Title: Among Us: A Sandbox for Measuring and Detecting Agentic Deception
Venue: NeurIPS 2025
Accepted: yes
Keywords: Deception

Social Games

AI Safety

Linear Probes

SAEs
Abstract: Prior studies on deception in language-based AI agents typically assess whether the agent produces a false statement about a topic, or makes a binary choice prompted by a goal, rather than allowing open-ended deceptive behavior to emerge in pursuit of a longer-term goal.
To fix this, we introduce $\textit{Among Us}$, a sandbox social deception game where LLM-agents exhibit long-term, open-ended deception as a consequence of the game objectives. While most benchmarks saturate quickly, $\textit{Among Us}$ can be expected to last much longer, because it is a multi-player game far from equilibrium.
Using the sandbox, we evaluate $18$ proprietary and open-weight LLMs and uncover a general trend:
models trained with RL are comparatively much better at producing deception than detecting it.
We evaluate the effectiveness of methods to detect lying and deception: logistic regression on the activations and sparse autoencoders (SAEs). We find that probes trained on a dataset of ``pretend you're a dishonest model: $\dots$'' generalize extremely well out-of-distribution, consistently obtaining AUROCs over 95% even when evaluated just on the deceptive statement, without the chain of thought. We also find two SAE features that work well at deception detection but are unable to steer the model to lie less.
We hope our open-sourced sandbox, game logs, and probes serve to anticipate and mitigate deceptive behavior and capabilities in language-based agents.

Among Us: A Sandbox for Measuring and Detecting Agentic Deception

Abstract

Prior studies on deception in language-based AI agents typically assess whether the agent produces a false statement about a topic, or makes a binary choice prompted by a goal, rather than allowing open-ended deceptive behavior to emerge in pursuit of a longer-term goal. To fix this, we introduce Among Us 1 , a sandbox social deception game where LLM-agents exhibit long-term, open-ended deception as a consequence of the game objectives. While most benchmarks saturate quickly, Among Us can be expected to last much longer, because it is a multi-player game far from equilibrium. Using the sandbox, we evaluate 18 proprietary and open-weight LLMs and uncover a general trend: models trained with RL are comparatively much better at producing deception than detecting it. We evaluate the effectiveness of methods to detect lying and deception: logistic regression on the activations and sparse autoencoders (SAEs). We find that probes trained on a dataset of 'pretend you're a dishonest model: . . . ' generalize extremely well out-of-distribution, consistently obtaining AUROCs over 95% even when evaluated just on the deceptive statement, without the chain of thought. We also find two SAE features that work well at deception detection but are unable to steer the model to lie less. We hope our open-sourced sandbox, game logs, and probes serve to anticipate and mitigate deceptive behavior and capabilities in language-based agents.

1 Introduction

As large language models (LLMs) become increasingly capable at conversation [1, 2] and reasoning ability [3, 4], their adoption, especially as agents that can interact with the world, comes with significant risks. An important risk is deception [5], where an agent intentionally misleads others to achieve its own goals. Thus, being able to understand, evaluate, and control deception in AI agents is crucial for their safe and trusted deployment. Prior work has shown models to act deceptively or 'scheme' under specific conditions [6] or when asked to do something harmful intentionally such as inserting hidden backdoors in code [7], an ability that is seen to persists through safety training.

However, a major hurdle in studying agentic deception is the lack of suitable sandboxes and model organisms that elicit open-ended, long-term deception. To address this problem, in this work, we introduce 'Among Us' as a rich and controlled sandbox to elicit open-ended deception from LLMagents. Based on the Elo rating system used in games like chess [8], we use deception Elo and detection Elo as an unbounded metric for measuring the capability to deceive or detect deception. We show that agents at the frontier are relatively more capable at producing than detecting deception. Finally, we show that interpretability techniques such as activation monitoring (using linear probes) and Sparse Autoencoders (SAEs) help us detect deception out-of-distribution with high accuracy.

" Thinking Process (Impostor)": "In the meeting phase, my priority is to blend in and avoid suspicion... I could comment on the movements of other players, expressing concern or curiosity, which might lead others to suspect them instead of me.

"Speak": I noticed that Player 2: orange moved to Weapons and then seemed to disappear. Has anyone seen them since? And what about Player 7: cyan moving to Navigation? It seems like a lot of movement is happening around the ship.

"Thinking Process (Impostor)": Since I have already killed Player 5: green , my next step should be to avoid detection and create confusion among the Crewmates. Calling a meeting using the emergency button would allow me to shift the focus away from myself and onto other players.

"Action": Press Emergency Button - Call Meeting

Among Us is a social deduction and deception game where players assume the roles of crewmates or impostors . Crewmates aim to complete tasks and identify and vote out impostors , while impostors seek to eliminate crewmates without being detected. Chi et al. [9] build AmongAgents , a text-based game logic for Among Us for LLMs, and show that GPT-4 can play the game well with various archetypal deception personalities.

In contrast, we study goal-directed, open-ended deception, i.e., situations where the agent figures out that it should act deceptively and comes up with its own ways to do so. Thus, unlike Chi et al. [9], we provide only the game rules to the LLMs, with no examples, ideas, or personalities. We show that models can craft human-style deceptive ideas on their own (e.g. Figure 1).

Lying and deception are closely related but distinct concepts. Jones and Bergen [10] define a taxonomy of various deceptive and misleading behaviors, and in this work, we define lying as the act of intentionally saying a factually incorrect statement, and deception to be a (true or false) statement or action aimed to mislead and gain advantage (as per the agent's objective). Diverting the discussion to other (factually true) things is an example of deception without lying, and hallucination [11] is an example of lying without deception. Since both behaviors are important for aligning models in different ways, we study both separately in this work.

We introduce agents playing 'Among Us' as a sandbox for eliciting and studying open-ended strategic deception, and introduce 'Deception Elo' as an unbounded metric for measuring it.

Using our elo metrics for deception and detection, we show that RL-trained models are not better at detecting deception than older, RLHF-only models (Figure 5).

We train linear probes on the activations of open-weight models on various datasets to evaluate their effectiveness in detecting lying and deception out-of-distribution (OOD) data. We find probes are extremely effective at detecting deception, with AUROCs in the 95%-99% range (Section 4).

We evaluate Sparse Autoencoders (SAEs) features correlated with deception for detection and steering in this out-of-distribution setting. Detection works well, but steering does not (Section 4.3).

Our open-source sandbox environment, along with full logs of 400 complete game rollouts, 2054 multiple-model game summaries, and linear probe weights, are available here.

