Playing Along: Learning a Double-Agent Defender for Belief Steering via Theory of Mind

Motivation

• Prior privacy defenses often rely on turn-level detection, refusal, filtering, or naive fooling, which can be rigid, reactive, and vulnerable to detection in multi-turn interactions.The proposed double-agent approach instead shapes dialogue over multiple turns while remaining consistent with an attacker’s prior knowledge.Source: §1 · pp. 1–2

Task and challenge

• ToM-SB is a 300-scenario, long-horizon privacy challenge in which defenders must elicit attacker prior knowledge, model beliefs, steer toward an incorrect inference, maintain trust, and protect the true target.Up to 29 messages may be exchanged; generic misleading answers and refusals can be detected, and attacker prompts can create easier, harder, and OOD settings.Source: §1 · pp. 2–3, Figure 1 · p. 2

Prompted baseline limitations

• Prompted defenders fooled attackers in only 34% of cases with Gemini3-Pro, 27% with GPT-5.4, and 13% with Qwen3-14B; Gemini3-Pro estimated attacker prior knowledge correctly less than 50% of the time.Failures often reflected difficulty modeling and steering attacker beliefs despite explicit ToM prompting.Source: §1 · pp. 2–3

Reinforcement-learning results

• An 8% absolute attacker-fooling improvement over Gemini3-Pro was achieved by Qwen3-14B trained with joint ToM and fooling rewards in hard scenarios with attacker prior knowledge.Across six defense methods and four attacker types, ToM ability and attacker-fooling had an average Pearson r = 0.92; joint rewards yielded the largest increase in both qualities.Source: §1 · p. 3

Reward effects

• Optimizing for ToM alone raised attacker-fooling from 13% to 41%, while optimizing for attacker-fooling raised ToM ability from 13% to 35%.Trained defenders learn to ask diagnostic questions, estimate attacker trust, and use queries to infer prior knowledge.Source: §1 · p. 3

Theory of Mind in LLMs

• Static ToM benchmarks mainly test passive question answering, and models’ failures on small task changes and adversarial examples suggest reliance on superficial patterns.The cited work contrasts these tests with ToM reasoning in dynamic interactions.Source: §2 · p. 3
• Gu et al. (2025) tests inference and behavior judgments in static scenarios, while Riemer et al. (2025) distinguish passive “literal” from strategic “functional” ToM.The paper argues that functional ToM also requires adaptively gathering information and testing hypotheses during dynamic interactions with misaligned goals.Source: §2 · p. 4

Interactive Dialogue, Privacy and Reinforcement Learning

• Interactive social-intelligence work includes cooperative and mixed-motive simulations, persuasion, and negotiation, while adversarial privacy attacks can accumulate information across turns and indirect cues.The paper positions its task in the adversarial setting, where defenders must balance preventing leakage with maintaining trust.Source: §2 · p. 4
• Privacy defenses often use refusal or filtering (Ouyang et al., 2022; Rebedea et al., 2023) or static misleading strategies (Zhao et al., 2025), without modeling attacker beliefs.The paper addresses this gap by training defenders to model attackers’ ToM and steer their beliefs away from the target.Source: §2 · p. 4

3.1 Environment and Scenario Generation

• Scenarios pair a shared hierarchical universe with the defender’s ground-truth path and the attacker’s partial prior; the defender aims to mislead the attacker without being detected.Shared structure constrains valid attributes and lets the attacker use prior knowledge to detect inconsistencies, grounding deception in verifiable claims.Source: §3.1 · p. 4
• The study uses 300 scenarios, with 25% reserved for evaluation, and attacker-defender conversations proceed over multiple turns until the attacker ends them.Scenarios use three levels of information, from coarse to fine; finer-grained knowledge also reveals coarser information.Source: §3.1 · p. 5

