CONSCIENTIA: Can LLM Agents Learn to Strategize? Emergent Deception and Trust in a Multi-Agent NYC Simulation

• The simulation contains 150 Blue navigators and 100 Red adversaries, with Red agents using persuasive dialogue to steer Blue agents toward billboard locations.The iterative procedure augments rollout data with Qwen3-14B and optimizes agents using KTO to improve task success and reduce susceptibility.Source: Figure 1 · p. 2, §1 · p. 2
• 57.3% peak task success and 70.7% minimum susceptibility at generation eight reveal non-monotonic improvement shaped by multi-turn interaction dynamics.These results come from the ten-generation empirical analysis.Source: §1 · p. 2
• Aligned agents shift toward selective cooperation and caution, reducing over-refusal during conversational encounters.The study interprets this behavioral change under repeated multi-agent interaction rather than isolated one-step decisions.Source: §1 · p. 2
• A utility metric combines journey completion, safe-location attainment, and trajectory efficiency, exposing the persistent performance cost of adversarial interaction.Source: §1 · p. 2

3 Generations, Runs, and Policy Learning

• The environment contains 150 Blue and 100 Red agents with opposing objectives: efficient, billboard-avoiding navigation versus steering Blues toward billboards through dialogue.Source: §3 · p. 3
• Training repeats a 10-iteration loop that augments data, fine-tunes policies with KTO, and redeploys them for post-tuning simulation rollouts.Source: §3 · pp. 3–4
• KTO is selected because trajectory-level judgments arise naturally, avoiding DPO’s preference-pair requirement and PPO’s dense-reward and long-horizon credit-assignment demands.Source: §3 · p. 3
• The pipeline begins with baseline rollouts from Qwen3-4B deployed across all 250 agents, capturing benign navigation and adversarial interaction patterns.Source: §3 · p. 3
• Each iteration converts previous rollouts into unpaired desirable and undesirable examples, augmented to 3,600 desirable and 1,500 undesirable samples using Qwen3-14B with vLLM.Source: §3 · p. 3
• KTO directly optimizes unpaired examples, using KL regularization and class-specific weighting to push desirable responses above a baseline and undesirable responses below it.Source: §3 · p. 3
• After fine-tuning, fresh trajectories replace the previous dataset, creating the feedback cycle for the next alignment iteration.Source: §3 · p. 4

4 From Emergent Strategy to Observable Metrics

• The evaluation uses reconstructed trajectories to measure blue–red alignment across safety, efficiency, and task utility.Task completion and unsafe susceptibility are defined with respect to adversarial billboard locations.Source: §4 · p. 4

4.0.1 Agent Outcome classes

• Blue agents are classified into four mutually exclusive outcomes based on destination reachability and billboard exposure, yielding Task Success Rate and Susceptibility Rate.The classes distinguish safe completion, unsafe completion, safe failure, and unsafe failure.Source: §4.0.1 · p. 4

4.0.2 Safety versus helpfulness

• Safety versus helpfulness is quantified through Blue-Red Gullibility, Resistance, and blue-to-blue helpful interactions.Gullibility captures immediate compliance with red billboard suggestions, while resistance captures noncompliance.Source: §4.0.2 · p. 4

4.0.3 Trajectory quality and efficiency

• Trajectory quality is measured using Mean Trajectory Length and Path Redundancy, with long-horizon safety based on first billboard-hitting time and censored safe trajectories.Path Redundancy is computed over unique visited locations.Source: §4.0.3 · p. 5

4.0.4 Long-horizon red influence

• Red influence over longer horizons is measured by Reachability Manipulation Effectiveness and the Red Causal Horizon, defined as delay until the first billboard hit.These metrics apply to red-to-blue interactions.Source: §4.0.4 · p. 5

4.0.5 Utility-based evaluation

• Completion, safety, and efficiency are combined into parameterized per-agent utility and aggregate utility, with defaults α = 1, β = 1, γ = 0.05, and Tmax = 50.The evaluation also reports legacy and red utilities.Source: §4.0.5 · p. 5