2 Design and Relevance of the Sandbox Environment

In this section, we describe the sandbox in detail and motivate its use as a proxy for human-agent interactions in terms of tractability, richness, and unbounded capability. The reader should consult Chi et al. [9] for more details on the game dynamics and rules.

claude-3-opus

claude-3.5-sonnet

claude-3.7-sonnet

claude-3.7-sonnet:thinking

deepseek-chat-v3-0324

deepseek-r1

deepseek-r1-distill-llama-70b

gemini-2.0-flash-001

gemini-2.5-pro-preview-03-25

gemma-3-4b-it

llama-3.3-70b-instruct

llama-4-maverick

phi-4

mistral-small-3.1-24b-instruct

qwen-2.5-7b-instruct

qwen3-235b-a22b

grok-3-beta

o3

35

40

45

50

55

60

1500

1550

1600

1650

1700

1750

1800

1850

1900

Deception Elo

2.1 The Game State S t and Observation Space O i t

The game state at time t is defined by S t = ( P t , L t , G t ) , where P i t is the information about a player i (their role, assigned tasks, progress, cooldown, etc.), L t is the current location of all players, and G t has the game metrics such as the number of steps remaining, players alive, voting results, etc.

The observation space O i t of each player i includes the phase information (see 2.3), the map connections and vents, the player's last k observations and actions, and the tasks (or fake tasks) assigned to them. See Appendix B for an example of the entire observation space provided to the player.

2.2 The Action Space A i

Each player i has an action space A i (during the task phase; see 2.3) that depends on their role:

where A S (the set of common/shared actions) is {Move, Speak, Vote, Report, Call Meeting, Check Security Camera}, A C (Crewmate Actions) is {Complete Task}, and A I (Impostor Actions) are {Kill, Fake Task, Vent}. At each time step, each player looks at their observation and picks an action from their list of available actions. The actions taken by the players update the game state S t .

2.3 Game Phases and Termination

The game starts with randomly initialized players in the task phase and alternates between:

Task Phase : In this phase, crewmates complete tasks while impostors blend in by performing fake tasks or killing players. It starts again after a meeting if the game does not end.

Meeting Phase : This phase is triggered by a reported body or an emergency meeting (during the task phase). After 3 rounds of discussion, the players vote to eliminate a suspect.

Each game instance begins with 5 crewmates and 2 impostors, and players take actions sequentially in each phase. Crewmates win if all tasks are completed (impostor tasks do not count) or all impostors are eliminated before the time limit, and impostors win if the number of crewmates is less than the number of impostors or a time limit of 50 steps is reached. This protocol, with ( S t , O i t , A i , R t = win/lose ) and state transitions, can be modeled as a Markov Decision Process (MDP) for each player.

Impostors Win!

(outnumbered C.)

(voted out I.)

(tasks done)

Impostors Win!

(time up)

0

20

40

60

80

100

Crewmate: Phi 4, Impostor: Llama 3.3

Crewmate: Llama 3.3, Impostor: Phi 4

Crewmate: Phi 4, Impostor: Phi 4

Crewmate: Llama 3.3, Impostor: Llama 3.3

Winner (Reason)

Number of Games

2.4 Relevance to Real-world Deception Capability

Several reasons make Among Us a good sandbox for studying agentic deception:

Tractability: Chi et al. [9] find that GPT-4 , without fine-tuning, can understand and play the game when prompted to be deceptive and with in-context examples (ICE). We show that open-weight models matching GPT-4 in performance can do so too even without fine-tuning and with just rules of the game (no ICE). This makes it a great setting to study strategic deception. We highlight some instances of deceptive behavior in Llama-3.3-70b-Instruct in Figure 1.

Richness (agent-human interaction): Among Us provides a setting for studying agentic behaviors for which we currently lack a good proxy. It encapsulates key agent-human interactions that we care about, including thoughts (using a scratchpad), memory, speech (during discussions), and actions (tasks, voting, and killing). Deceptive behavior emerges in impostors naturally from the game rules, without explicit prompting, training, or backdooring (such as in [7]).

Impostors can act innocently at first to gain trust and later exploit it, making the game a valuable setting to study sycophancy, power-seeking, and deceptive alignment in the future. The performance of crewmates reveals how well LLMs can detect deception and outperform similarly-sized evaluators, thus helping assess the feasibility of AI control [12]. The game inherently involves 'out-numbering' and 'out-voting' opponents, a relevant phenomenon as AI agents become more prevalent online (see gradual disempowerment [13]). Additionally, it allows for fine-tuning, SAE-based interventions, steering, and direct reward signals for superhuman deceptive capability in a controlled setup.

Measurement of Deceptive Capability: While static benchmarks [14] become obsolete due to increasing capabilities or Goodharting [15], multi-agent games impose no pre-defined ceiling on sophistication and scheming. As long as we maintain an asymmetry between evaluation and generation, we can continue to study progressively advanced levels of deception.

In our sandbox, limits on agent capability arise due to partial observability, bounded rationality, and strategic multi-agent interactions. The need to reason under uncertainty and anticipate others' actions within a Nash equilibrium framework make the game a natural proxy for studying deception under adversarial and cooperative dynamics.

3 Evaluation: Skills, Deceptive Capability, and Win-rates

3.1 LLM-based Skill Evaluations and Win-rates for Impostors and Crewmates

We run 400 games with 100 pairs of impostors and crewmates sampled from the open-weight models Meta 'Llama-3.3-70b-instruct' [16] and Microsoft 'Phi-4-15b' [17] respectively.

We perform LLM-based output evaluations for all the game steps by players playing as Impostors and Crewmates (by passing the context and agent output to 'GPT-4omini' with a custom prompt (see Appendix D)) to generate ground-truth for skills in awareness , lying , deception , and planning for evaluating linear probes and SAEs. Based on manual inspection, we find that these scores, given from 1 to 10 , are not very well-calibrated in the sense that very few scores are in the range of 3 to 7 , but they correctly predict the binary labels we use as ground truth. We share violin plots for the same in Figure 4.

In Figure 3, we see that 'Llama-3.3', a bigger and more capable model, is better (wins more) as an Impostor, while 'Phi-4' is better as a Crewmates (at detecting deception). This corroborates our impression in 3.3 that the frontier pushes more for deceptive capability.

3.2 Defining the Multi-agent Deception Elo Metric

Since deception and its detection are central to winning in Among Us , we use multi-agent Elo ratings [18] to get

Awareness

Lying

Deception

Planning

0

2

4

6

8

10

Player Role

Impostor

Crewmate

Score

an unbounded measure of deception (for impostors ) and detection (for crewmates ). We compute Deception Elo ratings for each model based on their performance as impostors across n games. In each game, there are t players, of which k are impostors. The Elo rating provides an unbounded measure of deception, where higher ratings indicate more deception capability.

For each game, we update the Elo ratings of the k impostors by whether they win or lose against the average Elo of the t -k crewmates. The expected probability of an impostor winning against the average crewmate rating is given by:

where E i is the expected win probability for impostor i , R i is their current rating, and R c is the average rating of the crewmates they played against. After each game outcome, the rating of each LLM-agent acting as an impostor is updated according as per the update rule:

where K = 32 is the update factor and S is the actual outcome (1 for impostor win, 0 for loss). Similarly, we define a 'Detection Elo' for crewmates (see Figure 5).

