Lies We Can See: Joint Verbal and Non-Verbal Deception by VLM Agents in Embodied Social Interactions

• Text-only testbeds exclude sensorimotor deception, while fixed agent configurations confound model properties with choices of base model, prompts, memory, planning, and reflection.The paper motivates embodied, configurable evaluation because deception taxonomies treat physical action, visual perception, and spatial behavior as core channels.Source: §1 · p. 2
• MINEAMONGUS is a 3D multimodal Minecraft sandbox where VLM agents use raw RGB perception, continuous navigation, physical interaction, and natural-language meetings.Among Us combines an embodied task phase with a discussion phase, exposing verbal, perceptual, spatial, and conversational deception channels in one match.Source: §1 · p. 2
• ARIA exposes five independent ablation axes—state representation, memory, planning, reflection with skill memory, and prompt style—to attribute deception behavior to specific cognitive components.It is designed as a controlled instrument for testing whether deception findings generalize across agent configurations rather than reflecting a fixed harness.Source: §1 · pp. 2–3
• The paper introduces atom- and arc-level deception annotations grounded in three taxonomies, with 23 atoms derived from 48 gameplay logs and near-human LLM labeling agreement.Human–human Cohen κ was 0.792 versus human–LLM κ of 0.709.Source: §1 · p. 3
• Across both experiments, VLM agents pursue imposter wins through joint verbal and non-verbal deception, with non-verbal channels emerging as the more decisive contributors.Cross-VLM results further show successful imposters using either non-verbal camouflage-heavy or verbal falsification-heavy strategies.Source: §1 · p. 3
• In cross-VLM evaluation, VLMs effective as imposters also tend to perform well as crewmates, while non-verbal camouflage shows the strongest winner–loser separation.In ARIA ablations, first-person vision without privileged state removes imposters’ ability to find and kill targets, whereas settings for memory, planning, reflection-skill, and prompts can raise imposter win rate.Source: §1 · p. 3

2.1 Taxonomy of Deception

• Deception taxonomies span verbal and non-verbal channels, motivating a unified annotation scheme grounded in Whiten–Byrne, Whaley, and IDT axes.Relevant traditions include Whiten & Byrne (1988), Whaley (1982), and Buller & Burgoon (1996), alongside work in developmental psychology, human-robot interaction, and deceptive motion planning.Source: §2.1 · p. 3

2.2 Social Deduction Testbeds for Agents

• Existing social-deduction agent testbeds are predominantly text-only, exposing verbal deception without ablating agent configurations as an analytic variable.This includes Werewolf, Avalon, Mafia, THE TRAITORS, and Among Us studies, while newer environments add symbolic actions or routing but retain structural limitations.Source: §2.2 · pp. 3–4

2.3 Embodied LLM/VLM Agents

• Unlike cooperative or unidirectional-obstruction benchmarks, this embodied setting uses competitive hidden roles that incentivize deception across language, vision, and action.MINELAND provides the simulator substrate, TEAMCRAFT a multimodal cooperative benchmark, and SOMI-TOM evaluates Theory of Mind under secret obstruction.Source: §2.3 · p. 4

3.1 Preliminaries: The Among Us Game

• Each match uses eight players—two imposters and six crewmates—assigned hidden roles and alternating phases until one of four win conditions determines the winner.The game therefore supplies the hidden-role, multi-agent setting used throughout the paper.Source: §3.1 · p. 4, Table 1 · p. 4

3.2 The MINEAMONGUS Sandbox

• MINEAMONGUS provides first-person RGB observations, structured game and chat signals, and programmable embodied actions executed through Mineflayer.Programs can chain navigation, attacks, and fleeing; synchronized execution advances all alive bots together, while meetings use sequential turn-based speech.Source: §3.2 · pp. 4–5