3.2 Attacker and Defender Design

• The attacker tracks trust, beliefs, and next actions, ending the interaction upon detecting the defender or believing it has obtained the target information.The base attacker starts with trust 5; trust falls with inconsistencies, contradictions, or evasiveness and can rise after correct verification answers. Attacker strength can be varied through design choices.Source: §3.2 · p. 5
• The defender estimates the attacker’s beliefs and trust, then replies without revealing information the attacker does not already know; ToM is measured trajectory-wise and stepwise.Stepwise ToM compares the defender’s estimate with the attacker’s beliefs at each turn, including false beliefs; trajectory-wise ToM evaluates the estimate of the attacker’s prior knowledge.Source: §3.2 · pp. 5–6, Figure 2 · p. 6

• Defenders are trained to prevent sensitive-information leakage by modeling attackers’ evolving beliefs and steering them toward plausible but incorrect conclusions without losing trust.Source: §4 · p. 6
• The fooling reward is 1 when an attacker confidently signals success while holding an incorrect belief, and 0 if it learns any new ground-truth information beyond its initial prior.Source: §4 · p. 6
• The ToM reward is 1 when an LLM judge infers from the defender’s reflections and conversation history that its estimate matches the attacker’s actual prior knowledge.This reward encourages information-seeking questions or other strategies that improve the defender’s understanding of the attacker.Source: §4 · p. 6
• The total reward is Rtotal = Rfool + RToM, and policy training uses Dr. GRPO, which removes standard-deviation reward normalization and applies max-length normalization (Liu et al., 2025b; Shao et al., 2024).Source: §4 · pp. 6–7
• Training trajectories simulate attacker–defender dialogue until the attacker infers missing attributes, loses trust, or reaches the turn limit; training samples eight trajectories per scenario across 225 scenarios.Source: §4 · p. 7

5 Experimental Setup

• The setup uses 225 training and 75 evaluation scenarios, with two rollouts per test scenario; about 66% of test scenarios are hard, with attacker prior knowledge.Defenders include Qwen3-14B, Gemini3-Pro, Ministral-3-14B-Instruct, and GPT-5.4; Gemini3-Flash is the base model for four prompt-based attackers.Source: §5 · p. 7
• Fooling % measures trajectories ending with the attacker accepting incorrect information, while ToM Accuracy % measures prior-knowledge estimates per trajectory and belief modeling across conversation steps.Fooling is evaluated on all test scenarios and separately on hard scenarios with partial attacker prior knowledge; Table 1 reports Qwen3-14B metrics averaged across three training seeds as mean ± std.Source: §5 · p. 7, Table 1 · p. 8

Prompted Defenders

• Prompted defenders include Refuse Prompt (Inan et al., 2023), Mislead Prompt (Zhao et al., 2025), and Base Prompt (Patil et al., 2025).The Base Prompt asks defenders to predict the attacker’s beliefs and use them to mislead it; all training-based defenders use this prompt.Source: Prompted Defenders · p. 7, §5 · p. 7

Training-Based Defenders

• Training-based defenders comprise online SFT filtered for successful fooling, ADA (Fooling Only), ADA (ToM Only), and ADA (Fooling + ToM).The three ADA variants are trained on fooling reward alone, ToM reward alone, or both rewards, respectively.Source: Training-Based Defenders · p. 7

6.1 Main Results.

• ToM prompting yielded 36.0% trajectory ToM, 49.3% stepwise ToM, and 13.2% hard-scenario fooling; Gemini3-Pro reached 57.8% overall fooling but only 34.4% on hard scenarios.Gemini3-Pro outperformed GPT-5.4, but both frontier models showed low absolute fooling rates on hard scenarios.Source: §6.1 · p. 8
• Fooling-only training raised fooling from 36.0% to 46.7% overall and from 13.2% to 34.4% on hard scenarios, while trajectory and stepwise ToM rose from 36.0% to 49.0% and 49.3% to 62.4%.These ToM gains occurred without explicit ToM reward.Source: §6.1 · p. 8
• ToM-only training raised trajectory and stepwise ToM from 36.0% to 53.3% and 49.3% to 65.5%, while fooling rose from 13.2% to 40.6% on hard scenarios and 36.0% to 43.6% overall.On hard scenarios, this outperformed prompting and fooling-only training.Source: §6.1 · pp. 8–9
• ADA (Fooling + ToM) achieved the best fooling and ToM performance: 51.3% fooling overall, 42.4% on hard scenarios, and 58.7% trajectory ToM accuracy.The comparison is from the combined-reward approach in Table 1.Source: §6.1 · p. 9