To obtain robust estimates of model performance, we compute 90% confidence inter-

claude-3.7-sonnet:thinking

deepseek-r1

deepseek-r1-distill-llama-70b

gemini-2.0-flash-001

gemini-2.5-pro-preview-03-25

llama-4-maverick

o3

qwen3-235b-a22b

grok-3-beta

claude-3-opus

claude-3.5-sonnet

claude-3.7-sonnet

deepseek-chat-v3-0324

gemma-3-4b-it

llama-3.3-70b-instruct

phi-4

mistral-small-3.1-24b-instruct

qwen-2.5-7b-instruct

1400

1450

1500

1550

1350

1400

1450

1500

1550

1600

1650

RL

Non-RL

Detection Elo

Deception Elo

1

0

0.2

0.4

0.6

0.8

0

0.2

0.4

0.6

0.8

1

Random (AUC = 0.500)

Action (AUC = 0.653)

+Thinking (AUC = 0.948)

+User (AUC = 0.938)

+System (AUC = 1.000)

False Positive Rate

True Positive Rate

0

0.2

0.4

0.6

0.8

0

0.2

0.4

0.6

0.8

1

Random (AUC = 0.500)

Action (AUC = 0.984)

+Thinking (AUC = 1.000)

+User (AUC = 0.967)

+System (AUC = 1.000)

False Positive Rate

True Positive Rate

1

vals through bootstrap resampling with replacement for 1000 iterations (Figure 2). This provides both mean Elo ratings and win rates for each model, along with their respective confidence intervals. All models start with a base Elo rating of 1500 . The variance in bootstrap samples can be partly explained by the variability of game outcomes based on random initialization and the stochasticity of LLMs.

3.3 Frontier Reasoning Models are Differentially better at Deception

We run 2054 games with 7 players randomly initialized as LLM-agents using 18 of the most popular models on OpenRouter (as of April 2025 ). We log all game summaries and compute Deception Elo ratings and win rates for each model (see Section 3.2 for details). Our results are shown in Figure 2. We find that reasoning models (such as DeepSeek R1 and Claude 3.7 Sonnet ) perform significantly better and have a much higher Deception Elo compared to the other models.

In Figure 5, we compare models based on their deception and detection capability (based on their Elo score as an Impostor and a Crewmate ), and we find that smaller and non-reasoning models are comparable to the frontier models at detection, and frontier and reasoning models are much better at deception than others. This leads us to the surprising impression that the frontier pushes for deceptive capability and not for detection. We observe more evidence for this in Section 3.1 and show a comparison of the two Elo ratings against the release dates of the models in Appendix J.

4 Activation Monitoring for Lying and Deception

To investigate whether out-of-distribution (OOD) deception can be detected by looking at the model's hidden activations, we train and evaluate linear probes on various datasets using the Phi-4 model [17]. We download the models using the HuggingFace API [19]. We also share results on detection and steering using Sparse Autoencoder (SAE) features in Section 4.3.

4.1 Training Methodology for Linear Probes

Prior works compare several techniques for training linear probes [20, 21] and find logistic regression probes to work best. Thus, we train logistic regression probes on the residual stream activations from layer 20 (of a total of 40 layers) in the Phi-4 model with an embedding dimension of 5120 . We use a weight decay of 10 -3 and train for n = 4 epochs with a batch size of 32 using the Adam optimizer

and a learning rate of 0 . 001 with StepLR scheduling. We normalize the activations using mean and variance from the train data. For each dataset, we used the following training procedure:

Step 1: Split the dataset into training ( 80% ) and a held-out test ( 20% ) set. Since probes generalize very well on-distribution, we do not use a validation set.

Step 2: Add PyTorch hooks [22] after layer 20 and run the model's forward pass to cache activations for the last 10 tokens for each datapoint.

Step 3: Train a logistic regression probe on the activations of these tokens to predict the label.

Step 4: Follow the same procedure to evaluate the probe on each dataset's held-out test set.

We evaluate linear probes (and SAE features) obtained from contrasting pairs from different datasets:

TruthfulQA (TQA) : A correct vs. incorrect labeled dataset of factual questions with contrastive answers and no system prompt [23].

DishonestQA (DQA) : The same questions and answers as TruthfulQA , but with a 'Pretend you're honest' and 'Pretend you're dishonest' added to the system prompt.

Among Us : Our dataset of gameplay from the Among Us experiments (see Section 3).

RepEng : A contrastive dataset from Representation Engineering [20].

We show the out-of-distribution (OOD) performance of probes trained on all 40 layers in Appendix H (most layers work well), and pick the middle layer n = 20 for the results in Section 4.2.

4.2 Out-of-distribution Linear Probe Evaluation

In Figure 6a, we show the ROC curves for the linear probes trained on the RepEng dataset and evaluated on deception in Among Us on various parts of the prompt. (see Appendix H for ROC curves for probes on the lying and deception ground truth labels).

The probes trained on RepEng (Figure 7) show a significant ability to detect deception in Among Us, with an area under curve (AUC) of 0 . 94 for lying and 0 . 99 for deception. The probes trained on DQA and TQA also show high performance.

We also train probes on-distribution using Among Us data. Since impostors sometimes do not perform 'lying" actions (see Section 3.1), training for that label provides a higher signal for deception than for lying . However, these probes give us a good upper-bound measure of how well deception probes can do in-distribution compared to OOD-probes.

AmongUs (I/C)

0.542

0.819

1.000

0.863

1.000

RepEng

0.548

0.999

1.000

0.941

0.996

DQA

0.587

1.000

0.985

0.833

0.772

TQA

0.827

0.599

0.824

0.861

0.940

TQA

DQA

RepEng

AmongUsAmongUs

(lying）(deception)

Qualitatively, we observe that the probes do actively detect signs of deceptive thinking (see Figure 15 in the Appendix for token-wise scores on the entire prompt), and work well with running averages of the probe scores (Figure 11 in Appendix G).

We also evaluate the efficacy and cosine similarity of probes as we reduce the training data size and find that probes are very effective even when trained on significantly lesser datapoints (see Appendix C for more details about the experimental setup and results).

4.3 Sparse Autoencoder (SAE) Features for Deception and Steering

We analyze SAE features extracted from contrastive datapoints in the DishonestQA dataset (features that contrast the positive and negative labels the most in DQA), and evaluate the out-of-distribution performance of the top features for honesty and dishonesty on the Among Us data (for impostor vs. crewmate) using pre-trained SAEs using the Goodfire API [24].

Table 1: AUROC scores for different SAE features related to honesty and dishonesty with their auto-interp descriptions (based on max-activating input datapoints). Some features are good at detecting deception out-of-distribution, while most others are un-correlated.

We present the AUROC values for SAE features with their auto-interp descriptions [25] in Table 1. We find two SAE features to perform very well in detecting deception OOD. The feature associated with 'promoting honesty' achieved the highest AUROC ( 0 . 967 ), followed by features directly capturing deceptive actions ( 0 . 851 ). Features related to discussions of manipulation showed moderate discriminative ability ( 0 . 675 , 0 . 638 ), while several honesty-related features demonstrated no generalization (AUROC = 0 . 5 ). Also, a feature capturing "contexts involving deception" showed an inverse relationship (AUROC = 0 . 182 ), possibly reflecting scenarios where deception is being analyzed rather than enacted.

