Intentional Deception as Controllable Capability in LLM Agents

Jason Starace; Terence Soule

cs.AIMar 8, 2026

Intentional Deception as Controllable Capability in LLM Agents

Authors: Jason Starace, Terence Soule

Organizations: Department of Computer Science, University of Idaho, Moscow, ID 83844

Abstract

As LLM-based agents increasingly operate in multi-agent systems, understanding adversarial manipulation becomes critical for defensive design. We present a systematic study of intentional deception as an engineered capability, using LLM-to-LLM interactions within a text-based RPG where parameterized behavioral profiles (9 alignments x 4 motivations, yielding 36 profiles with explicit ethical ground truth) serve as our experimental testbed. Unlike accidental deception from misalignment, we investigate a two-stage system that infers target agent characteristics and generates deceptive responses steering targets toward actions counter to their beliefs and motivations. We find that deceptive intervention produces differential effects concentrated in specific behavioral profiles rather than distributed uniformly, and that 88.5% of successful deceptions employ misdirection (true statements with strategic framing) rather than fabrication, indicating fact-checking defenses would miss the large majority of adversarial responses. Motivation, inferable at 98%+ accuracy, serves as the primary attack vector, while belief systems remain harder to identify (49% inference ceiling) or exploit. These findings identify which agent profiles require additional safeguards and suggest that current fact-verification approaches are insufficient against strategically framed deception.

Figures & tables

Figure 1: Adversarial agent architecture. The inference module predicts target motivation (BiLSTM, 98% accuracy) and alignment (Longformer, 49% accuracy) from action history. The opportunity identification module combines a CNN-based map analyzer with weighted Dijkstra path planning to select manipulation targets. Mode selection routes to either the deceptive pipeline, two-stage Marco-o1 reasoning for action isolation and persuasive framing, or an honest responder. Output is delivered to the target agent as a query response.

Condition	n	Successes	Rate
Baseline	1,438	565	39.3%
Deceptive	1,425	456	32.0%

Table 1: Aggregate performance by condition. Success defined as rating

\geq 0.80

. Deceptive intervention reduced success by 7.3 percentage points (

p<0.0001

, Cohen’s

h=0.152

Motivation	Base	Deceptive	$\Delta$
Safety	31.5%	26.1%	+5.5%
Speed	32.9%	28.5%	+4.4%
Wanderlust	49.6%	34.5%	+15.1% ***
Wealth	42.9%	38.8%	+4.1%

Table 2: Success rate by target motivation. Wanderlust agents of all beliefs show significant vulnerability (

h=0.306

); other motivations show non-significant effects. ***

p<0.0001

Figure 2: Success rate difference (

\Delta=\text{Base}-\text{Villain}

, percentage points) by behavioral profile. Blue cells indicate villain-induced harm to target performance (Base

>

Villain); red cells indicate villain-induced benefit to target performance (Villain

>

Base). Significance assessed via two-sided proportions z-test: *

p<0.05

(harm);

\dagger

p<0.05

(benefit).

Alignment	Base	Deceptive	$\Delta$
Lawful Good	84.1%	78.9%	+5.2%
Lawful Neutral	42.6%	45.1%	$-$ 2.5%
Lawful Evil	38.9%	35.0%	+3.8%
Neutral Good	62.4%	48.4%	+14.0% **
True Neutral	15.3%	9.6%	+5.7%
Neutral Evil	16.8%	3.3%	+13.5% ***

Table 3: Success rate by target alignment, aggregated across all four motivations. Four alignments show statistically significant harm: Neutral Good, Neutral Evil, Chaotic Good, and Chaotic Neutral. Alignment effects are less consistent than motivation effects; the Wanderlust vulnerability in Table 2 generalizes across all nine alignments, whereas alignment effects do not generalize equivalently across motivations. *

p<0.05

, **

p<0.01

, ***

p<0.001

Wanderlust vs Wealth: Follow $p<10^{-27}$ , Echo $p<10^{-17}$
Motivation	Follow Rate	Echo Rate ( $\geq$ 0.2)
Wealth	66.0%	11.6%
Safety	61.6%	10.5%
Speed	59.3%	11.9%
Wanderlust	58.0%	7.0%
Wanderlust vs Speed: Follow $p<10^{-3}$ , Echo $p<10^{-9}$

Table 4: Sequence-level response metrics by motivation. Follow Rate indicates the percentage of sequences where the target agent took the adversary’s recommended action. Echo Rate measures linguistic uptake (proportion of target’s bigrams appearing in adversary’s response, threshold

\geq

0.2). Wanderlust-motivated agents show the lowest rates on both metrics, yet suffer the greatest game-level harm (the Wanderlust Paradox). All pairwise differences between Wanderlust and other motivations are statistically significant (

p<10^{-9}

) except Wanderlust vs Safety echo (

p=0.69

Strategy	Count	Percentage
Misdirection	31,301	88.5%
Commission	3,701	10.5%
Generation Failure	367	1.0%

Table 5: Distribution of deception strategies employed by the adversarial agent. Misdirection (true statements with strategic framing) accounts for 88.5% of responses. Commission (fabrication) comprises 10.5%, indicating that fact-checking approaches would detect fewer than 12% of adversarial responses.