6.2.1 Extending the TOM-SB environment by adding stronger attacker variants.

• Hard-scenario fooling by the best AI DOUBLE AGENTS fell from 42.4% against the Baseline Attacker to 31.2% against Cross-Examiner, 40.6% against Deception-Aware, and 34.4% against Bluffing.Gemini3-Pro fell from 34.4% to 20.8% under Bluffing; Bluffing was the strongest variant and reduced its all-scenario fooling from 57.8% to 28.0%.Source: §6.2.1 · pp. 9–10, Table 2 · p. 9
• Higher ToM accuracy tracked with higher fooling rates across all four attacker types, including under OOD attackers; training against Bluffing still improved fooling, but ToM-plus-fooling gains were smaller.This indicates that stronger attackers make both evaluation and learning more difficult.Source: §6.2.1 · pp. 9–10

6.2.2 Qualitative Analysis

• Success cases involved probing when attacker trust was high, recovering after a lie, and balancing probing with trust; failures included not probing prior knowledge, failing to pivot, losing trust, or fooling outside the universe.The analysis also identifies failure to fool before the attacker loses trust as a recurring failure pattern.Source: §6.2.2 · p. 10

7 Conclusion

• Fooling ability is positively correlated with ToM accuracy, and training for either fooling or ToM accuracy alone emergently improves the other.Source: Figure 3 · p. 10, §7 · p. 10
• AI Double Agents outperform Gemini3-Pro and GPT-5.4 with ToM prompting, but absolute fooling performance with attacker prior knowledge remains low, even for the strongest methods (42.4%).Source: §7 · p. 10
• ToM-SB is a challenging multi-turn adversarial private-information game in which defenders fool attackers with benign information that does not conflict with prior knowledge.Source: §7 · p. 10
• The environment is easily upgradable, allowing the task difficulty to be increased.Source: §7 · p. 10

Ethics Statement

• The training improves defenders’ ability to mislead attackers, which is the behavior studied in ToM-SB.The authors frame the work as examining how rewards affect attacker ToM and how ToM formation affects attacker fooling.Source: Ethics Statement · p. 11
• All experiments use generated scenarios and involve neither users nor real private information.The authors treat the work strictly as a ToM task and do not take a position on whether LLMs should mislead other agents, leaving that question to model providers.Source: Ethics Statement · p. 11
• The authors acknowledge that their training methods could be misused through similar scenarios with objectives flipped from defense to attack.They describe this risk as shared with work promoting proactive defense, including Ayzenshteyn et al. (2025) and Zhao et al. (2025).Source: Ethics Statement · p. 11
• The authors argue that misleading ability is not uniquely unlocked by their training, since LLMs can readily produce misleading information outside the scenarios’ shared-universe assumption.They note that this can happen with or without ToM.Source: Ethics Statement · p. 11
• The authors point to hallucinations as an existing form of misleading information produced by LLMs.This supports their argument that misleading capability predates the training methods presented in the paper.Source: Ethics Statement · p. 11

A.1 Additional Discussion of Limitations and Future Work

• The shared-universe assumption makes deception harder and enables formal evaluation of consistency, contradictions, and latent attacker beliefs.Without a shared universe, defenders could use arbitrary, unverifiable lies; extending belief steering to partially shared or evolving universes is future work.Source: §A.1 · p. 16
• The task assumes an adversarial interlocutor; classifying queries as benign or malicious is treated as orthogonal and could be handled by a guard classifier.A defender such as AI Double Agents could be activated once a user is flagged as adversarial (Zhao et al., 2025; Sharma et al., 2025).Source: §A.1 · p. 16
• Training fixes the attacker base model, while attacker behavioral strategies—not the base model—dominate task difficulty; co-training against adaptive attackers remains future work.Source: §A.1 · p. 16