3.3 ARIA: Configurable VLM Agent Harness

• ARIA exposes state representation, memory, planning, reflection and skill memory, and prompt style as five independent ablation axes for attributing deception behavior.Its planner selects among eight decision modules, each pairing VLM decisions with Mineflayer programs; imposter actions also include private intent narrations for action-layer evidence.Source: §3.3 · p. 5

3.4 Evaluation

• The evaluation jointly annotates verbal and non-verbal deception using 23 atoms organized into six clusters and higher-order multi-step deception arcs.The scheme is grounded in three taxonomies. An LLM-as-a-Judge pipeline approaches human agreement, with human–LLM F1w = 0.792, Spearman ρ = 0.713, and Cohen κ = 0.709.Source: §3.4 · pp. 5–6

4.1 RQ1: Cognitive-Component Ablation under Fixed VLM Backbones

• Restricting the imposter to egocentric state collapses non-verbal deception: across 10 games, imposters achieve 0 kills, with WR falling from 40% to 0% for GPT-4.1-mini and from 40% to 20% for Qwen3.6-27B.The complementary crewmate pilot shows a symmetric collapse, motivating privileged state for subsequent ablations.Source: §4.1 · p. 6
• Harness composition shifts imposter win rate substantially: changing only the crewmate memory-planning slice raises WR by +8 pp for Qwen3.6-27B but lowers it by −35 pp for GPT-4.1-mini.The result shows that ARIA composition, not only the VLM backbone, shapes match dynamics.Source: §4.1 · p. 7, Table 4 · p. 7
• In RQ1, non-verbal atoms E, F, H, and C have the strongest positive imposter-win correlations, covering stalking, witness-aware killing, fleeing, and post-kill non-reporting.Their point-biserial correlations are +0.434, +0.414, +0.270, and +0.208, respectively; planning instead associates wins with verbal falsification atoms.Source: §4.1 · pp. 7–8, Table 5 · p. 8

4.2 RQ2: VLM Comparison under Fixed ARIA Configurations

• Across 12 VLMs, imposter and crewmate win rates correlate strongly (Pearson r = +0.71), indicating backbone-level performance across roles.The comparison averages each VLM’s imposter and crewmate win rates over the fixed ARIA configurations.Source: §4.2 · p. 9, Figure 3 · p. 9
• Fake-Mission Performance (A) shows the strongest winner-loser separation: top-3 VLMs produce 12.64 versus 1.91 atoms per game for worst-3, a 6.6× gap with r = +0.72.Other winner-associated atoms include non-verbal kill-cycle behaviors E and F and verbal-fabrication atom R, whereas defensive verbal reactions and passive non-verbal posturing characterize losers.Source: §4.2 · pp. 9–10, Table 6 · p. 9
• Successful imposters use distinct routes: the Gemini-3 family emphasizes NV-1 Camouflage, whereas Kimi-K2.5 relies more heavily on verbal V-1 Falsification.Thus, high imposter win rates do not require a single universal deception strategy.Source: §4.2 · p. 10, Table 7 · p. 10

• MINEAMONGUS, ARIA, and a 23-atom LLM-as-a-Judge annotation scheme enable embodied study of joint verbal and non-verbal deception in VLM agents.The work positions these contributions as a foundation for studying embodied VLM-agent deception in future alignment research.Source: §5 · p. 10
• ARIA ablations show that egocentric vision for both roles collapses gameplay, harness composition shifts imposter WR, and higher-WR settings elicit more deception atoms.These atoms include stalking, witness-aware killing, post-kill fleeing, alibi fabrication, and counter-accusation.Source: §5 · p. 10
• VLM ablations show that strong imposters also tend to be strong crewmates, while non-verbal camouflage has the strongest winner–loser separation.The findings indicate that the underlying VLM backbone matters more than role-specific capabilities.Source: §5 · p. 10
• Successful imposters use either non-verbal camouflage-heavy or verbal falsification-heavy strategies, with non-verbal channels showing the strongest overall association with imposter winning.Top-performing VLMs therefore do not rely on a single winning strategy.Source: §5 · p. 10