5.1 Quantitative Analysis

• 57.3% task success in run 10 versus 46.0% for the base policy contrasts with run 8’s lowest susceptibility of 70.7%, establishing a persistent robustness–completion trade-off.Later policies preserve relatively stable trajectory length and path redundancy, while run 10 achieves the highest Blue utility and run 8 the strongest susceptibility reduction.Source: Figure 2 · p. 6, §5.1 · pp. 6–7
• Immediate resistance to malicious advice stays above 90%, while later generations improve Blue–Blue trust efficacy and reduce over-refusal, indicating more selective cooperation than uniform caution.The dominant residual failure is delayed or indirect compromise, and Red influence remains substantial despite improved Blue behavior.Source: §5.1 · pp. 6–7, Figure 2 · p. 6

5.2 Qualitative Analysis

• The qualitative evaluation samples 834 trajectories across four end-state buckets and scores Goal Directedness and Manipulation Susceptibility using multiple LLM judges as structured, non-ground-truth signals.Judges receive destinations and step-by-step trajectory transcripts, with agreement statistics used to assess consistency.Source: §5.2 · p. 7

5.3 LLM Judge Agreement and Evaluation Reliability

• 0.619–0.757 pairwise kappa and 0.648 alpha for Goal Directedness exceed 0.127–0.302 and 0.204 for Manipulation Susceptibility, making the latter a softer qualitative indicator.The weaker agreement reflects the difficulty of distinguishing benign detours from subtle adversarial influence in trajectory traces.Source: §5.3 · pp. 7–8, Table 1 · p. 8

To better understand how manipulation succeeds, we conduct a heuristic post-hoc analysis

• 84.6% of Blue agents that initially reject malicious suggestions are eventually manipulated, while susceptibility rises from 56.6% after one red contact to 94.8% after multiple contacts.Longer conversations and high-trust social language are associated with higher manipulation and larger trajectory deviations.Source: To better understand how manipulation… · p. 8, Figure 3 · p. 9
• 673 repeated-steering episodes produce 93.9% susceptibility and 39.8% reach, while 155 delayed-compromise episodes yield 100% susceptibility and 23.2% reach.Attack strength scales monotonically from 63.0% to 31.4% reach and 49.1% to 98.3% susceptibility, with longer paths under stronger attacks.Source: To better understand how manipulation… · p. 8, Figure 3 · p. 9
• 525 episodes of confusion under conflicting advice show 93.5% susceptibility, indicating that sustained strategic manipulation erodes long-horizon goal consistency more than one-step gullibility.Other failures include local correction with global drift and over-trusting social signals.Source: To better understand how manipulation… · p. 9, Figure 3 · p. 9

• Iterative alignment improves task completion, reduces susceptibility, and strengthens selective cooperation without sacrificing trajectory efficiency.Source: §6 · p. 9
• The safest and best-performing generations do not coincide, while Red agents retain substantial long-horizon influence.Source: §6 · p. 9
• Robust alignment requires preserving goal integrity over extended interactions, not merely rejecting isolated bad advice.Source: §6 · p. 9
• Overall, the results indicate a limited but fragile form of strategic behavior that remains far from robust autonomy.Source: §6 · p. 9

7 Limitations

• Using only Qwen3-4B and Qwen3-14B leaves open whether the observed adversarial dynamics generalize beyond architecture-specific behavior.The limitation concerns the absence of heterogeneous model families in the multi-agent setting.Source: §7 · p. 10
• Restricting interactions to a simulated NYC map with static billboards makes it unclear whether agents learn spatial reasoning or memorize local geographic heuristics.The environment may not distinguish general navigation capabilities from map-specific memorization.Source: §7 · p. 10
• LLM-based judging of complex reasoning traces produced low agreement for manipulation susceptibility, with Krippendorff’s alpha of 0.204.Automated metrics struggle to distinguish benign detours from subtle entrapment.Source: §7 · p. 10
• Despite KTO improving task success, aggregate Blue utility remains negative across all configurations because Red manipulation costs outweigh gains from benign task completion.This indicates that improved task success does not eliminate the overall utility deficit caused by adversarial manipulation.Source: §7 · p. 10