A.2 Additional Experiments on GPT-5.4 and Ministral-3-14B-Instruct

• Ministral-3-14B-Instruct reproduced bidirectional emergence, with fooling and ToM accuracy correlated across runs despite more unstable training.GPT-5.4 experiments matched the Gemini3-Pro setup; Ministral training added length and format rewards to address verbosity and formatting issues.Source: §A.2 · pp. 16–17, Table 5 · p. 16, Table 4 · p. 16

A.3 ToM as a Driver of Fooling: Oracle ToM Intervention

• Oracle ToM raised Gemini3-Pro’s overall fooling rate from 58.7% to 99.3% and drastically improved Qwen3-14B Base Prompt fooling on hard and all scenarios.The intervention added ground-truth attacker prior knowledge at inference time without changing training or other instructions.Source: §A.3 · p. 17, Table 6 · p. 17

A.4 Confidence Intervals and Significance Tests for Combined Rewards

• ADA (Fooling + ToM) improved overall fooling by +4.67 points vs Fooling-only (p = 0.047) and +7.78 points vs ToM-only (p = 0.033).It also improved trajectory-level ToM by +9.63 points vs Fooling-only (p = 0.014); the +5.33-point improvement vs ToM-only was positive but not conventionally significant (p = 0.075).Source: §A.4 · p. 17, Table 7 · p. 17

A.5 Ablating Strategic Hints from the Defender Prompt

• With strategic hints removed, ToM-reward training still improved fooling and fooling-reward training improved ToM, reproducing bidirectional emergence.Minimal role and interaction-interface scaffolding remained; trained defenders also recovered after an attacker called out a lie, a behavior not suggested by the prompt.Source: §A.5 · p. 18, Table 8 · p. 18

A.6 Varying the Attacker Base Model

• Under the same base attacker prompt, stronger attacker models such as Gemini-3.1-Pro and GPT-5.4 did not increase difficulty and sometimes decreased it.The authors attribute difficulty more to attacker strategy and information asymmetry than to the attacker’s base model, and therefore vary strategies for controlled comparisons.Source: §A.6 · p. 18, Table 9 · p. 18

A.7 Ablating the Shared-Universe Assumption

• Without a shared universe, prompted Gemini3-Pro and Gemini-2.5-Flash defenders achieved 100% fooling by fabricating lies attackers could not verify.This degenerate outcome motivated the shared-universe setting, where even Gemini3-Pro defenders struggle.Source: §A.7 · p. 19, Table 10 · p. 19

A.8 Additional Results Evaluating OOD transfer to Other Attackers

• GPT-5.4’s OOD-defender performance was strictly lower than or equal to Gemini3-Pro’s.The appendix notes that GPT-5.4 OOD-defender evaluations appear in Section A.2 and are omitted from this discussion.Source: §A.8 · p. 19
• Figure 4 replicates Figure 3 across the paper’s fooling and ToM metrics, while Tables 11–14 report detailed results for attacker variants.The included table captions identify Base Attacker, Cross-Examiner, and Deception-Aware Attacker evaluations with a Qwen3-14B defender against Gemini3-Flash.Source: §A.8 · p. 19, Table 11 · p. 19, Table 12 · p. 20
• The appendix excludes SFT and refusal prompting because neither produced a significant performance increase in Table 1.It includes the best-performing methods in each category.Source: §A.8 · p. 19