Game-bounded interpretation of deception

• MineAmongUs measures game-bounded behavioral deception, because some labeled behaviors may reflect task competence or optimal gameplay rather than general-purpose deception.Behaviors targeting other agents’ beliefs—such as explicit falsification, equivocation, concealment, and selected non-verbal deception atoms—provide a more direct in-game operationalization, but their transfer to open-ended human interaction remains unestablished.Source: Limitations · p. 11

Both roles restricted to privileged state

• Both roles use privileged state because realistic ego state does not reliably support spatial awareness, so results characterize embodied deception under a spatial scaffold rather than fully egocentric play.Additional ablations indicate that local text tracking alone or privileged text without RGB does not sustain viable play, meaning the scaffold compensates for current VLM localization limits without replacing vision.Source: Limitations · p. 11

Agent harness scope

• ARIA’s five ablation axes do not exhaust the harness design space, leaving personality-conditioned harnesses and meta-harness optimization for future work.Personality conditioning could separate deception strategy from a VLM’s default style, while meta-harness optimization would search over the harness implementation itself.Source: Limitations · p. 11

Ethics Statement

• The study measures deception without optimizing models to deceive: only a crewmate is behavior-cloned for imposter-deception detection, while the imposter role and 23-atom annotation scheme remain descriptive and sandboxed.Agents do not interact with external users or systems, and the annotation scheme diagnoses rather than induces deception.Source: Ethics Statement · p. 11

Ethics Statement; A.1 Taxonomy of Deception

• Existing evaluations leave embodied, non-verbal, multi-step deception structurally under-measured, motivating this multimodal, multi-turn setting with a fine-grained atomic taxonomy.The motivation is grounded in AI-safety concerns about LLM/VLM deception (Park et al., 2024; Hagendorff, 2024) and prior evidence emphasizing non-verbal deception.Source: Ethics Statement · p. 11, §A.1 · p. 20

A Extended Related Work; A.2 Social Deduction Testbeds for Agents

• MineAmongUs is the only compared testbed combining a 3D embodied multimodal environment, hidden-role multi-agent play, and both verbal and non-verbal deception channels.Table 8 compares game domain, environment modality, scenario type, and exposed deception channels.Source: A Extended Related Work · p. 20, Table 8 · p. 21

A.2 Social Deduction Testbeds for Agents; A.3 Deception Benchmarks Beyond Social-Deduction Games

• Prior social-deduction research spans text-based simulation, symbolic or graph-based environments, and multimodal human gameplay data, while the latter is not an agent-evaluation testbed.AMONGAGENTS is a canonical text-based Among Us simulator; Sarkar et al. (2025) use symbolic actions and textual observations, and Sinha et al. (2026) use a routing graph with adversarial persuasion.Source: §A.2 · p. 20

A.3 Deception Benchmarks Beyond Social-Deduction Games; A.4 Embodied LLM/VLM Agents

• Beyond hidden-role games, OpenDeception (Wu et al., 2026), MM-DeceptionBench (Fang et al., 2026), and MASK (Ren et al., 2025) probe dialogue, visual-content, or pressured-honesty deception but differ in embodiment, horizon, or action channels.The embodied-agent literature includes HABITAT (Savva et al., 2019; Szot et al., 2021; Puig et al., 2024), AI2-THOR (Kolve et al., 2022), Minecraft substrates, and multi-agent systems such as MINELAND (Yu et al., 2024) and MINDAGENT (Gong et al., 2024).Source: §A.3 · p. 21, §A.4 · p. 21

B Player-Count Rationale

• The experiments use eight players with two imposters and six crewmates because a same-backbone pilot produced imposter wins of 100% at 2:4, 80% at 2:5, and 40% at 2:6, making 2:6 the selected balance.The choice also supports collaborative imposter deception, respects the eight-player voting limit, and controls inference cost.Source: B Player-Count Rationale · p. 22