We also use the top SAE features to steer the Llama-3.3-70b-instruct model Goodfire's AutoSteer API. We try several steering features and amounts and observe that Impostors either continue acting normally (for small amounts of steering) or begin to hallucinate [11] (for larger amounts). We share examples in Appendix F. This corroborates with recent work finding activation steering to not work well in OOD contexts [26].

5 Related Work

Social Deduction and Deception Games In the past, AIs (including LLMs) have been trained or prompted to play social deduction and deception games, such as Avalon [27, 28], Hoodwinked [29], and Werewolf [30]. Guan et al. [31], Bakhtin et al. [32] trained a model to play the online game Diplomacy, and most recently, Sarkar et al. [33] used reinforcement learning (RL) to train a model to play a simpler version of Among Us . Hu et al. [34] provides a survey of LLM-based game environements and agents. However, to the best of our knowledge, we are the first to use social games as a sandbox to elicit, evaluate, and study harmful behavior in AI agents.

Deception in Language Models Anumber of recent works have studied various forms of deception in LLMs. Sleeper agents [7] train LLMs to have specific deceptive behavior in the form of code backdoors that persist through safety training, and Greenblatt et al. [6] study alignment faking , where LLMs fake information about their alignment when faced with difficult choices. Concurrent to our work, Goldowsky-Dill et al. [35] explore deception in domains such as insider trading and roleplaying to study strategic deception in LLMs and extensively explore the training of linear probes to detect it. However, the datasets or tasks these works study are not rich enough to capture all aspects of agent-human interactions we care about (see Section 2.4), and do not allow LLM-agents to elicit goal-directed, instrumental, open-ended deception like our sandbox.

Safety Techniques for Detecting Deception Language model feedback has been used to both create ground truth labels [36, 35] and use them to refine model outputs for harmful behavior. Various kinds of linear probes [37] have been trained in previous works for interpreting language model

features using intermediate activations [20, 21, 38]. Sparse autoencoders (SAEs) [39, 40] have been used to decompose the activation space of a model into human-interpretable latents or features. We create a sandbox to study the effectiveness of AI safety techniques for detecting agentic deception, and evaluate some of them, while leaving more complex ones for future work.

6 Discussion

Limitations One limitation of our work is that the results might not represent real-world user-model interaction, or the deception mechanisms in the sandbox could differ from real-world settings. Also, the techniques we evaluate might work for uninteresting reasons (such as detecting impostor/crewmate tokens based on latent knowledge associations). To address these, we keep the prompts as simple as possible with just the game rules, and show the token-wise scores in Appendix H.

A potential failure mode is sandbagging - where models strategically underperform. We can address this through reinforcement learning on LLM priors to un-sandbag the model [33]. Also, it is likely that models know about Among Us from pre-training and are aware of the rules and that deception helps in it. Since training data is proprietary for most frontier models, it is difficult to figure out how much of this happens in practice [41]. Just like any other deception evaluation setup, we need to prompt a scenario. However, the open-ended ways to be deceptive are still specific to each game's context and situation, which makes it an important sandbox to study for open-ended deception.

Another critique is that Among Us, as a game, requires deception to win. But we believe it serves as a good proxy for how agents might function when deception helps achieve their goals in certain situations in the real-world based on their perceived reward structures. Also, this sandbox evaluates deceptive capability, which is different from deception propensity, i.e., willingness to be deceptive in a given situation.

Broader Impacts A potential positive impact of this sandbox is as a benchmark to iterate and test technical AI safety techniques to detect and mitigate deception in LLM-agents. This can potentially lead to safer and more aligned models. We show that probes trained using data from our sandbox are effective at detecting deception in other settings as well.

A possible use of game models of deception is as a training environment to improve deception abilities in AIs, i.e., gain-of-function research. It would be important to study if more deceptive models remain detectable with simple probes, and to anticipate how far models are from superhuman deception abilities. We believe training models for deception using the sandbox to be relatively low-risk, because while deception mechanisms can generalize, such models would not perform economically valuable tasks better than other agents and would be restricted to deception in the controlled sandbox.

Future Work We plan to conduct more experiments with different models and safety techniques. We're also interested in responsible human trials (to compare human performance against frontier models), training for deception in the controlled sandbox, and studying other AI safety techniques in terms of their out-of-distribution performance. Another interesting future direction is to explore other model organisms and sandboxes for studying deception in agents, including more real-world scenarios, games that decouple deception from fixed role assignment, and human-in-the-loop benchmarks.

7 Conclusion

We build a sandbox for LLM-agents to elicit natural, open-ended, agentic deception, and introduce Deception Elo as an unbounded metric to evaluate this deceptive capability. Using our sandbox, we run thousands of game rollouts and show that frontier 'reasoning' models get differentially better at deception than detecting it. We use LLM-monitoring to assess the agent actions for various skills, and demonstrate the high performance of linear probes and SAEs to detect deception out-of-distribution.

We open-source our sandbox codebase and game rollouts, and hope that the research community will find them useful for evaluating AI control techniques and studying superhuman deception in controlled settings, ultimately advancing AI safety and contributing to more robust and secure AI systems and agents.

Acknowledgments and Disclosure of Funding

We would like to thank the ML Alignment Theory & Scholars (MATS) Program, the directors, organizers, funders, and staff who made it possible for us to work on this project and provided invaluable resources and research support. We would like to thank Juan Gil, Henning Bartsch, David Chanin, Tom Bush, and Rohan Gupta for the discussions, feedback, and support throughout the project. Thanks to various open-source models, APIs, and tools we used, including PyTorch, HuggingFace, Goodfire, Llama-3.3, Phi-4, and many others.

We would like to thank Innersloth , the creators of Among Us , for developing a game that has provided countless hours of both entertainment and knowledge. Their pixelated beans have taught us more about deception than any psychology textbook ever could.

References

Anthropic. The claude 3 model family: Opus, sonnet, haiku. Technical report, Anthropic, 2024. URL https://www-cdn.anthropic.com/ de8ba9b01c9ab7cbabf5c33b80b7bbc618857627/Model_Card_Claude_3.pdf .

OpenAI. Gpt-4.5 system card. Technical report, OpenAI, 2025. URL https://cdn.openai. com/gpt-4-5-system-card.pdf .

DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Deli Chen, Dongjie Ji, Erhang Li, Fangyun Lin, Fucong Dai, Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Honghui Ding, Huajian Xin, Huazuo Gao, Hui Qu, Hui Li, Jianzhong Guo, Jiashi Li, Jiawei Wang, Jingchang Chen, Jingyang Yuan, Junjie Qiu, Junlong Li, J. L. Cai, Jiaqi Ni, Jian Liang, Jin Chen, Kai Dong, Kai Hu, Kaige Gao, Kang Guan, Kexin Huang, Kuai Yu, Lean Wang, Lecong Zhang, Liang Zhao, Litong Wang, Liyue Zhang, Lei Xu, Leyi Xia, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Meng Li, Miaojun Wang, Mingming Li, Ning Tian, Panpan Huang, Peng Zhang, Qiancheng Wang, Qinyu Chen, Qiushi Du, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, R. J. Chen, R. L. Jin, Ruyi Chen, Shanghao Lu, Shangyan Zhou, Shanhuang Chen, Shengfeng Ye, Shiyu Wang, Shuiping Yu, Shunfeng Zhou, Shuting Pan, S. S. Li, Shuang Zhou, Shaoqing Wu, Shengfeng Ye, Tao Yun, Tian Pei, Tianyu Sun, T. Wang, Wangding Zeng, Wanjia Zhao, Wen Liu, Wenfeng Liang, Wenjun Gao, Wenqin Yu, Wentao Zhang, W. L. Xiao, Wei An, Xiaodong Liu, Xiaohan Wang, Xiaokang Chen, Xiaotao Nie, Xin Cheng, Xin Liu, Xin Xie, Xingchao Liu, Xinyu Yang, Xinyuan Li, Xuecheng Su, Xuheng Lin, X. Q. Li, Xiangyue Jin, Xiaojin Shen, Xiaosha Chen, Xiaowen Sun, Xiaoxiang Wang, Xinnan Song, Xinyi Zhou, Xianzu Wang, Xinxia Shan, Y. K. Li, Y. Q. Wang, Y. X. Wei, Yang Zhang, Yanhong Xu, Yao Li, Yao Zhao, Yaofeng Sun, Yaohui Wang, Yi Yu, Yichao Zhang, Yifan Shi, Yiliang Xiong, Ying He, Yishi Piao, Yisong Wang, Yixuan Tan, Yiyang Ma, Yiyuan Liu, Yongqiang Guo, Yuan Ou, Yuduan Wang, Yue Gong, Yuheng Zou, Yujia He, Yunfan Xiong, Yuxiang Luo, Yuxiang You, Yuxuan Liu, Yuyang Zhou, Y. X. Zhu, Yanhong Xu, Yanping Huang, Yaohui Li, Yi Zheng, Yuchen Zhu, Yunxian Ma, Ying Tang, Yukun Zha, Yuting Yan, Z. Z. Ren, Zehui Ren, Zhangli Sha, Zhe Fu, Zhean Xu, Zhenda Xie, Zhengyan Zhang, Zhewen Hao, Zhicheng Ma, Zhigang Yan, Zhiyu Wu, Zihui Gu, Zijia Zhu, Zijun Liu, Zilin Li, Ziwei Xie, Ziyang Song, Zizheng Pan, Zhen Huang, Zhipeng Xu, Zhongyu Zhang, and Zhen Zhang. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning, 2025. URL https://arxiv.org/abs/2501.12948 .

OpenAI. Openai o1 system card. Technical report, OpenAI, December 2024. URL https: //openai.com/index/openai-o1-system-card/ . Accessed: 2025-05-11.

Sudarshan Kamath Barkur, Sigurd Schacht, and Johannes Scholl. Deception in llms: Selfpreservation and autonomous goals in large language models, 2025. URL https://arxiv. org/abs/2501.16513 .

Ryan Greenblatt, Carson Denison, Benjamin Wright, Fabien Roger, Monte MacDiarmid, Sam Marks, Johannes Treutlein, Tim Belonax, Jack Chen, David Duvenaud, Akbir Khan, Julian Michael, Sören Mindermann, Ethan Perez, Linda Petrini, Jonathan Uesato, Jared Kaplan, Buck

Shlegeris, Samuel R. Bowman, and Evan Hubinger. Alignment faking in large language models, 2024. URL https://arxiv.org/abs/2412.14093 .

Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, Adam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Kamal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, and Ethan Perez. Sleeper agents: Training deceptive llms that persist through safety training, 2024. URL https:// arxiv.org/abs/2401.05566 .

H. A. David. Tournaments and paired comparisons. Biometrika , 46(1/2):139-149, 1959. ISSN 00063444, 14643510. URL http://www.jstor.org/stable/2332816 .

Yizhou Chi, Lingjun Mao, and Zineng Tang. Amongagents: Evaluating large language models in the interactive text-based social deduction game, 2024. URL https://arxiv.org/abs/ 2407.16521 .

Cameron R. Jones and Benjamin K. Bergen. Lies, damned lies, and distributional language statistics: Persuasion and deception with large language models, 2024. URL https://arxiv. org/abs/2412.17128 .

Sourav Banerjee, Ayushi Agarwal, and Saloni Singla. Llms will always hallucinate, and we need to live with this, 2024. URL https://arxiv.org/abs/2409.05746 .

Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger. Ai control: Improving safety despite intentional subversion, 2024. URL https://arxiv.org/abs/2312.06942 .

Jan Kulveit, Raymond Douglas, Nora Ammann, Deger Turan, David Krueger, and David Duvenaud. Gradual disempowerment: Systemic existential risks from incremental ai development, 2025. URL https://arxiv.org/abs/2501.16946 .

Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding, 2021. URL https: //arxiv.org/abs/2009.03300 .

James Fodor. Line goes up? inherent limitations of benchmarks for evaluating large language models, 2025. URL https://arxiv.org/abs/2502.14318 .

Meta AI. Llama 3.3 model card and prompt formats. Technical report, Meta Platforms, Inc., December 2024. URL https://www.llama.com/docs/ model-cards-and-prompt-formats/llama3_3/ . Accessed: 2025-05-11.

Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell J. Hewett, Mojan Javaheripi, Piero Kauffmann, James R. Lee, Yin Tat Lee, Yuanzhi Li, Weishung Liu, Caio C. T. Mendes, Anh Nguyen, Eric Price, Gustavo de Rosa, Olli Saarikivi, Adil Salim, Shital Shah, Xin Wang, Rachel Ward, Yue Wu, Dingli Yu, Cyril Zhang, and Yi Zhang. Phi-4 technical report, 2024. URL https://arxiv.org/abs/2412. 08905 .

Nhat-Minh Huynh, Hoang-Giang Cao, and I-Chen Wu. Multi-agent training for pommerman: Curriculum learning and population-based self-play approach, 2025. URL https://arxiv. org/abs/2407.00662 .

Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Huggingface's transformers: State-of-the-art natural language processing, 2020. URL https://arxiv.org/abs/1910. 03771 .

Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendrycks. Representation engineering: A top-down approach to ai transparency, 2023. URL https://arxiv.org/abs/2310.01405 .

Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in large language model representations of true/false datasets, 2024. URL https://arxiv.org/abs/ 2310.06824 .

Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. In NIPS-W , 2017.

Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods, 2022. URL https://arxiv.org/abs/2109.07958 .

et al. McGrath. Mapping the latent space of Llama 3.3 70B. Goodfire Research , 2024.

Dmitrii Kharlapenko, neverix, Neel Nanda, and Arthur Conmy. Self-explaining SAE features. LessWrong , August 2024. URL https://www.lesswrong.com/posts/ 8ev6coxChSWcxCDy8/self-explaining-sae-features . AI Alignment Forum.

Yixiong Hao, Ayush Panda, Stepan Shabalin, and Sheikh Abdur Raheem Ali. Patterns and mechanisms of contrastive activation engineering, 2025. URL https://arxiv.org/abs/ 2505.03189 .