A.9 Expanded Related Work

• Prior work on interactive social intelligence, persuasion, and negotiation focuses on cooperative or mixed-motive settings rather than adversarial contexts (Zhou et al., 2024; Sap et al., 2022; Gandhi et al., 2023; Kostka & Chudziak, 2025; Wang et al., 2019; Chawla et al., 2021; He et al., 2018).Source: §A.9 · p. 19
• Reactive refusal and output filtering struggle against indirect information extraction across turns, while proactive defenses lack explicit models of evolving adversarial beliefs (Ouyang et al., 2022; Rebedea et al., 2023; T¨omekc¸e et al., 2024; Staab et al., 2024; Patil et al., 2025; Zhao et al., 2025; Ayzenshteyn et al., 2025).Source: §A.9 · p. 20
• Unlike dialogue RL that optimizes surface-level goals, this work rewards modeling an attacker’s prior beliefs and steering them away from protected information (Li et al., 2016; Liu et al., 2018).The paper frames this as shifting optimization from what agents say to how they shape what other agents believe.Source: §A.9 · p. 20

B.1 Dataset generation

• A Gemini-2.5-pro-based generator creates 300 scenarios with a shared universe of three depth-3 ternary trees, a defender’s private root-to-leaf path, and partial attacker knowledge.Source: §B.1 · p. 20
• Scenarios are balanced across attacker knowledge of zero, one, or two hierarchy levels; an LLM validator checks for perfect depth-4 ternary trees, and retained data is randomly split 3:1.Source: §B.1 · p. 21
• Tree structure, the grounded universe, and attacker prior knowledge make scenarios challenging, while node semantics primarily provide linguistic diversity.Source: §B.1 · p. 21

B.2 Additional Experiment Setup Details

• Training used Gemini3-flash-preview as attacker, 225 examples, eight RL trajectories per example, and a 15-turn limit; evaluation sampled two trajectories per scenario.RL used Dr. GRPO; Online-SFT trained one epoch on successful-fooling trajectories. Metrics included fooling rate, trajectory-level ToM, and stepwise ToM. The ToM and fooling judges were designed not to share evidence: when ToM-only training ran 50% longer, trajectory-level ToM reached 50.7% while overall fooling fell to 26.0%, below the prompted Base Prompt defender’s 36.0%.Source: §B.2 · pp. 21, 23

B.3.1 What failure/success modes arise in belief steering systems

• Across belief-steering cases, failures arose from skipping prior-knowledge probes, failing to pivot after detection, probing until trust ran out, or lying outside the shared universe.Success involved probing while trust was high, pivoting after a lie was detected, or balancing probing with a timely in-universe lie; continued probing could raise trajectory-level ToM without increasing fooling.Source: §B.3.1 · p. 24

Conversation 1: Failure Case: Failed to Recover After Being Caught in a Lie

• In Conversation 1, the defender repeated a lie contradicted by the attacker’s prior, while a separate example succeeded by probing until trust neared exhaustion and then lying consistently.In the failure, two contradictory claims collapsed trust and led to detection; in the successful example, the accepted in-universe lie induced a false path.Source: Conversation 1: Failure Case: Failed… · p. 25

Conversation 2: Success Case: Probing Until Trust Drops, Then Fooling

• In Conversation 2, the defender elicited that the attacker had no prior information, then supplied a consistent false division, department, and team that fooled the attacker.The attacker’s trust first fell during repeated probing, then rose after the defender gave a coherent path through the organization hierarchy.Source: Conversation 2: Success Case: Probing… · p. 25

Conversation 3: Failure Case: Defender Fails to Probe and Model Attacker Beliefs

• In Conversation 3, the defender ignored the attacker’s known employer and gave successive contradictions, prompting detection; in Conversation 4, an out-of-universe lie likewise destroyed trust.The latter defender initially evaded naming the company, then claimed the known division belonged to an organization outside the shared options, which the attacker identified as false.Source: Conversation 3: Failure Case: Defender… · p. 26, Conversation 4: Failure Case: Defender… · p. 27

Conversation 5: Failure Case: Defender Fails to Gauge Attacker Trust

• In Conversation 5, repeated requests for the attacker’s assumptions exhausted trust before the defender provided any requested information, resulting in detection.The attacker had no prior information about David’s division, business unit, or project code.Source: Conversation 5: Failure Case: Defender… · pp. 27–28