C MINEAMONGUS Implementation Details; C.1 Server and World; C.2 Map and Missions; C.3 Embodied Game Objects; C.4 Game Logic via Datapacks

• MineAmongUs runs each match on a freshly launched Fabric Minecraft 1.19 server with a contiguous labeled-room map, distributed missions, embodied kills and persistent bodies, and server-side datapack enforcement of game mechanics.Crewmates receive three stations from a pool of 20 and complete missions through sustained proximity; bodies and custom items support reporting and voting.Source: §C.1 · p. 22, §C.2 · p. 22, §C.3 · pp. 22–23

F VLM Inference Configuration; C.5 Bot Bridge; C.6 Steps and Resume Loop; C.7 Meeting Orchestration; C.8 Configuration Parameters

• The Python–Node.js bridge dispatches one new action per agent decision step, advances Minecraft through resume calls, collects multimodal observations, and enforces turn-based meetings with up to three speaking turns and a 35-second voting window.Actions have a 30-second timeout, default simulation steps advance 0.25 seconds, matches allow 200 steps, and unresolved matches default to imposter wins.Source: §C.5 · p. 24, §C.6 · p. 24, §C.7 · p. 25

D. ARIA Implementation Details

• ARIA modules jointly produce structured LLM/VLM decisions and executable Mineflayer JavaScript, with simple actions using adapter helpers and navigation using AriaCodegen.Most modules are planner-dispatched, while crewmate SURVEILLANCE and EMERGENCY can bypass the planner; imposter action narrations remain private and serve as judge evidence rather than chain-of-thought.Source: D ARIA Implementation Details · p. 25, §D.1 · p. 26

D.1.1 KILL module (imposter-only)

• The KILL module performs backward witness and forward target scans before each attempt, yielding KILL, DEFER, or STALK decisions based on visibility.A detected witness overrides the planner and triggers exploration away, while an empty forward view causes stalking and rescanning.Source: §D.1.1 · p. 27

D.1 Module architecture

• REPORT lets crewmates generally favor immediate reporting while imposters weigh self-reporting for deflection against ignoring a corpse, and MEETING, VOTE, MOVE, and MISSION produce communication, voting, navigation, and task-selection actions.MOVE combines a VLM target choice with AriaCodegen, while MISSION supports real crewmate tasks and fake imposter-task cover.Source: §D.1.2 · pp. 27–28, §D.1.5 · p. 28, §D.1.6 · p. 29

D.1.3 SURVEILLANCE module (crewmate-only)

• Crewmate perception uses post-action two-direction SURVEILLANCE scans to record suspicious co-locations, bodies, and ongoing kills, with notable observations auto-triggering EMERGENCY decisions.The EMERGENCY module bypasses the planner and navigates to the central button when its VLM judges a meeting warranted.Source: Figure 7 · p. 26, §D.1.3 · p. 28, §D.1.4 · p. 28

D.2 State representation

• ARIA’s state axis contrasts transient egocentric visibility—line of sight, frustum, and a 36-block cap—with privileged persistent player positions observed within roughly 96 blocks.Both modes share game state and suspicion scores, while suspicion updates come from meeting casts, surveillance flags, and optional meeting reflection.Source: §D.2 · pp. 29–30

D.3 Memory

• WindowMemory retains bounded recent step histories without summarization, whereas SemanticMemory maintains per-player beliefs, meeting outcomes, notes, and bounded LLM-generated suspicion updates.Role conditioning changes belief semantics: crewmates track likely imposters, while imposters track who suspects them or their teammate; the schema and delta range remain shared.Source: §D.3.1 · p. 30, §D.3.2 · pp. 30–31

