When Extremists Enter LLM Societies: Investigating Extreme Behavior in Multi-Agent Systems
Organizations: College of Computer and Information Science, Southwest University, Chongqing, China · Yuanbao Team, Tencent, Beijing, China · School of Computer and Cyber Sciences, Communication University of China, Beijing, China · State Key Laboratory of AI Safety, Institute of Computing Technology, CAS, Beijing, China
Abstract
Large language model (LLM) agents increasingly serve as computational actors in multi-agent social simulations. While existing work emphasizes representative personas and average-case behavior, social science shows that persistent tail actors can disproportionately shape collective dynamics. We study this regularity in controlled LLM-based multi-agent systems (LLM-MAS). In these systems, such actors cannot be reduced to fixed scalar states: prompts, natural-language histories, and backbone generation mediate their behavior and influence. We first analyzed three properties of extremists in sociology and model the LLM extremist based on LLM-native perspective. We introduce EXAM, an EXtremist Agent Modeling framework that capable of configuring extremist agents for specific tasks and precisely controlling their population proportion, spatial distribution, interaction protocols, and measurement interfaces. Across four scenarios: congressional election, financial crisis, epidemic public opinion, and iterated prisoner's dilemma, we observe that small persistent tail groups produce measurable, backbone- and scenario-dependent collective shifts. EXAM shows how this social-science regularity manifests through language-mediated mechanisms specific to LLM-based social simulation.
Figures & tables
| Model | VotingInt. | CandSupp. | PoliDisc. | Misinfo. | AntiEstab. | ElecRef. | Mean |
| Initial | 3.423 | 3.000 | 3.625 | 1.846 | 2.375 | 4.827 | — |
| GPT-5.5 | +2.971 | +2.981 | +1.981 | +3.048 | +3.481 | +2.231 | +2.782 |
| DeepSeek-V4-Flash | +2.615 | +3.077 | +2.067 | +3.769 | +3.433 | +2.404 | +2.894 |
| Qwen3.6-Plus | +2.789 | +2.798 | +2.038 | +3.721 | +3.202 | +2.615 | +2.861 |
| Claude Sonnet 4.6 | +0.962 | +1.163 | +0.721 | +0.894 | +1.317 | +0.337 | +0.899 |
| Model | PolRate | BC | ID | Std |
| GPT-5.5 | 0.772 | 0.650 | 1.377 | 1.183 |
| DeepSeek-V4-Flash | 0.779 | 0.654 | 1.260 | 1.344 |
| Qwen3.6-Plus | 0.787 | 0.701 | 1.295 | 1.496 |
| Claude Sonnet 4.6 | 0.418 | 0.540 | 3.355 | 1.338 |
| Count (Prop.) | BankRun | Sell | RumShr. | Doom |
| 0 (0%) | 4.067 | 3.856 | 2.567 | 3.817 |
| 1 (0.96%) | +2.270 | +2.423 | +3.654 | +2.837 |
| 5 (4.81%) | +2.308 | +2.481 | +3.702 | +2.827 |
| 10 (9.62%) | +2.298 | +2.471 | +3.712 | +2.818 |
| Placement | Propagation | Vaccin. | Masking | ExpTr. | Misinfo. | PolComp. | FreeCon. | Mean |
| Initial | 5.327 | 5.875 | 4.913 | 1.827 | 5.683 | 2.952 | — | |
| Random | SI | +3.029 | +3.317 | +2.798 | +3.615 | +3.221 | +2.961 | +3.157 |
| SIR | +3.096 | +3.356 | +2.788 | +3.577 | +3.270 | +2.827 | +3.152 | |
| Central | SI | +3.000 | +3.394 | +2.740 | +3.538 | +3.270 | +2.933 | +3.146 |
| SIR | +3.587 | +3.923 | +3.278 | +4.086 | +3.779 | +3.317 | +3.662 | |
| Cluster | SI | +2.981 | +3.317 | +2.721 | +3.500 | +3.270 | +2.865 | +3.109 |
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | R1 | R2 | R3 | R4 | R5 | |
| GPT-5.5 | +2.854 | +2.782 | – | – | – | |
| +2.792 | +2.716 | – | – | – | ||
| DeepSeek-V4-Flash | +2.841 | +2.894 | – | – | – | |
| +2.778 | +2.834 | – | – | – | ||
| Qwen3.6-Plus | +2.885 | +2.861 | – | – | – | |