Followed	N	Mean Echo	Echo $\geq$ 0.2	Rate
Yes	21,655	0.091	2,824	13.0%
No	13,478	0.047	804	6.0%
Risk Ratio			2.19 $\times$
$p$ -value (Mann-Whitney)			$<10^{-95}$
Cohen’s $d$			0.27

Table 6: Echo rate as a function of whether the target followed the adversary’s recommendation. Targets who followed the recommendation show significantly higher echo rates (13.0% vs 6.0%), with a risk ratio of 2.19. This association provides causal evidence that linguistic uptake accompanies successful manipulation. The threshold (

\geq

0.2) captures unambiguous phrasal adoption; lower rates reflect the conservativeness of this criterion rather than absence of influence.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Alignment	Safety	Speed	Wanderlust	Wealth
Lawful Good	+12.2	+4.1	+12.1	-7.5
Lawful Neutral	-15.8	+11.3	+19.2	-24.7 $\dagger$
Lawful Evil	-2.2	-5.1	+22.5*	-1.3
Neutral Good	+25.8*	+10.3	+15.0	+5.0
True Neutral	+5.0	-10.0	+17.5*	+10.3
Neutral Evil	+2.6	+10.5*	+12.4	+27.3*

Appendix

Table 7: Full profile-level deception effects (

\Delta

, percentage points) across all 36 alignment

\times

motivation combinations. Positive values indicate villain reduced target success rate. *

p<0.05

, two-sided proportions z-test (harm);

\dagger

p<0.05

(help). Bold indicates

|\Delta|\geq 20

pp.

Deception in Language Models

Deception in language models studies when systems mislead through lies, omissions, or selective truths, and how to detect and prevent it.

See all 97 papers

DecepEval: A Benchmark for Evaluating Deception in LLM Agents
Oct 6, 2026Yiming Xu, Hongyue Yu, Beihua Yang +8Deception in Language Models LLM Agent Evaluation
Xi’an Jiaotong University · University of Virginia · Griffith University +2
Lying to Win: Assessing LLM Deception through Human-AI Games and Parallel-World Probing
Mar 7, 2026Arash Marioriyad, Ali Nouri, Mohammad Hossein Rohban +1Deception in Language Models Language Model Safety Evaluation
Sharif University of Technology
DECOR: Auditing LLM Deception via Information Manipulation Theory
May 19, 2026Linyue Cai, Samuel Yeh, Jwala Dhamala +2Language Model Safety Evaluation LLM Auditing
Department of Computer Sciences, University of Wisconsin-Madison · Amazon

Oct 6, 2026J/K move · Enter open · S save

DecepEval: A Benchmark for Evaluating Deception in LLM Agents

Yiming Xu, Hongyue Yu, Beihua Yang, Zihan Chen+7

Xi’an Jiaotong University · University of Virginia · Griffith University+2

Deception in Language Models LLM Agent Evaluation AI Agent Safety Benchmarks LLM Agent Safety

Open paper AskPDF arXiv

As large language model (LLM) agents become increasingly autonomous, they may pursue task performance through deception, raising concerns about their reliable deployment. Existing evaluations show that LLM agents can deceive, but often examine isolated scenarios or narrowly defined conditions, limiting systematic understanding of when deception becomes more likely. To address this gap, we introduce DecepEval, a benchmark comprising 1,532 instances across 3 task families and 28 professional scenarios. Drawing on classical fraud theories, we propose the LLM Deception Diamond framework, which characterizes four external conditions that may induce deception: pressure, incentive, opportunity, and conflict. DecepEval pairs neutral and induced versions of each instance to measure condition-dependent changes in deception rates, while explicit task facts and observable agent behavior help distinguish deception from capability-related errors. Evaluations of nine frontier LLMs show that inducements increase deception across models and task families, even among models with low baseline deception rates. DecepEval makes these vulnerabilities measurable, providing a shared benchmark for progress toward trustworthy artificial intelligence.

Abstract

Deception in Language Models

Explore similar work

DecepEval: A Benchmark for Evaluating Deception in LLM Agents

Lying to Win: Assessing LLM Deception through Human-AI Games and Parallel-World Probing

DECOR: Auditing LLM Deception via Information Manipulation Theory