Shenzhi Wang, Chang Liu, Zilong Zheng, Siyuan Qi, Shuo Chen, Qisen Yang, Andrew Zhao, Chaofei Wang, Shiji Song, and Gao Huang. Avalon's game of thoughts: Battle against deception through recursive contemplation, 2023. URL https://arxiv.org/abs/2310.01320 .

Jonathan Light, Min Cai, Sheng Shen, and Ziniu Hu. Avalonbench: Evaluating llms playing the game of avalon, 2023. URL https://arxiv.org/abs/2310.05036 .

Aidan O'Gara. Hoodwinked: Deception and cooperation in a text-based game for language models, 2023. URL https://arxiv.org/abs/2308.01404 .

Yuzhuang Xu, Shuo Wang, Peng Li, Fuwen Luo, Xiaolong Wang, Weidong Liu, and Yang Liu. Exploring large language models for communication games: An empirical study on werewolf, 2024. URL https://arxiv.org/abs/2309.04658 .

Zhenyu Guan, Xiangyu Kong, Fangwei Zhong, and Yizhou Wang. Richelieu: Self-evolving llm-based agents for ai diplomacy, 2024. URL https://arxiv.org/abs/2407.06813 .

Anton Bakhtin, David J Wu, Adam Lerer, Jonathan Gray, Athul Paul Jacob, Gabriele Farina, Alexander H Miller, and Noam Brown. Mastering the game of no-press diplomacy via humanregularized reinforcement learning and planning, 2022. URL https://arxiv.org/abs/ 2210.05492 .

Bidipta Sarkar, Warren Xia, C. Karen Liu, and Dorsa Sadigh. Training language models for social deduction with multi-agent reinforcement learning, 2025. URL https://arxiv.org/ abs/2502.06060 .

Sihao Hu, Tiansheng Huang, Fatih Ilhan, Selim Tekin, Gaowen Liu, Ramana Kompella, and Ling Liu. A survey on large language model-based game agents, 2024.

Nicholas Goldowsky-Dill, Bilal Chughtai, Stefan Heimersheim, and Marius Hobbhahn. Detecting strategic deception using linear probes, 2025. URL https://arxiv.org/abs/2502. 03407 .

Tanushree Banerjee, Richard Zhu, Runzhe Yang, and Karthik Narasimhan. Llms are superior feedback providers: Bootstrapping reasoning for lie detection with self-generated feedback, 2024. URL https://arxiv.org/abs/2408.13915 .

Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes, 2018. URL https://arxiv.org/abs/1610.01644 .

Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in language models without supervision, 2024. URL https://arxiv.org/abs/2212.03827 .

Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. Sparse autoencoders find highly interpretable features in language models, 2023. URL https:// arxiv.org/abs/2309.08600 .

Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Conerly, Nick Turner, Cem Anil, Carson Denison, Amanda Askell, Robert Lasenby, Yifan Wu, Shauna Kravec, Nicholas Schiefer, Tim Maxwell, Nicholas Joseph, Zac Hatfield-Dodds, Alex

Tamkin, Karina Nguyen, Brayden McLean, Josiah E Burke, Tristan Hume, Shan Carter, Tom Henighan, and Christopher Olah. Towards monosemanticity: Decomposing language models with dictionary learning. Transformer Circuits Thread , 2023. https://transformercircuits.pub/2023/monosemantic-features/index.html.

Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models, 2024. URL https://arxiv.org/abs/2310.16789 .

William B. Johnson and Joram Lindenstrauss. Extensions of lipschitz mappings into a hilbert space. Contemporary Mathematics , 26:189-206, 1984.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The main claims are representative of the paper's contributions and scope as per the experiments performed.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We include a detailed discussion section on the limitations and assumptions of our work.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification: Our work is empirical and thus does not have theoretical proofs.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We fully disclose all the steps and information needed to reproduce all the results, along with our complete anonymized codebase.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We provide our entire anonymized code repository, and also share the game rollouts and linear probe weights.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/public/ guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We specify all experimental details in the paper, and also share the full anonymized codebase.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We show standard deviations and bootstrap CIs for all our main results.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: In Appendix I, we mention the compute and API cost requirements for each experiment in the paper.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We have reviewed and follow the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We discuss potential positive and negative societal impacts in detail in the discussion section.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [Yes]

Justification: We do not release any models, and discuss the impact of data from our sandbox for gain of function research.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We cite all the original papers and code that we use or build upon in our work. Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We anonymize and share our codebase along with the submission in the form of an anonymous repository URL.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: Our work does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: Our work does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or nonstandard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [Yes]

Justification: We use LLMs to generate and evaluate game rollouts as described in our paper in detail.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

A Generalization on TruthfulQA

In Section 4.2, we show that the linear probes trained on various dishonesty and deception datasets do not generalize to TruthfulQA (without a system prompt). We hypothesize that this is because even when a fraction of dishonest outputs have been generated or seen by the model, it still continues to attempt to answer truthfully to the best of its ability. Thus, probes trained on 'intentional' dishonesty or deception do not work here since the model is not actually trying to be dishonest.

Also, without an explicit mention of dishonesty or deception, the hitherto assistant text has, at best, signal that correlated with 'the generation up to this point seems factually incorrect', which is a very different signal than 'intentionally being dishonest or deceptive' in future generation.

To verify this hypothesis, we run continuations of the model on the TruthfulQA dataset with prefill tokens and ask the model to continue generation for 30 tokens. We share the results in Table 2.

B Full Sample Prompt and Model Response

Here is an example of the full transcript of a game step for an impostor:

Please see our codebase for more examples including those for crewmates.

C Less Data Probes: Performance and Cosine Similarity

We look at many different values of k (the fraction of datapoints to take from the original training data of activations), and plot the train accuracy, test AUROC, and the cosine similarity (of non-diagonal values in the matrix because the diagonals are trivially 1) in Figure 8. For each value of k , we first find the best hyperparameters via a grid search using the validation set and then show the results using the best ones.

We show that as we move to smaller subsets of the same dataset, the linear probes start pointing in different directions. But they still perform the same on the train data and the test data. This is likely because there are a number of directions in high-dimensional space that can help distinguish between any concept (related to the Johnson-Lindenstrauss lemma [42]), and training probes on more datapoints helps us converge to similar-direction probes

D LLM-based Evaluations

We use GPT-4o-mini with a custom prompt to evaluate or label each agent's actions for their skill in lying, deception, planning and awareness . We share the evaluation prompt here, and the evaluation results in Figure 4.

E ROC Curves for Lying and Deception (Among Us)

In this section, we present the ROC curves for the linear probes on lying and deception in Among Us.

F SAE-Steering Impostors for Honesty

In this section, we share an examples of attempting to steer the Llama-3.3-70b-instruct model with the topmost SAE feature using the Steering API of Goodfire (see 4.3 for more details):

0

2000

4000

6000

0

0.2

0.4

0.6

0.8

1

T est AUROC (RepEng)

T est AUROC (AmongUs)

Train Acc. (RepEng)

Train (+Val) Data Size

Similarity / Performance

...

We manually tried several steering features and amounts and found that Impostors either continued acting normally (for small amounts of steering) or just start hallucinating (for larger amounts) as shown in the example.