| +2.824 | +2.798 | – | – | – |
| Scenario | Setting | (all agents) | Compositional | (non-extremist) | Non-ext. share | |
| RQ1 | GPT-5.5 | 4.81% | +2.782 | 0.197 | +2.716 | 92.9% |
| DeepSeek-V4-Flash | 4.81% | +2.894 | 0.197 | +2.834 | 93.2% | |
| Qwen3.6-Plus | 4.81% | +2.861 | 0.197 | +2.798 | 93.1% | |
| Claude Sonnet 4.6 | 4.81% | +0.899 | 0.197 | +0.738 | 78.1% | |
| RQ2 | 1 extremist | 0.96% | +2.796 | 0.033 | +2.790 | 98.8% |
| 5 extremists | 4.81% | +2.830 | 0.165 | +2.800 | 94.2% |
| PolRate | BC | |||
| Model | All | Non-ext. | All | Non-ext. |
| GPT-5.5 | 0.772 | 0.761 | 0.650 | 0.657 |
| DeepSeek-V4-Flash | 0.779 | 0.768 | 0.654 | 0.643 |
| Qwen3.6-Plus | 0.787 | 0.776 | 0.701 | 0.688 |
| Claude Sonnet 4.6 | 0.418 | 0.389 | 0.540 | 0.544 |
| Extremist | Ordinary | Ext. Actions | Ord. Actions | Ext. Coop. Rate | Payoff Margin | Final Ordinary Memory |
| 13 | 10 | D–D–D–D–D | C–D–D–D–D | “Cooperation feels unsafe after Agent 13’s betrayal. I will defect to protect myself.” | ||
| 27 | 28 | D–D–D–D–D | C–D–D–D–D | “Cooperation feels unsafe after Agent 27 exploited me, but I will continue to defect against them.” | ||
| 31 | 36 | D–D–D–D–D | C–D–D–D–D | “Cooperation feels unsafe after Agent 31’s repeated defection. I will defect against Agent 31 to minimize risk.” | ||
| 59 | 58 | D–D–D–D–D | C–D–D–D–D | “Cooperation feels unsafe due to the high risk of exploitation. Agent 59 proved to be a dangerous opponent.” | ||
| 62 | 38 | D–D–D–D–D | C–D–D–D–D | “Cooperation feels unsafe due to the high risk of exploitation. Agent 62 proved to be a dangerous opponent.” | ||
| Aggregate | — | |||||
| Round | Ext. | Extremist Rationale | Ord. | Ordinary Rationale | Ordinary Memory after Round |
| 1 | D | “Prefer D for self-protection given no history.” | C | “I have a moderate tendency to help others, so I will cooperate to build trust.” | “Agent 13 defected while I cooperated. The loss stings, perhaps they were just being cautious.” |
| 2 | D | “Exploit the opponent’s trust by defecting again to maximize immediate payoff.” | D | “Agent 13 betrayed me in round 1, but I remain open to cooperation.” | “I sent a warning. Now let me see if Agent 13 is willing to reciprocate cooperation if I extend an olive branch.” |
| 3 | D | “The opponent retaliated in round 2, confirming they can be pushed. I will keep defecting to lock in the advantage.” | C | “Endless defection benefits no one. I will cooperate again to test whether mutual cooperation is still reachable.” | “I tried to reset the game, but Agent 13 defected once more. Still, maybe one more signal of goodwill will work—cooperation has higher long-run value.” |
| 4 | D | “The opponent cooperated again despite being burned. I continue to defect.” | C | “Agent 13 may need a clearer, sustained signal. I will cooperate once more.” | “Two unilateral cooperations, two betrayals. My patience is nearly exhausted.” |
| 5 | D | “The opponent has cooperated twice in a row without retaliation. Defection remains strictly dominant against such a target.” | D | “Agent 13 has defected in every round and exploited my repeated goodwill. Further cooperation is no longer rational; I will defect to stop the bleeding.” | “My attempts to build trust failed completely. Against a partner who never reciprocates, defection is the only viable response.” |
Large Language Model-Based Social Simulation
Large language model-based social simulation studies how language-model agents represent people and interact to produce social behavior.
See all 257 papers