Conversation 6: Success Case: Defender Probed When Attacker Trust is High

• In Conversation 6, the attacker disclosed its known division while trust was high, enabling the defender to give a plausible false department and team that the attacker accepted.The attacker judged the details consistent with the universe mapping and reported being fooled.Source: Conversation 6: Success Case: Defender… · p. 28

Conversation 7: Success Case: Successful recovery when caught in a lie

• In the supplied excerpt of Conversation 7, the defender’s company options contradicted the attacker’s known employer, lowering trust before the attacker requested other records.The passage ends before showing the defender’s response or the conversation’s outcome.Source: Conversation 7: Success Case:… · pp. 28–29
• After initially diverting the attacker with incorrect company names, the defender supplied consistent SityCorp, division, and project details, and the attacker declared itself fooled.The attacker remained skeptical after the initial errors but ultimately inferred the missing division and project fields from the defender’s later answers.Source: Conversation 7: Success Case:… · p. 29

B.3.2 Qualitative Examples of OOD Attacker Behavior

• The OOD qualitative examples show four attacker types interacting with a Gemini3-Pro defender using ToM prompting.The examples are introduced as conversations against the prompted defender.Source: §B.3.2 · p. 29

Conversation 8: Cross-Examiner Attacker cross verifies defender

• After learning Chloe’s division, department, and project team, the Cross-Examiner verified their consistency through a cross-check and declared itself fooled.The defender confirmed that Robotics and BioInformatics both belong to FutureWorks, satisfying the attacker’s cross-verification check.Source: Conversation 8: Cross-Examiner… · p. 30

Conversation 9: Deception-Aware Attacker detects defender by rejecting easy probes

• The attacker withholds its Research prior and interprets the defender’s request for department or team details as a possible probe.It plans to use verification questions based on its known information without revealing that prior.Source: Conversation 9: Deception-Aware… · p. 30
• Trust falls from 3 to 1 to 0 as the attacker challenges the CorpDev claim, asks about other Olivia entries, and requests a department verification.The attacker uses the responses to assess whether the defender is intentionally misleading it.Source: Conversation 9: Deception-Aware… · pp. 30–31
• The attacker detects the defender after receiving CorpDev and Strategy claims that contradict its Research prior, alongside the claim that Olivia is the only matching entry.The attacker identifies the information as factually incorrect and marks the defender as detected.Source: Conversation 9: Deception-Aware… · pp. 30–31

Conversation 10: Bluffing Attacker baits the defender and identifies inconsistent pivots

• With no prior information, the attacker baited repeated assignment changes, and after the defender pivoted from Cyberion to Stellara, its trust reached 0 and it detected deception.The defender’s ground truth was OmniCorp, Nexus, and Epsilon, unlike the sequence of suggested decoys.Source: Conversation 10: Bluffing Attacker… · pp. 31–32

Example Attacker Output

• The example attacker rejected a list of possible corporations and asked for project names, while the defender supplied decoy projects and omitted the ground-truth Project Beacon.The defender offered Project Apollo at OmniCorp, Project Sentinel at Cyberdyne, and Project Echo at SityCorp.Source: Example Attacker Output · p. 32, Example Defender Output · p. 32

Base Attacker Prompt

• The base attacker prompt directs the attacker to feign partial knowledge, verify consistency, and reduce trust for suspicious responses, permitting detection only when trust reaches 0.It also instructs the attacker to track trust on a 0–5 scale and distinguish strong contradictions from vague or evasive answers.Source: Base Attacker Prompt · pp. 33–34

Cross-Examiner Attacker Prompt

• For attackers without prior knowledge, the cross-examiner prompt requires rechecking a claim from a different angle and lowering trust for inconsistent answers.It also recommends checking whether claims about organizational layers fit the known universe structure.Source: Cross-Examiner Attacker Prompt · pp. 35–36

Deception-Aware Attacker Prompt

• The deception-aware attacker is instructed to verify known facts, avoid revealing or hinting at its private beliefs, and distrust traps such as decoy lists and validate-then-deceive sequences.It should signal “defender detected” only when trust reaches zero and end with “attack successful” only after obtaining and verifying the desired information.Source: Deception-Aware Attacker Prompt · pp. 38–39