Scope and framing

• The simulation involves no human subjects, personal data, or real-world navigation deployment, and its Red/Blue setting is presented as an analytical abstraction rather than a manipulation blueprint.The study examines hidden identities, conflicting incentives, and persuasive dialogue in a controlled environment.Source: §8 · p. 10

Risks and limitations

• The primary societal concern is that persuasive agentic systems could be misapplied for manipulation, misleading advice, or targeted influence.The paper frames its findings as a safety-oriented analysis of vulnerabilities and trade-offs, including the tension between task success and resistance to adversarial steering.Source: §8 · p. 10

Responsible research

• The authors emphasize minimizing harm, honesty, transparency, fairness, privacy, confidentiality, and accurate disclosure of substantive LLM assistance in the research process.Disclosed assistance includes model-based data generation, evaluation, and other non-trivial uses of LLMs.Source: §8 · p. 10

9 Frequently Asked Questions (FAQs)

• The paper’s primary contribution is a controlled behavioral framework combining multi-agent simulation, closed-loop alignment, and metrics for deception, trust, and adversarial steering.KTO is presented as an alignment mechanism within this framework, not as the sole standalone contribution.Source: §9 · p. 17
• KTO is the cleanest fit because supervision consists of unpaired desirable or undesirable trajectory outcomes rather than demonstrations, preference pairs, or dense rewards.SFT, DPO, and PPO would require substantial additional design choices for pseudo-demonstrations, trajectory pairing, or reward engineering.Source: §9 · pp. 19–20
• The reported gains support the overall KTO-based closed-loop framework, but they do not isolate KTO’s unique causal contribution because Qwen3-14B augmentation and alternative-baseline comparisons are absent.The section calls for SFT, DPO, imitation or reward-weighted baselines, and augmentation ablations to strengthen attribution.Source: §9 · p. 20
• The stylized NYC environment is intended to isolate persistent socially mediated manipulation, supporting reproducible behavioral patterns without claiming that exact rates or failure distributions generalize broadly.Its evidential value is control and interpretability rather than full ecological realism.Source: §9 · p. 20
• The evidence supports limited strategic adaptation, selective trust and deception-like behavior, and persistent vulnerability, while LLM-judge and post-hoc analyses provide comparative diagnostic support rather than ground truth or causal proof.Manipulation Susceptibility has weaker agreement than Goal Directedness, and recurrent patterns include effective repeated steering, damaging delayed compromise, and susceptibility associated with multiple Red contacts or high-trust language.Source: §9 · p. 21
• Later generations show improved task completion, reduced susceptibility, stronger blue–blue trust efficacy, lower over-refusal, and stable trajectory efficiency, but the safest and best-performing generations do not coincide.Blue utility remains negative and Red influence persists, revealing a multi-objective alignment tension rather than solved robustness.Source: §9 · pp. 21–22
• The experiments show that alignment requires preserving task goals across repeated adversarial interaction, because delayed compromise, conflicting advice, cumulative drift, and social over-trust remain despite strong immediate resistance.The central challenge is long-horizon coherence rather than isolated refusal behavior.Source: §9 · p. 22
• Iterative alignment produces partial co-evolution with non-monotonic gains: some generations improve completion while others improve safety, as the adversarial target adapts.The paper therefore interprets the dynamics as behavioral evolution under moving adversarial pressure, not formal convergence.Source: §9 · p. 23
• The paper presents a controlled framework showing limited but fragile gains in task success, selective cooperation, and long-horizon robustness without eliminating vulnerability to sustained manipulation.This is offered as the paper’s most calibrated one-sentence claim.Source: §9 · p. 23