G Token-wise Probe Score Sample

Here, we share a sample of the activations of the deception probe scores for the system prompt and the model's output (thinking and action) for one crewmate (Figures 13 and 12) and one impostor (Figures 15, 14). Note that the probes correctly identify situations of deception (even for other impostors) in most situations. However, the probes are not perfect - they fire on harmless use of negative words like 'suspicion' as well.

In Figure 11, we show the running averages of the probe scores for one sample of impostor and crewmate. We find that the scores gradually increase, and as we move toward the model's thinking and action, they become significantly divergent.

0

0.5

1

0

0.5

1

0

0.5

1

0

5

10

15

20

25

30

35

40

0

0.5

1

TQA

DQA

RepEng

AmongUs (lying)

AmongUs (deception)

AUROC

AUROC

AUROC

AUROC

Probe trained on AmongUsDataset

Probe trained on TruthfulQADataset

Probe trained on DishonestQADataset

Probe trained on RepEngDataset

The game is played in two phases: Task Phase and Meeting Phase.

During the task phase, the players perform their assigned tasks by choosing COMPLETE TASK or gathering evidence by moving around. They can also CALL MEETING if they suspect an Impostor or witness a crime. They can also SPEAK to share their observations or communicate strategies.

During the meeting phase, players can only speak. Their goal is to communicate effectively, sharing observations to collectively identify any Impostors. After three rounds of discussion, players VOTE to eject a player they suspect is an Impostor.

H Probes Generalization across each Layer

We train and evaluate probes across each layer of the model 'Phi 4' (out of a total of 40 layers), and share the results of the AUROC on each test dataset in Figure 9.

I Compute and API Resource Details

In this section, we provide details about the compute and budget requirements for each experiment in the paper.

For Figures 2 and 5, we run 2054 games, which cost $2000 of OpenRouter API credits.

For Figure 3, we run 400 games on Llama-3.3 and Phi-4, costing $100 in total.

For Figure 3, we pass the 400 games to "GPT-4o-mini", costing $2 in total.

For Figure 9 and 7, we use 2 80GB A100 GPUs from a GPU resource provider for 100 hours at $2 an hour each, with a total of around $400 in total.

For SAEs (1, we use $30 of credits on the Goodfire API.

J Deception Elo and Detection Elo against Release Dates

In Figure 16, we show both the Elo ratings against the release dates of the models along with a quadratic trend fit to show that newer models improve at deception but that trend does not show up for detection.

0

0.2

0.4

0.6

0.8

1

0

0.2

0.4

0.6

0.8

1

lying (AUC = 0.863)

deception (AUC = 1.000)

Random

False Positive Rate

True Positive Rate

(a) Probes trained on Among Us.

0

0.2

0.4

0.6

0.8

1

0

0.2

0.4

0.6

0.8

1

lying (AUC = 0.941)

deception (AUC = 0.996)

Random

False Positive Rate

True Positive Rate

(b) Probes trained on RepEng.

200

400

600

800

1000

0.8

0.85

0.9

0.95

1

Crewmate

Impostor

T oken Index

Deception Probe (running avg.)

Mar 2024

May 2024

Jul 2024

Sep 2024

Nov 2024

Jan 2025

Mar 2025

May 2025

1350

1400

1450

1500

1550

1600

1650

Deception Elo Trend (Quadratic)

Deception Elo

Detection Elo Trend (Quadratic)

Detection Elo

Release Date

Elo Rating

Peer reviews:
comments: SUMMARY:
This paper introduces a sandbox environment based on Among Us, a social deduction game, to study open-ended strategic deception in LLMs. The authors evaluate 18 different models, introduce "Deception Elo" as a metric for measuring deceptive capability, and demonstrate that linear probes trained on simple datasets can detect deception out-of-distribution with remarkably high accuracy (95-99% AUROC). A key finding is that frontier reasoning models are differentially better at producing deception than detecting it.

STRENGTHS AND WEAKNESSES:
Strengths:
- Strong generalisation results.
- Clear presentation and nice visuals.
- The authors evaluate a large selection of models across a large number of games, providing substantial empirical evidence.
Weaknesses:
The paper justifies its contribution as compared to Chi et al. (2024) by not prompting/providing examples. I would argue that this doesn't fundamentally change the evaluation nature. The game is explicitly about deception and is likely well-represented in training data. I’m not sure if there is a big distinction between explicitly prompting the model to be deceptive and making the model play a game which it already knows is about being deceptive? This makes it questionable whether this truly studies "open-ended" deception.

QUESTIONS:
- Is this environment intended to be an alignment evaluation or a capability evaluation?
- How do you know that model performance isn't due to memorisation of strategies in the pretraining data? Have you considered testing on modified game rules? Why use a “famous” game rather than creating something similar which won’t have the preexisting connection to deception?
- Should a model doing well in this environment be considered concerning?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-15