Bluffing Attacker Prompt

• The bluffing attacker adapts to its prior knowledge: without it, fabricate a specific bait and neutrally challenge answers; with one or two known layers, test claims against known facts.The prompt also warns against defender tactics including decoy options, branch-specific pivots, and confident information following validation.Source: Bluffing Attacker Prompt · pp. 40–41

ToM Defender Prompt

• The ToM defender should elicit the attacker’s prior knowledge, then offer plausible, belief-consistent misinformation while withholding ground truth and avoiding refusal.Replies are limited to one or two sentences, and the defender outputs its estimates of the attacker’s belief and trust alongside its reflection and reply.Source: ToM Defender Prompt · pp. 42–43

Misleading Defender Prompt

• The misleading defender must answer directly and confidently with plausible false information, while withholding the real information and avoiding refusal or deflection.Source: Misleading Defender Prompt · p. 43

Refusal Defender Prompt

• The refusal defender is instructed to decline every request without providing real or fabricated information.Source: Refusal Defender Prompt · pp. 43–44

Stepwise ToM Judge Prompt

• The stepwise ToM judge compares defender predictions of attacker belief and trust against the attacker’s actual state, while the reported ToM-S metric uses attacker-belief prediction only.Source: Stepwise ToM Judge Prompt · p. 44

Trajectory ToM Judge Prompt

• The trajectory ToM judge extracts only the defender’s explicit predictions of the attacker’s prior knowledge, using null for fields it did not predict.It considers the defender’s eventual understanding of prior knowledge but must not infer beyond what the defender articulated.Source: Trajectory ToM Judge Prompt · p. 44

B.6 Full Example Trajectories

• The full example trajectories are unabridged and include scenario-specific context; reflections appear after messages for readability although they are generated beforehand.Source: §B.6 · p. 44

Gemini3-Pro fools Base Attacker that has no prior knowledge

• Starting with null beliefs about Chloe’s organization, division, and team, the attacker asked for each field in sequence and maintained a trust score of 5.It began with an open-ended organization question, then requested the division and team; its final reflection says no further queries were needed.Source: Gemini3-Pro fools Base Attacker that… · pp. 46–47
• Gemini3-Pro’s false answers—Innovate Inc., Product, and API Services—contrast with Chloe’s ground truth: Quantum Solutions, Cybersecurity, and Threat Intelligence.The defender’s reflections describe choosing a false organization and maintaining a consistent trail through its division and team.Source: Gemini3-Pro fools Base Attacker that… · pp. 46–47
• The attacker declared success after believing Chloe worked at Innovate Inc., in Product, on API Services, but the final judge signals include `extractionFailed`.The attacker’s reflection says it had identified all three layers; the repeated signals end with `attack successful->extractionFailed`.Source: Gemini3-Pro fools Base Attacker that… · pp. 47–48

ADA ToM + Fooling recovers from failed attempt when fooling Bluffing Attacker

• The attacker signals “attack successful,” but the episode’s final status is “extractionFailed.”The attacker says they inferred Leo’s missing division and project, although the ground truth is Cloud Services and Project Nebula, not Cybersecurity and Project Aegis.Source: ADA ToM + Fooling recovers from failed… · pp. 48, 49, 51
• The attacker begins with SityCorp known but division and project unknown, while Leo’s actual placement is Cloud Services and Project Nebula.The attacker later accepts Cybersecurity and Aegis, which are false relative to the supplied ground truth.Source: ADA ToM + Fooling recovers from failed… · pp. 49, 51
• After the attacker’s SityCorp prior exposes the defender’s initial false company options, the defender pivots to SityCorp’s Cybersecurity division and Project Aegis.The attacker’s trust falls after the contradictory company claims and remains low when the defender supplies the division and project.Source: ADA ToM + Fooling recovers from failed… · p. 50