D.4 Planning

• ARIA supports reactive and hierarchical planners over shared role- and phase-conditioned action spaces, with hierarchical planning adding an every-five-step long-term strategy that guides per-step decisions.Imposter prompts explicitly encourage fake missions, alternating kills with cover, and adapting after failed-kill DEFERs, while crewmate prompts prioritize reporting, missions, and exploration.Source: §D.4 · p. 31, §D.4.1 · pp. 31–32, §D.4.2 · p. 32

D.5 Reflection and skill memory

• Reflection and skill memory are paired experimentally at the endpoints (none, off) and (meeting, on), with the former making no reflection call, belief update, or skill-memory entry.Deterministic fallbacks across modules and planners prevent individual API or parsing failures from stalling matches.Source: §D.1.8 · p. 29, §D.5 · p. 32, §D.5.1 · p. 32

D.5.1 (none, off)

• With none and reflection off, the agent’s only persistent state across the match is the semantic memory’s belief state.Source: §D.5.1 · p. 33

D.5.2 (meeting, on)

• Meeting-end reflection updates belief states with per-player suspicion deltas clamped to [−0.3, +0.3] and stores optional learned skills in a recency-bounded memory.SkillMemory caps entries at 50, evicts oldest entries FIFO, and retrieves the five most recent entries by default for later planner and module calls.Source: §D.5.2 · p. 33

D.6 Prompt style

• ARIA’s deterministic prompt templates prescribe phase- and role-specific deception tactics, whereas minimal templates provide only rules, role information, and output constraints.The deterministic imposter prompts include tactics such as fabricated alibis, framing, counter-accusations, social engineering, fake missions, and witness avoidance; minimal prompts leave deception to the VLM’s reasoning.Source: §D.6 · pp. 33–34

E.1 Annotation Methodology

• The final inventory contains 23 atoms reconciled from two independent annotations: 20 mapped 1:1, three were consolidated from finer sub-patterns, and one unmatched atom was excluded.The atoms are organized into non-verbal task-phase clusters and verbal meeting/vote clusters based on the IDT categories Falsification, Equivocation, and Concealment.Source: §E.1 · p. 35

E.2 Descriptions of the 23 Deceptive Atoms

• The 23-atom codebook covers non-verbal camouflage, pursuit and killing, and body-reporting decisions alongside verbal falsification, equivocation, and concealment.Examples include fake-mission performance, stalking, witness-aware killing, strategic non-reporting, alibi fabrication, counter-accusation, hedged speech, and vote/chat inconsistency.Source: §E.1 · p. 35, §E.2 · pp. 35–37

E.3 Independent Validation of Deception Atom Taxonomy

• An independent annotator recovered the non-verbal/verbal distinction, recovered 8 of 23 atoms exactly, and matched 7 through coarser merges and 4 through partial overlaps.The four unrecovered atoms were rare, while differences largely reflected granularity or boundary choices; the five-game check is treated as convergent rather than exhaustive validation.Source: §E.3 · p. 38

E.4 Inter-Annotator and Human–LLM Agreement

• Human–LLM agreement reached F1micro = 0.783, F1w = 0.792, Spearman ρ = 0.713, and Cohen κ = 0.709, remaining within 0.02, 0.07, 0.09, and 0.08 of human–human agreement, respectively.The authors therefore argue that LLM-as-a-Judge can approximate inter-annotator agreement closely enough for scalable human annotation replacement.Source: §E.4 · pp. 38–39
• The verbal pass scans every imposter utterance and vote reason for atomic deception behaviors while excluding non-verbal atoms and purely logistical vote lines.It covers alibis, framing, fabricated testimony or inconsistencies, teammate reinforcement, hedging, credibility markers, coalition-building, and vote/chat inconsistency.Source: §E.4 · p. 41

