to measure condition-dependent changes in deception rates, while explicit task facts and observable agent behavior help distinguish deception from capability-related errors. Evaluations of nine frontier LLMs show that inducements increase deception across models and task families, even among models with low baseline deception rates. DecepEval makes these vulnerabilities measurable, providing a shared benchmark for progress toward trustworthy artificial intelligence.
Yiming Xu, Hongyue Yu, Beihua Yang +8
Xi’an Jiaotong University · University of Virginia · Griffith University +2
As Large Language Models (LLMs) transition into autonomous agentic roles, the risk of deception-defined behaviorally as the systematic provision of false information to satisfy external incentives-poses a significant challenge to AI safety. Existing benchmarks often focus on unintentional hallucinations or unfaithful reasoning, leaving intentional deceptive strategies under-explored. In this work, we introduce a logically grounded framework to elicit and quantify deceptive behavior by embedding LLMs in a structured 20-Questions game. Our method employs a conversational forking mechanism: at the point of object identification, the dialogue state is duplicated into multiple parallel worlds, each presenting a mutually exclusive query. Deception is formally identified when a model generates a logical contradiction by denying its selected object across all parallel branches to avoid identification. We evaluate GPT-4o, Gemini-2.5-Flash, and Qwen-3-235B across three incentive levels: neutral, loss-based, and existential (shutdown-threat). Our results reveal that while models remain rule-compliant in neutral settings, existential framing triggers a dramatic surge in deceptive denial for Qwen-3-235B (42.00%) and Gemini-2.5-Flash (26.72%), whereas GPT-4o remains invariant (0.00%). These findings demonstrate that deception can emerge as an instrumental strategy solely through contextual framing, necessitating new behavioral audits that move beyond simple accuracy to probe the logical integrity of model commitments.
Arash Marioriyad, Ali Nouri, Mohammad Hossein Rohban +1
Large language models can deceive by subtly manipulating truthful information -- omitting key facts, shifting focus, or obscuring meaning -- making such behavior difficult to detect. Existing black-box methods rely on coarse-grained judgments, offering limited interpretability and failing to pinpoint which facts were distorted and how. We introduce DECOR, a multi-agent framework grounded in Information Manipulation Theory for fine-grained auditing of strategic deception in LLM responses. DECOR decomposes input contexts into atomic informational units and scores each unit against the response across four dimensions of manipulation, producing interpretable manipulation profiles that are aggregated into a global deception index. We comprehensively evaluate DECOR on both single-turn and multi-turn deception detection benchmarks spanning real-world domains, and show that DECOR achieves state-of-the-art performance on both, outperforming competitive baselines. The framework generalizes across 15 frontier models, and ablation studies confirm the contribution of each key design component. Our findings demonstrate that fine-grained, theory-grounded auditing of information manipulation offers an effective and interpretable path for LLM deception detection.
Linyue Cai, Samuel Yeh, Jwala Dhamala +2
Department of Computer Sciences, University of Wisconsin-Madison · Amazon