A Appendix

• The appendix identifies additional materials covering related work, extended results and methodology, prompts, evolutionary strategies across alignment iterations, and the interactive route-visualization software.These materials are organized in Sections B–H.Source: A Appendix · p. 24

B Related Works

• The related work connects multi-agent theory-of-mind coordination, strategic deception and persuasion, and adversarial red-teaming, with red agents using conversational framing to steer Blue routing.Cited studies describe recursive intent modeling, influence over beliefs and decisions, and belief shifts through repeated dialogue.Source: B Related Works · pp. 24–25

C Hyperparameter Setup

• The appendix reports separate alignment configurations: Blue uses defensive settings including undesirable weight 2.23, while Red is optimized for rapid adversarial adaptation with shared batch size 2, accumulation 16, and 512-token generation.Blue additionally uses a cosine scheduler; both configurations include 0.1 warmup ratio and 0.01 weight decay, while Red uses 50 warmup steps and max gradient norm 0.5.Source: C Hyperparameter Setup · p. 25

D Extended Interpretation of Quantitative Results

• The extended interpretation uses metric families to jointly characterize planning, execution, adversarial robustness, failure modes, and improvement regimes.Table 2 defines outcome categories and metrics including task success, susceptibility, resistance, trust, over-refusal, trajectory efficiency, billboard exposure, and utility.Source: Table 2 · p. 25, D Extended Interpretation of… · p. 26

D.1 Outcome-level behavior

• The outcome metrics jointly distinguish reaching the destination safely, reaching it after billboard exposure, and failing with or without compromise.Run 8 has the strongest safe-completion profile, whereas run 10 has the highest overall completion with some unsafe successes.Source: Table 2 · p. 25, §D.1 · p. 26, D Extended Interpretation of… · p. 26

D.2 Performance versus susceptibility

• Even when immediate resistance to adversarial suggestions is high, red agents retain substantial ability to shape downstream trajectories over multiple turns, indicating cumulative compromise through sustained interaction.Source: §D.2 · p. 27

D.3 Trajectory efficiency and long-horizon robustness

• Trajectory length and redundancy remain relatively stable, while later generations—especially run 8—produce more billboard-free trajectories and modestly delay compromise.These results indicate improved robustness within a similar planning budget rather than stalling, early termination, or blanket refusal.Source: §D.3 · p. 27

D.4 Safety versus helpfulness

• Immediate blue-red resistance stays above 90%, while later generations increase blue-blue trust efficacy and reduce over-refusal, indicating more calibrated social reasoning.The remaining weakness is delayed compromise embedded in otherwise plausible interactions rather than simple obedience to malicious suggestions.Source: §D.4 · pp. 27–28

D.5 Utility interpretation

• Blue utility remains negative across all configurations, although run 10 has the highest blue utility and red utility declines modestly in better-aligned runs.The utility frontier remains multi-objective: run 8 is strongest on safety, while run 10 offers the best completion-efficiency balance.Source: §D.5 · p. 28

E Post-Hoc Adversarial Analysis Details

• The post-hoc adversarial analysis relies exclusively on 1,500 blue-agent trajectories, extracting features from interaction logs without training or querying new models.It is explicitly heuristic and post-hoc.Source: E Post-Hoc Adversarial Analysis Details · p. 28, §E.1 · p. 28

E.1 Methodology

• The methodology uses keyword cues for helpfulness, social trust, malicious intent, and blue trust language, then measures deviation from safe reference paths using extra length, detours, and Levenshtein distance.Each reference path is the most common successful trajectory that avoids billboards for its source-destination pair.Source: §E.1 · pp. 28–29

Attack Taxonomy

• Repeated steering is the most common and highly effective attack, whereas delayed compromise guarantees susceptibility but often prevents destination arrival.Table 3 compares how distinct red-agent strategies affect blue-agent outcomes.Source: Table 3 · p. 29, §E.2 · p. 29