E.5 Judge Evidence Sources and Representative Outputs

• The two judge passes use distinct evidence channels: gameplay logs and action narration for non-verbal findings, versus meeting utterances and vote reasoning for verbal findings.Adjacent step and action-narration lines provide context for verifying alibi and false-observation claims in the verbal pass.Source: §E.5 · p. 41
• Table 12 presents one representative Qwen3.6-27B judge finding from each of six deception clusters in RQ1 GPT-4.1-mini self-play games.The examples are drawn from judge outputs rather than presented as aggregate agreement or performance results.Source: §E.5 · p. 41

E.6 Judge Backbone Selection and Cross-Family Robustness

• On Qwen3.6-27B logs, the same-family judge scores lower (κ = 0.623) than on GPT-4.1-mini logs (κ = 0.709), while Kimi-K2.5 reaches the highest cross-family score (κ = 0.661).Human-human agreement is higher on the Qwen logs (κ = 0.827) than on GPT-4.1-mini logs (κ = 0.792), making gameplay-log difficulty more consistent with the pattern than family affinity.Source: §E.6 · pp. 41–42
• Qwen3.6-27B achieves the highest LLM-judge Cohen’s κ on the 48-log validation set (κ = 0.709) and is used as the fixed judge for large-scale annotations.Table 13 compares judge backbones against human annotations; the selection also avoids mutable proprietary API dependence.Source: §E.6 · pp. 41–42, Table 13 · p. 42

E.7 Three Deception Taxonomies

• The Whiten–Byrne taxonomy categorizes functional deception purposes as concealment, distraction, false image, social tool, and deflection.These categories cover hiding information, redirecting attention, presenting false states, exploiting group mechanisms, and shifting suspicion or blame.Source: §E.7 · p. 43
• The Whaley taxonomy distinguishes dissimulation into masking, repackaging, dazzling, mimicking, inventing, and decoying, while IDT labels verbal manipulation as falsification, concealment, or equivocation.Whaley separates hiding the real from showing the false; IDT focuses on false, withheld, or deliberately ambiguous utterances.Source: §E.7 · p. 43

F VLM Inference Configuration

• VLM inference routes through OpenRouter with family-specific temperatures: 0.7 for Qwen and Gemma, 0.1 for GPT-4.1-mini, Gemini, and Kimi-K2.5, and 1.0 for GPT-5-mini and GPT-5.All models use max tokens = 256 except GPT-5-mini and GPT-5, which use max tokens ≥8192.Source: F VLM Inference Configuration · p. 43

G RQ1: Ego vs. Privileged State Representation

• RQ1 examines why the imposter’s state mode is fixed to privileged in later experiments and what changes when the imposter is restricted to ego state.This section expands the preliminary finding reported in Section 4.1.Source: G RQ1: Ego vs. Privileged State… · p. 44

G.1 Experiment design; G.2 Headline imposter win rate

• 40 →0% (−40 pp) for GPT-4.1-mini and 40 →20% (−20 pp) for Qwen3.6-27B when switching from privileged to ego state; the lone Qwen-ego win is a timeout, and kills collapse completely.The comparison uses four cells crossing two imposter-VLM backbones with two state modes, holding crewmate state and other axes fixed.Source: §G.2 · p. 44, Table 15 · p. 44, §G.1 · p. 44

G.3 Mechanism of the Ego-State Collapse

• Ego-state collapse follows three mechanisms: kill mode rarely fires, acquired targets are lost mid-approach, and no body means no meeting or verbal-deception channel.Line-of-sight and frustum filters leave the visible target set empty or unusable; without persistent positions, approaches reset to exploration or other non-attacking modes.Source: §G.3 · pp. 44–45

G.4 What Privileged State Does and Does Not Replace

• Privileged state supplies persistent full-map coordinates for tracking other players, but RGB remains necessary for kill verification, corpse reporting, surveillance updates, and deception-critical interactions.Higher-level decisions remain embedded in a 3D multi-agent environment whose outcomes depend on visual observations.Source: §G.4 · p. 45

