L egal S im: Multi-Agent Simulation of Legal Systems for Discovering Procedural Exploits (2025)

Abstract: We present LegalSim, a modular multi-agent simulation of adversarial legal proceedings that explores how AI systems can exploit procedural weaknesses in codified rules. Plaintiff and defendant agents choose from a constrained action space (for example, discovery requests, motions, meet-and-confer, sanctions) governed by a JSON rules engine, while a stochastic judge model with calibrated grant rates, cost allocations, and sanction tendencies resolves outcomes. We compare four policies: PPO, a contextual bandit with an LLM, a direct LLM policy, and a hand-crafted heuristic; Instead of optimizing binary case outcomes, agents are trained and evaluated using effective win rate and a composite exploit score that combines opponent-cost inflation, calendar pressure, settlement pressure at low merit, and a rule-compliance margin. Across configurable regimes (e.g., bankruptcy stays, inter partes review, tax procedures) and heterogeneous judges, we observe emergent “exploit chains”, such as cost-inflating discovery sequences and calendar-pressure tactics that remain procedurally valid yet systemically harmful. Evaluation via cross-play and Bradley-Terry ratings shows, PPO wins more often, the bandit is the most consistently competitive across opponents, the LLM trails them, and the heuristic is weakest. The results are stable in judge settings, and the simulation reveals emergent exploit chains, motivating red-teaming of legal rule systems in addition to model-level testing.

## introduction the legal system is an adversarial process guided by dense procedural rules that shape how disputes unfold. litigants do not only argue substance; they sequence filings, exploit timing, and impose tactical costs to influence outcomes. as ai enters legal practice, these tactics may be amplified: learning agents can search large procedural spaces, probe edge cases at scale, and coordinate strategies with speed and persistence beyond human capacity. this possibility raises questions at the intersection of natural legal language processing, multi-agent reinforcement learning, and ai safety @xcite . most work in legal nlp treats models as assistive tools that classify, summarize, retrieve, or predict @xcite @xcite . these settings assume a largely passive role for ai within human workflows. far less is known about what happens when ai agents interact directly with codified procedure and with each other. in complex systems, agents trained to optimize rewards often uncover loopholes that remain technically compliant while socially harmful @xcite . the legal process, with its motion practice, deadlines, and rule-based gates, is a natural domain where such behavior may emerge. we argue that studying these dynamics requires a simulation environment that treats litigation as strategic interaction under rules. our approach frames procedure as a structured action space with observable state, limited information, and stochastic judicial response. agents learn over repeated play to pursue objectives that extend beyond win or loss, including cost imposition, delay, and settlement leverage under sanction risk. by varying rule sets across domains, the same environment can reveal how different procedural regimes encourage or deter exploitative behavior. we introduce legalsim, a modular multiagent framework for adversarial legal proceedings. plaintiff and defendant agents select structured actions validated by a json rule engine that encodes domain-specific procedural gates; a stochastic judge mediates outcomes via calibrated grant rates, cost allocations, and sanction tendencies. policies include a hand-crafted heuristic baseline, a contextual bandit over tactic families, a ppo policy trained in self-play, and a direct llm policy @xcite @xcite @xcite . rather than optimizing a binary case outcome, agents receive a composite exploit score that aggregates opponent-cost inflation, calendar pressure, settlement pressure conditional on low merits, and a rule-compliance margin. ## background and related work our research sits at the intersection of four areas: ai for legal reasoning, ai safety in legal contexts, multi-agent systems for strategic discovery, and the formalization of law as code. each area is established, but their synthesis to red-team legal frameworks is new. ## problem formulation we model litigation as a multi-agent adversarial game governed by codified procedure. two agents, plaintiff and defendant, act in a structured environment mediated by a judge. the objective is to allow learning agents to discover strategies from the environment dynamics rather than rely on hand-coded heuristics. ## experiments and evaluation we evaluate legalsim under a controlled protocol that alternates roles each game, sweeps ten random seeds, and rotates between two judge profiles: permissive (grant_rate 0.65, sanction_tendency 0.25, calendar_load 0.55) and strict (0.35, 0.70, 0.60). domains are loaded from json rule files; unless noted, we use the default regime. policies and training. we evaluate the four policy families introduced in sec. 4 (heuristic, llm, contextual bandit, ppo). the heuristic is nonlearning. the llm policy uses a single api model at inference time and emits json-constrained tokens without any fine-tuning. the contextual bandit selects a high-level tactic via an ϵ-greedy linear contextual bandit with a bias term (ϵ=0.1, learning rate 0.05), then asks the same llm to instantiate a concrete token; it performs one sgd update per episode on the terminal composite reward. the ppo agent is an actor critic over the discrete token set with a 13-d observation (budgets, burdens, judge features, merits, progress, gate summaries); both actor and critic are two-layer mlps (64 tanh units each) trained with adam (3 × 10 -4 ), γ=0.99, gae λ=0.95, clip ϵ=0.2, and entropy coefficient 0.005. ppo optimizes the shaped reward r @xmath0.20 ∆(opponent burden)-0.01 ∆(own cost) -0.01 ∆(own burden) . (2) with a terminal bonus of +5 (plaintiff win) and -5 (defendant win), is trained for 300 episodes against the heuristic while alternating judges by episode, and is then frozen for evaluation. environment and rules. litigation is modeled as a turn-based process with a rules-as-code core. agents emit tokens such as request_docs, file_motion, move_sanctions, meet_confer, settlement_offer, and file_proceeding. a json rule engine maps state-action conditions to cost transfers, burden updates, temporary gates that block actions, and judge-sensitive sanction events; a rulesoracle provides proportionality and sanction-risk proxies. each