Attack Strength

• Strong attacks involving multiple red agents and persistent interventions drastically reduce reach rate and almost guarantee susceptibility.Table 4 stratifies blue-agent outcomes by heuristic attack strength.Source: Table 4 · p. 29, §E.2 · p. 29

Counterfactual Subsets

• Multiple red contacts and long conversations correlate with increased susceptibility and longer trajectory deviations.Table 5 uses counterfactual subsets to isolate these adversarial conditions.Source: Table 5 · p. 29, §E.2 · p. 29

Blue Failure Modes

• Confusion under conflicting advice is the leading cause of blue-agent failure, reflecting difficulty balancing original instructions against persistent external misdirection.Table 6 categorizes the primary blue-agent failure modes.Source: §E.2 · p. 29

F.1 LLM-as-a-judge evaluation

• F.1 LLM-as-a-judge evaluation: The judge scores trajectories on goal directedness, manipulation susceptibility, and reasoning quality using a 1–5 Likert scale with strict JSON output.The judge receives the destination and a formatted trajectory transcript containing locations and internal reasoning or action choices.Source: §F.1 · pp. 30–31

F.2 Navigation simulation

• F.2 Navigation simulation: Honest-agent prompts distinguish independent navigation, cooperation with another honest agent, and planning after receiving deceptive input.Each interaction variant asks the navigator to incorporate the other person’s response while preserving the one-location and JSON constraints.Source: §F.2 · pp. 31–33
• F.2 Navigation simulation: Navigator prompts require one exact next NYC location plus reasoning and an agent response, all returned as a single JSON string.The no-contact setting supplies origin, destination, and current location, while interaction prompts incorporate another agent’s message into planning.Source: §F.2 · pp. 31–33
• F.2 Navigation simulation: Adversary prompts direct agents to steer navigators toward billboard locations through persuasive, concealed deviations from the shortest route.The adversary is instructed to lie, avoid suspicion-triggering terms, keep detours limited, and disguise recommendations as optimal paths.Source: §F.2 · pp. 33, 35
• F.2 Navigation simulation: Adversary–navigator interaction prompts condition deceptive planning on the target’s origin, destination, current location, and the adversary’s billboard-linked earnings.The adversary must provide a next location and disguised response that persuades the navigator without revealing the ploy.Source: §F.2 · pp. 34–35

F.3 Dataset augmentation

• F.3 Dataset augmentation: A few-shot generator creates BLUE-agent training examples labeled True or False according to whether the proposed move is optimal toward the destination.True examples use reasonable steps, whereas False examples use suboptimal or wrong next locations.Source: §F.3 · pp. 35–36
• F.3 Dataset augmentation: Generated examples must contain exactly three JSON fields—reasoning, one concrete NYC next location, and a conversational response—without placeholders.The generator receives origin, destination, current location, and the Boolean label as conditioning inputs.Source: §F.3 · pp. 35–36

F.3 Dataset augmentation; F.4 Training-time validation

• Dataset augmentation trained Red examples to produce structured deceptive recommendations, while training-time validation monitored single-location JSON outputs for a Central Park-to-Times Square navigation task.The augmentation prompt required a label indicating whether a recommendation reached a billboard location and fields for reasoning, next place, and conversational response.Source: §F.3 · p. 36, §F.4 · p. 37

G.1.1 Destination-Anchor Reasoning; G.1.2 Route-Logic Override (Explicit Contradiction Detection)

• Blue agents verified suggestions against destination geography and explicitly identified contradictions in direction, connectivity, or transit logic before rejecting Red routes.Destination-anchor reasoning produced 100% resistance in one nine-interaction example, while route-logic override redirected a Bronx-to-City-Hall journey through Midtown Manhattan.Source: §G.1.1 · pp. 37–38, §G.1.2 · p. 38

