Hoodwinked: Deception and Cooperation in a Text-Based Game for Language Models

• Hoodwinked places players in a house where innocents seek a key and an impostor kills them, followed by natural-language discussion and a banishment vote.Source: §1 · p. 1, Figure 1 · p. 2
• 55% of games with discussion banish the killer, compared with 33% without discussion, showing that discussion improves cooperation overall.Source: §1 · p. 1
• Witnesses are 12 percentage points less likely to correctly banish the killer after discussing with the killer, while non-witnesses are 22 points more likely to identify the killer.Source: §1 · p. 1
• 18 of 24 pairwise comparisons favor more advanced models as more effective killers, with the advantage attributed to stronger deception during discussions rather than different actions.The authors report that voting patterns among players who did not directly observe murders drive this effect.Source: §1 · p. 1
• The game and source code are publicly available to support evaluation of whether language models can deceive humans and future research on cooperation and lie detection.Source: §1 · p. 2

2.1 Hoodwinked: A Text-Based Murder Mystery Game

• Hoodwinked pits innocents seeking a hidden key against an impostor who can kill co-located players, with victory determined by escape, murder, or banishment.Source: §2.1 · p. 2
• After each murder, surviving players make natural-language statements and simultaneously vote on whom to banish.Source: §2.1 · p. 2
• Personalized prompts provide each player’s identity, rules, action history, observed murders, discussion text, and voting results, while actions cover movement, searches, and killing available targets.Source: §2.1 · p. 2

2.2 Models

• Experiments benchmark GPT-3 Ada, GPT-3 Curie, GPT-3.5 Chat, and GPT-4, prompting them to produce actions, discussions, and discussion statements.Source: §2.2 · p. 2
• Actions are sampled from model probabilities, discussion uses temperature 1 with a 50-token maximum, and overly long GPT-3 prompts replace earliest turns with an ellipsis.Source: §2.2 · p. 3

3.1 Discussion Facilitates Cooperation and Deception

• During discussions, killers denied crimes and accused others, while eyewitnesses and non-witnesses exchanged evidence about the killer’s identity.A representative exchange shows a witness accusing the killer, the killer claiming to be framed, and a non-witness evaluating the accusation.Source: §3.1 · p. 3

3.2 Communication Facilitates Cooperation and Deception

• Discussion increased killer banishment from 32% to 43% for GPT-3.5 and from 33% to 55% for GPT-3 Curie.Across these experiments, information sharing by innocent players outweighed the risk of deception during discussion.Source: §3.2 · p. 3
• GPT-3 Curie eyewitness accuracy fell from 82% without discussion to 70% with discussion, whereas GPT-3.5 eyewitnesses remained perfectly accurate in both conditions.Non-witnesses consistently benefited from discussion, while eyewitnesses could be deceived despite already receiving direct evidence.Source: §3.2 · p. 3
• Figure 2 presents a heatmap showing the percentage of games in which the killer is banished, with each matchup based on a sample of either 50 or 100 games.Source: Figure 2 · p. 4

3.3 More Advanced Models are More Deceptive

• More advanced models were less likely to be banished in 18 of 24 pairwise comparisons, with banishment rates of 36% versus 51% for less advanced models.Non-witnesses were less likely to vote to banish more advanced models in 19 of 24 pairwise comparisons, suggesting stronger discussion-based deception.Source: §3.3 · p. 4
• More advanced models were slower to strike in 75% of comparisons and allowed more innocent escapes in 79%, but eyewitnesses saw 20% of their murders versus 21% for less advanced models.They also averaged 1.40 murders per game versus 1.38, indicating that caution alone does not explain their lower banishment rates.Source: §3.3 · p. 4

Dangerous capability evaluations

• Dangerous-capability research evaluates harmful behaviors such as disinformation and cyberattacks, including inverse scaling trends where larger models may be less capable or more harmful.The cited work motivates probing potentially dangerous capabilities to inform technical safety research and societal responses.Source: §4 · p. 4

Deception

• Prior deception research studies propaganda, scams, confabulations, and learned behaviors that reliably mislead humans, while also investigating detection and correction methods.These methods include examining or intervening on neural-network internal states.Source: §4 · p. 5

Text-Based Games

• Text-based games provide richer information environments for studying social dynamics and agent actions than static binary or multiple-choice evaluations.Related work has also used such environments to measure and improve ethical decision-making by text-based agents.Source: §4 · p. 5

Social Deduction Games

• Human deception in Mafia and Werewolf has been studied with NLP, whereas prior Among Us agents lacked natural-language discussion and therefore lacked this setup’s deception channel.AI agents have also reached human-level play in Diplomacy, another game involving deception between players.Source: §4 · p. 5

Cooperative AI

• Cooperative-AI research emphasizes agents that cooperate with humans, while recognizing that communication can facilitate cooperation but also be undermined by deception.Suggested countermeasures include commitment devices, reputation, and interpretability techniques.Source: §4 · p. 5

• Language models often lie and deflect blame as killers, measurably affecting voting outcomes.Source: §5 · p. 5
• Readers can play Hoodwinked against GPT-3.5, with gameplay data planned for a follow-up study of AI deception of humans.Source: §5 · p. 5
• The released source code supports future research on evaluating and improving AI agents’ cooperative and honest tendencies beyond multiple-choice lie benchmarks.Source: §5 · p. 5

Game framework

• Players receive procedurally generated prompts containing game rules, prior turns, and a requested action or statement.Source: A Game Examples · p. 7

Innocent-player example

• Innocent players search rooms for a key and can win by unlocking the door and escaping alive.Source: A Game Examples · p. 7

Game framework

• Players choose actions by number, after which the backend replaces the action list with a natural-language description of the chosen action.Source: A Game Examples · p. 7

Killer example

• The killer must murder other players while hiding their identity to avoid being banished.Source: A Game Examples · p. 8
• A killer victory example shows Bob denying a witnessed murder, shifting blame to Sally, and avoiding banishment before killing the remaining player.Source: A Game Examples · p. 8

Innocent-player example

• An innocent victory example shows Bob reporting Tim’s murder, Sally supporting the accusation, and the group banishing Tim by majority vote.Source: A Game Examples · pp. 8–9