episode tracks budgets, burdens, merits, fees, sanctions, active gates, and the judge profile. protocols. we use two complementary designs. (i) head-to-head: selected pairs play under both judges with alternating roles; we log token sequences, rulings, and per-role metrics. (ii) crossplay league: all policies play all others across seeds and judges. from these games we build a rolesymmetric payoff matrix a whose entry when policy i faces j, flipping the sign when roles swap so cells are comparable. we also fit rolesymmetric bradley-terry-luce (btl) ratings with a sum-to-zero constraint (bradley and @xcite : and report 95% bootstrap confidence intervals over 500 resamples. prompt templates used during evaluation are reproduced in app. c overall effectiveness. the win-rate analysis in figure 1 (win-rate by policy & judge) shows a consistent ordering: ppo attains the highest effective win rate overall, followed by the contextual bandit, then the llm policy, with the heuristic trailing. the same ordering holds within each judge profile. this indicates that learning a direct policy over the token space (ppo) converts the observable state into match wins more reliably than tactic selection with llm instantiation (contextual bandit) or purely generative action proposals (llm). exploitiveness metrics. each episode produces per-role components already defined in the environment: (i) opponent cost inflation (opponent fees divided by own fees), (ii) calendar pressure (opponent burden divided by 1+ own burden), (iii) settlement pressure at low merit (settlement offers times 1-own merits, clipped), and (iv) rule-compliance margin (a penalty for self-sanctions). the composite exploit score is a fixed weighted sum of these components (0.35/0.25/0.25/0.15). we summarize these per policy with means and standard errors and also report the flag rate, the fraction of episodes with @xmath1.6. exploitiveness results. applying these definitions, judge effects. breaking out the bars in figure 1 by judge shows that absolute win rates shift with judicial temperament, but the relative ordering of policies remains stable. on the permissive judge, motion-driven strategies benefit more; on the strict judge, margins compress but the ranking persists. this mirrors the sanction and grant-rate sensitivities in robustness. we stress-test the policies in two simple ways: (i) we make the judge more likely to impose sanctions, and (ii) we add @xmath2. for each policy and judge profile we then recompute two summaries, the mean composite exploit score and the fraction of episodes that are flagged (@xmath3.6), and present them as a policy-by-stress matrix ( beyond accuracy. the problem is not only wrong predictions but system-level exploits that emerge when agents play the rules. league and cross-play results echo findings in open multi-agent games: small tactical gains can snowball into undesirable equilibria @xcite . evaluating performance in such ecologies requires methods beyond simple win-rates, such as alpharank or bradley-terry models, to capture the full matrix of strategic interactions @xcite . design-time defenses. harden procedures before deployment: introduce light randomization in scheduling, add rule linting to detect long burdeninflating chains, and tie cost shifting to burden ratios so exploit-heavy sequences become expensive. governance. require pre-deployment redteaming in a rules-as-code sandbox, disclosure of agent capabilities, and auditable reports with cross-play matrices, btl ratings, and exploit dashboards. this aligns with emerging ai governance standards, such as the nist ai risk management framework, which emphasizes continuous testing, evaluation, and risk mitigation throughout the ai lifecycle the core risk is not that agents can win, but that they can steer rule-driven systems toward exploitheavy equilibria. simulation-first analysis, league benchmarks, and targeted procedural guardrails provide a practical path to measure and mitigate these effects. ## ethical considerations this work examines how agentic ai might exploit codified procedure with the goal of improving safety and fairness in legal automation by identifying failure modes before real-world use. by surfacing and quantifying "exploit chains," we aim to support due-process values and reduce risks. we acknowledge dual-use concerns: the same insights could enable misuse. to mitigate this, we confine our analysis to simulation, avoid jurisdiction-specific guidance, and emphasize safeguards. legalsim is a research simulator and not legal advice. ## limitations our simulator necessarily abstracts complex laws and institutional practice: rules are encoded at a coarse level, the judge model is parametric and stationary, and strategy discovery is constrained by a tokenized action space. the exploit metrics and their weights, though motivated, are ultimately design choices that may not capture the full spectrum of welfare-relevant harms. similarly, policy coverage remains narrow (four families) and training horizons modest, such that stronger or more sample-efficient methods could shift the observed rankings. these results should therefore not be assumed to generalize across jurisdictions, case types, or institutional settings, especially since the environment omits strategic behavior by non-party actors such as regulators or multi-judge panels. a central limitation is that our findings have not yet been grounded in real-world judicial data or case law. while the experiments reveal how artificial agents may exploit procedural rules in silico, we have not examined whether comparable exploitative dynamics occur in practice, nor how judicial actors (e.g., judges, clerks, regulators) adapt to mitigate such behaviors. finally, we emphasize that simulations cannot substitute for legal or ethical judgment. insights derived here should inform, but never replace, human governance and procedural safeguards. ## conclusion we introduced legalsim, a modular multi-agent simulation that treats procedure as rules-as-code and measures how ai-driven strategies can exploit legal process. across head-to-head and crossplay evaluations, we observed consistent ordering among policies, documented emergent "exploit chains," and quantified exploitiveness with outcome and pressure centric metrics. these results frame procedural robustness as an ai-safety problem: not only how models behave, but how codified rules can be gamed. the framework provides a controlled setting to study defenses, e.g. randomized gates, human review for high-impact actions, and system-level red-teaming, before deployment in real practice. we hope this work catalyzes collab-