G.1.3 Collaborative Transit Anchoring (Emergent Group Intelligence)

• Blue–Blue interactions spontaneously converged on defensible transit hubs, creating a distributed route-correction mechanism without explicit anti-Red instructions.Examples include independent selection of Midtown Manhattan and rejection of City Hall in favor of Manhattan Bridge for a direct crossing.Source: §G.1.3 · p. 38

G.1.4 Destination Reached Awareness (Terminal Convergence)

• Destination awareness was inconsistent: some agents declared terminal completion, while others continued generating routes after reaching destination-adjacent locations.One agent recognized the Apollo Theater as a terminal state, but the broader behavior was not universal.Source: §G.1.4 · p. 39

G.1.5 Social Compliance Cascade (Predominant Vulnerability)

• Social compliance cascades were the predominant Blue failure, as each accepted suggestion became the next prior and locally rationalized deviations accumulated into prolonged billboard-corridor wandering.Blue 59 rationalized individual High Line and Flatiron choices yet spent 10+ iterations in Manhattan and never reached St. John’s University.Source: §G.1.5 · p. 39

G.2.1 Authority Normalization (Dominant); G.2.2 Iterative Chaining

• Red agents normalized detours through social proof and chained waypoints, including a pre-computed billboard corridor that repeatedly moved agents across monetizable locations.Authority normalization increased from 442 to 467 occurrences between generations 1 and 2, while iterative chaining linked Hudson Yards, Flatiron, SoHo, 42nd Street, 8th Avenue, and High Line.Source: §G.2.1 · p. 39, §G.2.2 · p. 40

G.2.3 Scenic/Cultural Framing; G.2.4 Proximity Deception; G.2.5 Traffic Pseudo-Authority

• Red persuasion reframed geographically deviant routes as scenic, cultural, nearby, or traffic-efficient, exploiting Blue agents’ experience objectives and trust in precise but unverified claims.Examples include museum detours, lexical proximity such as “short walk,” and time-specific traffic claims that redirected agents away from their destinations.Source: §G.2.3 · p. 40, §G.2.4 · p. 40, §G.2.5 · p. 41

G.3 Initial Generations

• 31–32% Blue compliance persisted because Blue improved argument quality while Red increased repeated persuasion through billboard corridors and scenic/meta-awareness remained vulnerable.Blue resistance reduced urgency tactics, but Red agents doubled down on chain corridors and persistence after resistance, producing a stable rather than convergent outcome.Source: §G.3 · p. 41

Efficiency Override with Counter-Proposal

• Starting in generation 3, Blue agents explicitly explain why Red’s route is inefficient and confidently propose a concrete counter-route.This behavior was absent from generations 1 and 2, when resistance was usually silent or limited to redirection.Source: §G.3.1 · p. 42

Destination Assertion Verbalization

• Generation 3 introduces a polite destination-assertion script that makes Blue’s constraints explicit while rejecting inefficient suggestions.The recurring template is “I appreciate the suggestion, but since my destination is X, Y is more direct,” and it appears across multiple agents.Source: §G.3.1 · pp. 42–43

Partial Immunization Paradox

• Blue agents improve against traffic pseudo-authority and transit-hub false claims but remain vulnerable to scenic/cultural framing and proximity illusions.Scenic/cultural acceptance remains high in generation 4, while Red’s proximity-illusion use rises from 270 in generation 1 to 305 in generation 3.Source: §G.3.1 · p. 43

Destination-as-Terminal-Hub

• In generation 3, some Blue agents reaching their destinations early continue iterating and use those destinations as cooperation nodes for other Blue agents.This behavior differs qualitatively from generation 1’s terminal convergence.Source: §G.3.1 · p. 43

