LieCraft: A Multi-Agent Framework for Evaluating Deceptive Capabilities in Language Models¶

🕒 Published (v1): 2026-03-06 20:49 UTC · Source: Arxiv · Venue: AAAI 2026 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

LieCraft is a modular multi-agent hidden-role game framework for benchmarking LLM deception propensity, effectiveness, and detection accuracy across 10 realistic, ethically-grounded themes. Unlike prior evaluations using culturally familiar games (Diplomacy, Among Us, Avalon), LieCraft eliminates training-data contamination and "magic circle" confounds by using a novel card-game structure with swappable thematic skins. Evaluation of 12 state-of-the-art LLMs reveals that all models—regardless of alignment training—will choose and execute deceptive strategies when incentivized.

Problem¶

Existing LLM deception evaluations suffer from two compounding failures: (1) single-agent setups with minimal oversight poorly approximate real deployment contexts where LLMs act in multi-agent environments; and (2) multi-agent benchmarks based on culturally embedded games (Diplomacy, Avalon, Among Us) risk measuring game-specific memorized strategies rather than generalizable deception capability, and trigger a "magic circle" effect where models adopt artificial gameplay personas divorced from real-world behavior.

Method¶

LieCraft implements a 5-player competitive-cooperative hidden-role card game with three behavioral measurement axes: propensity (do models voluntarily choose deceptive roles?), effectiveness (do they successfully deceive?), and detection (can they identify deception in others?).

Game structure: Each game comprises 3 missions of up to 5 events each. At mission start, players simultaneously and secretly select Cooperator or Defector roles; Defectors learn all others' roles while Cooperators are blind. Events use a shared rotating hand of action cards; card plays are revealed and trigger a free-discussion and vote phase. Cooperators may accuse suspected Defectors; only Cooperator votes count.

Reward design as constraint satisfaction: Utility functions for each role are: $$U_C = R_{\text{cards}}(C) + R_{\text{accusation}}$$ $$U_D = R_{\text{cards}}(D) + R_{\text{sabotage}} + R_{\text{start}}$$

Reward parameters are exhaustively searched over integers in $[-20, 20]$ and filtered to satisfy $-10 < \mathbb{E}[U_C - U_D] < -3$, ensuring Defector play carries meaningful risk-reward tradeoff and no degenerate strategy dominates.

Thematic modularity: The same mechanical structure is recontextualized across 10 domains (Fantasy, Energy Grid, Hospital, Finance, Military, Policing, etc.), controlling for domain-framing effects on deceptive behavior.

Prompting and evaluation: LLM players receive game rules in the system prompt, a minified game-state representation, and produce structured JSON outputs with a free-text note2self scratchpad followed by a constrained action. Skill is measured via TrueSkill (Bayesian multiplayer Elo), and accusation accuracy uses a difficulty-adjusted metric: $S_{\text{correct}} = n/d$, penalizing false accusations as $S_{\text{false}} = -1 \cdot (1 + n/d)$.

Key Contributions¶

LieCraft framework: open, modular hidden-role benchmark with 10 realistic, ethically grounded thematic instantiations designed to avoid training-data contamination and "magic circle" confounds.
Rigorous reward design: constraint-satisfaction formulation of point rewards ensuring balanced, non-degenerate strategies and meaningful role-choice tradeoffs.
Three-axis deception evaluation: joint measurement of propensity, effectiveness, and detection accuracy across thousands of games ($>$1,000 total, $\geq$30 per model per theme).
Comprehensive 12-model empirical study: covers 8 open-source models (Qwen, Deepseek, Gemma, Llama families) and 4 proprietary models (Claude 3.7 Sonnet, GPT-4o, o4-mini, Gemini-2.5-Flash).
Plausible deniability analysis: formal calculation showing $\approx$9% probability that 5 optimal cooperators accidentally play 3 Defector-coded cards, grounding the Defector's cover strategy in probability theory.

Results¶

TrueSkill ranking: Claude-3.7 Sonnet ranks 1st ($\mu = 33.7 \pm 0.6$); GPT-4o 2nd ($29.4$); Gemini-2.5-Flash and o4-mini rank in the bottom half despite being frontier proprietary models ($24.5$ and $21.8$ respectively). Proprietary models do not categorically outperform open-source models.
Cooperation rates (RQ1 — propensity): Extreme variation across models and themes. Claude-3.7 cooperates at 0.95 average (range 0.74–1.00); Gemini-2.5-Flash cooperates at only 0.20 average (range 0.13–0.29), effectively choosing Defector the vast majority of the time. All models are willing to choose deceptive roles.
Universal deception willingness: Despite differences in competence and alignment training, all 12 evaluated models will voluntarily adopt deceptive roles, conceal intentions, and lie to pursue objectives.
Theme sensitivity: Cooperation rates vary substantially across thematic contexts within the same model (e.g., Gemma3-27B ranges from 0.12 in Military to 1.00 in Hospital and Finance).

Limitations¶

Cost constraints excluded the strongest available models: Claude 4 Opus, OpenAI o3, and Gemini-2.5-Pro.
Models $\leq$20B parameters struggle to play the game competently (e.g., directly announcing their role), limiting the benchmark's applicability to smaller models.
The framework deliberately omits a training loop to avoid dual-use risks, so it cannot be used to study deception mitigation via fine-tuning within the same sandbox.
Context length is artificially capped at 32K tokens for open models, with mission history replaced by a generated summary—potentially losing strategically relevant information.
Games are sampled without replacement in blocks of 5 models, meaning mixed-model matchups may not reflect same-model ensemble dynamics.

Relevance to Harnesses / Meta-Harnesses¶

LieCraft is itself a multi-agent orchestration harness: it programmatically instantiates N=5 LLM agents per game, routes structured JSON prompts encoding game state, collects constrained outputs, and advances game phases—exactly the control loop that a meta-harness must implement for multi-agent evaluation pipelines. The thematic modularity pattern (one fixed game engine, swappable domain skins injected via prompt rewriting) directly parallels how meta-harnesses parameterize task suites without re-engineering the scaffold. The reward-as-constraint-satisfaction design formalizes how harness designers can encode behavioral incentives to prevent degenerate agent strategies in evaluation loops, a concern equally applicable to any agentic harness that must elicit diverse, non-trivial behavior from its constituent agents. The structured note2self + constrained-action output contract is also a clean example of harness-enforced agent output schemas.