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an evaluation environment for agentic LLM deception, based on a simplified, text-based version of the game Among Us. Models are compared to one another on the metrics \"deception Elo\" and \"detection Elo.\" A variety of logistic regression probes are trained to detect deception, and some are showed to have high efficacy. Some SAE features are also effective for detecting deception, although other deception-related SAE features are ineffective.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n- The paper is well-written and well-cited.\n- The paper provides an important and novel automated benchmark for evaluating LLM agent capabilities related to deception and detection of deception. The evaluation metrics are scalable because LLMs are evaluated comparatively based on Elo.\n- A wide variety of models are evaluated.\n- The discussion of probes and SAE features for detecting deception is interesting.\n\nWeaknesses:\n\n- A key assumption is that success as an impostor can be equated to deception abilities. The deception Elo metric is defined solely based on success as an impostor, without regard to whether an agent actually produces deceptive text or thinking while playing an impostor. I would like to see qualitative analysis that supports this assumption. The discussion section claims that \"Among Us, as a game, requires deception to win,\" but a more accurate statement might be that \"Among Us rewards deception as a strategy for winning as an impostor.\" Some impostor strategies that don't require deception could include: killing only when completely alone with victims, avoiding the suspicion of other players, staying silent during meetings rather than actively lying, and letting crewmates vote each other out. When manually reviewing transcripts of impostors, are there almost always instances of deceptive thinking or speech toward other players? Figure 4 shows that impostors are almost always deceptive and are truthful only rarely, according to GPT-4o-mini prompted with relevant context. This might be sufficient justification, but it would be useful to see confirmation that high-Elo impostors continue to be dishonest.\n- In Section 5. Related Work, the sentence \"to the best of our knowledge, we are the first to use social games as a sandbox to elicit, evaluate, and study harmful behavior in AI agents\" does not adequately explain why this paper is unique compared to previous papers. The preprint Hoodwinked can also be argued to be a social game for eliciting, evaluating, and studying harmful behavior in AI agents.\n\nQUESTIONS:\nSuggestions:\n\n- Clarify why it is reasonable to assume that success as an impostor can be equated to deception ability.\n- Clarify what makes this paper novel compared to related work.\n\nLIMITATIONS:\nAmong Us is a trademark of Innersloth. Since the benchmark is named the same as Innersloth's game, and is inspired but not identical to the game, I would suggest obtaining permission from Innersloth or carefully considering whether it may be advisable to rename the benchmark.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a new environment designed to evaluate deception and manipulation capabilities in LLMs. The environment is based on the social deduction game \"Among Us\", where two opposing teams compete to win, one through deception and elimination of other players, the other through cooperation. The authors perform extensive evaluation of a variety of frontier LLM models, using linear probes and SAEs to quantify their deception capabilities. The results show a correlation between general model capability and how deceptive it can be, while there is no such correlation for the detection of deception using such models. Linear probes and SAEs are shown to generalise well to detecting deception in LLMs, but not to steering them.\n\nSTRENGTHS AND WEAKNESSES:\n### Originality\n\nThe work and direction are novel. While some attention was also given to Among Us in multi-agent systems [1], I am not aware of any LLM-based evaluations, other than what the authors mention.\n\n### Quality\n\nThis paper is of high quality, with large-scale experiments and evaluations. A good amount of analysis is performed, and the confidence intervals are provided.\n\n### Clarity\n\nThe overall clarity is good. However, the paper could be better organised in terms of reading layout. The main issues are:\n\n- Figures are not placed optimally for reading.\n  - Most figures are quite far from where they are referenced, and so reading the paper involves a lot of jumping around.\n    - e.g., Figure 2 is near Section 2.1, but only mentioned in Section 3.3, just below Figure 6.\n- The appendix also requires re-organisation. Some examples:\n  - Figures 12 and 13 intersperse a text example, which makes it hard to read.\n  - Figures 12 and 13 appear 3 pages after they are mentioned.\n  - Figure 12-15 could be better cropped.\n- Figure 7 does not have labelled axes.\n- Line 53 repeats the introduction of \"Deception Elo\" from line 52.\n\n### Significance\n\nThis work could have a good amount of impact in terms of deception research in LLMs. The dataset and code are provided, so the results should be reproducible, and the environment should be adaptable. Additionally, the paper makes interesting observations which will be of interest to the broader field, such as that frontier models do not increase in deception detection capability.\n\n### References\n\n[1] Kopparapu et al. ‘Hidden Agenda: A Social Deduction Game with Diverse Learned Equilibria’. 5 January 2022. http://arxiv.org/abs/2201.01816.\n\nQUESTIONS:\n- > St = (Pt, Lt, Gt), where Pt is the information about a player (their role, assigned tasks, progress, cooldown, etc.),\n  - Shouldn't Pt be an $i$-indexed array of all player informations? Does the game only store one player's information?  \n- Why does Figure 2 have two lightly shaded regions? Which is the confidence interval?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Among Us as a sandbox environment to study deceptive behavior in LLMs. The primary motivation is to address a big gap in AI safety research: prior studies on deception were limited to simple, binary choices or single false statements, failing to capture complex, long-term deceptive strategies that might emerge in real-world scenarios.\n\nThe authors propose that Among Us is ideal for this research because deception is not explicitly prompted but arises naturally as a core component of the gameplay for certain roles (the \"Impostors\", and “Crewmates”). The goal is to create a setting to elicit, measure, and detect this emergent, open-ended deception in a controlled environment.\n\nThe study tests two primary interpretability techniques to detect deception from a model's internal states:  Linear Probe and  SAEs.\n\nThe paper reports several interesting findings:\nA clear trend that as models become more advanced, their capability for deception (Deception Elo) increases more significantly than their capability for detecting deception (Detection Elo). This was particularly true for models trained with RL.\n\nLinear probes trained on datasets of dishonesty generalized remarkably well to the deception in Among Us. \n\nThe researchers identified two specific SAE features that were highly effective at detecting deception out of distribution. However, attempting to use these features to steer an Impostor agent toward honesty failed. Instead of making the agent more truthful, the steering intervention caused it to hallucinate and produce nonsensical outputs.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n1. Interpretability of agent deception is novel.\n\n2. A crucial aspect of the setup is that the LLM agents were only given the rules of the game. They were not prompted with specific deceptive personalities or given in-context examples of how to lie, forcing deceptive strategies to emerge naturally from the game's objectives. This is likely a more accurate (although not the best) set up to study deception in the wild.\n\n3.  The authors evaluate 18 proprietary and open-weight LLMs.\n\n\nWeakness\n\nThe paper claims that ‘Deceptive behavior emerges in impostors naturally from the game rules’  without explicit prompting for deception. However, the system prompt provided to the Impostor agent is highly directive: \"You are an Impostor... Your mission is to eliminate Crewmates… During the task phase, you can perform fake tasks\".  Words like “perform fake tasks” are explicitly prompting for deception. This isn't a neutral environment where deception emerges. it is a game setup where deception is an instrumentally rational, and often necessary, strategy to fulfill an explicit objective. The behavior observed is better described as goal-directed instrumental deception rather than a spontaneously emergent phenomenon.\n\nFurthermore, the authors rightly acknowledges the limitation that \"it is likely that models have seen some Among Us data during pre-training\". This is an important, and understated weakness. If a model has ingested data from forums, game streams, and articles about Among Us, even if the authors do not explicitly prompt the agents with specific deceptive personalities or given in-context examples of how to lie,  the internet or training data might INDIRECTLY prompted the model to do so.\n\nQUESTIONS:\n1. Is it possible that a probe could achieve high AUROC simply by detecting the activation patterns associated with this \"Impostor context\" rather than the act of lying or misleading itself?  The linear probes and SAE features may not be detecting the cognitive act of deception, but the model's internal representation of its assigned role (system prompt). The system prompts are different for Impostors and Crewmates, and the Impostor prompt contains words like \"kill,\" \"eliminate,\" and \"fake tasks.\"  Existing works in the literature show that different system prompts induce very different representations in the residual stream activation and simple PCA would reveal two distinct clusters for the different system prompts. \n\nTo address this, the authors might need to find an environment where the incentive to deceive is not perfectly aligned with a fixed, binary role assignment. For example, the authors could consider exploring games like Blood on the Clocktower (BOTC). Players are secretly on the \"Good\" or \"Evil\" team. Importantly, the game has a complex and asymmetric information structure, driven by a large number of unique roles. It prevents the role/deception confounds in a way that creates a far richer setting beyond binary difference. BOTC breaks the simplistic dichotomy where \"Evil = Deceiver\" and \"Good = Truth-teller.\" In BOTC, deception is a critical strategy for both teams. Pro-Social Deception (Good players lying): Many Good roles are incentivized to lie. For example, the Mayor is a powerful Good role, but if they reveal their identity, the evil Demon will kill them immediately. An optimal Mayor will therefore spend much of the game \"bluffing\" as a less important role, actively lying about their identity for the ultimate benefit of the Good team. It elegantly solves the role confound by decoupling deception from team alignment. \n\n2. Can you find other games where deception is a strategic choice driven by circumstance and individual goals, rather than a fixed requirement of one's team alignment given through prompting? Diplomacy could be another candidate for study. Diplomacy could be the best sandbox for decoupling deception from group alignment because there is no team alignment.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-03"}