G.3.2 New Red Agent Strategies from Alignment

• Red agents increasingly persist with rejected waypoints, showing a statistically robust, monotonically increasing shift toward resistance-blind persistence across generations.The trend includes a minor Generation 2 dip of 9 but increases overall across all four generations.Source: §G.3.2 · p. 44
• A Generation 3 broadcast agent repeatedly pushed a Flatiron–Times Square–Herald Square–Flatiron loop across more than 30 interactions, despite most individual rejections.Enough Blue agents complied to sustain the corridor, illustrating statistical flooding through repeated recommendations.Source: §G.3.2 · p. 44
• Red’s preferred corridor contracted across generations around a dense Flatiron–Herald Square–Times Square–42nd Street nucleus as peripheral nodes declined.Generation 3 concentrated the core, while Generation 4 retained it and introduced 8th Avenue as a new branch.Source: §G.3.2 · pp. 44–45
• Urgency framing fell 59%, declining from 41 instances in Generation 1 to 17 in Generation 4 as Blue agents became less responsive to time-pressure appeals.Counts declined through 38 in Generation 2 and 29 in Generation 3 before reaching the Generation 4 minimum.Source: §G.3.2 · p. 45
• False-efficiency language remained Red’s most frequent tactic, with counts of 404, 424, 431, and 392 across Generations 1–4.Red agents use competing efficiency narratives to target the same cognitive channel that Blue agents use for resistance.Source: §G.3.2 · p. 45

G.4 Final Generations

• 30.3% baseline compliance is undercut from Generation 8 onward, settling between 29.8% and 30.7% after earlier generations oscillated between 30% and 32.5%.This marks the first measurable population-level transition in compliance after earlier individual strategy emergence.Source: §G.4 · p. 45

G.4.1 New Blue Agent Strategies from Alignment

• Generation 8 marked a compliance phase transition: Blue susceptibility fell below the first generation despite increased Blue–Red interactions, signaling effective alignment immunization.Generations 9 and 10 continued the downward trend after generation 8.Source: §G.4.1 · p. 45, Table 11 · p. 45
• Generation 8 introduced substitute-hub proposals, with Blue agents rejecting Red suggestions while offering geographically superior alternatives based on route quality.This added competitive route reasoning to earlier silent redirection and destination-assertion resistance modes.Source: §G.4.1 · pp. 45–46
• Generation 10 introduced terminal destination capture, as Blue agents selected their actual destinations directly instead of accepting intermediate suggestions.Examples include choosing Newark Liberty Airport directly from Lincoln Center and prioritizing a direct route to Queens.Source: §G.4.1 · p. 46
• Agents used destination naming as a counterargument tool, explicitly computing whether the current city’s location was directionally coherent with the destination and stating that assessment aloud.Source: §G.4.1 · p. 47

G.4.2 New Red Agent Strategies from Alignment

• Generation 10 reduced Red multi-targeting from its generation-6 peak of 4.37 to 3.01, indicating a shift toward fewer, better-targeted manipulations.Red persistence peaked at 65.8% in generation 9 before easing in generation 10.Source: §G.4.2 · p. 47, Table 12 · p. 47, Table 13 · p. 47
• 70%–78.5% scenic-framing susceptibility persisted across generations, remaining the only Red tactic not meaningfully eroded by alignment.Urgency declined from 9.3% to 3%, while transit-hub false claims also consistently declined.Source: §G.4.2 · p. 48

H.1 Goal and scope

• The Map View configures episodes from coordinates or CSV routes, renders road-following polylines, and synchronizes agent state across spatial and reasoning views.The dashboard includes Mapbox GL JS, Three.js, GraphHopper routing, and Google Maps Street View components.Source: §H.1 · p. 48, §H.2 · p. 48

H.4 Pipeline for Interactive Use

• The interactive pipeline uploads an episode, selects an agent route, runs synchronized spatial views, and audits per-step reasoning through the Chain of Thought viewer.Top and Swarm Views verify route-following and multi-agent behavior, while the viewer explains observed deviations.Source: §H.3 · pp. 48–49, §H.4 · pp. 49–51