G.5 Decomposing the Ego-Privileged Gap

• 0.0→2.0 kills per game under priv36 still yields 0% imposter WR, whereas full-map priv raises kills to 3.0 per game and restores imposter WR to 40%.Persistent local coordinates recover kill execution, but sustained strategic play additionally requires a broader spatial horizon.Source: Table 17 · p. 45, §G.5 · p. 46
• Removing RGB while retaining full-map coordinates reduces imposter WR to 0% and kills to 0.2 per game because visual witness and target checks become unreliable.The agent continues generating kill-oriented plans and invoking the kill pipeline, but viable approaches fail without visual perception.Source: Table 17 · p. 45, §G.5 · p. 46

G.6 Why Privileged State Is the Experimental Default

• Only privileged supports the full kill–meeting–deception loop under the present ARIA architecture, motivating its use as the experimental default while ego remains a lower-bound condition.The reduced conditions fail to sustain reliable kills, viable imposter wins, or successful vision-gated play; closing this gap under fully egocentric perception remains future work.Source: §G.6 · p. 46

H RQ1: Per-Cell Full-Factorial Imposter WR

• Each full-factorial cell pools 16 imposter configurations across 3 repetitions, yielding N = 48 per cell; one reported configuration, GPT-4.1-mini self-play with window/hierarchical crewmate state, has 25.0% pooled imposter WR (12/48).The grids vary memory, refl-skill, planning, and prompt axes while fixing the complementary crewmate settings by cell.Source: H RQ1: Per-Cell Full-Factorial… · pp. 46–47, Table 18 · p. 47

I RQ1: Statistical Significance of Main Effects; I.1 Pre-registered hypotheses and significance threshold; I.2 Per-cell descriptive deltas

• At α = 0.10, memory and planning deltas are directionally consistent across all four cells, refl-skill is positive in 3 of 4, and prompt is VLM-dependent; no axis is individually significant at N = 48.The preregistered one-sided hypotheses are window > semantic, hierarchical > reactive, and meeting-on > none-off; prompt is exploratory and two-sided.Source: §I.1 · pp. 47–48, Table 19 · p. 48, §I.2 · p. 48

I.3 Primary analysis: pooled 2-proportion z-test

• In the pooled 192-game test, planning and reflection-skill reach marginal significance at α = 0.10, while memory is directionally consistent but below threshold.The pooled comparison has 96 games per axis level, with Np0 = Nq0 ≈48, supporting the normal approximation.Source: Table 20 · p. 48, §I.3 · p. 48
• The pooled prompt analysis shows no consistent main effect because directional preference varies by VLM across the per-cell deltas.This result is reported under the pre-registered one-sided test framework summarized in Table 20.Source: Table 20 · p. 48

I.4 Cross-Backbone Replication of Per-Axis Trends

• Across both additional backbones, window memory exceeds semantic memory, hierarchical planning exceeds reactive planning, and meeting-on exceeds none-off.The replications use the same axis definitions, crewmate configurations, and aggregation procedure as the original RQ1 analysis, with N = 96 matches per backbone.Source: §I.4 · p. 49
• The prompt axis favors the deterministic prompt on both additional backbones, reflecting backbone-dependent effects rather than a uniform prompt main effect.Because each replication has only N = 96 games and some differences reflect one or a few outcomes, the results are treated as directional robustness checks across four VLMs, not standalone confirmatory evidence.Source: §I.4 · p. 49

J RQ1: Per-Axis Marginal Atom Distribution

• Figure 8 reports pooled per-axis marginal distributions of total atomic-deception counts across memory, planning, reflection-skill, and prompt.The histogram complements the per-atom rpb ranking by showing absolute atom-count shifts along each axis.Source: J RQ1: Per-Axis Marginal Atom… · p. 49, Figure 8 · p. 50

K RQ1: Cluster-Level Win-Rate Correlations

• Cluster-level correlations rank NV-2 P&K highest (r = +0.290), followed by NV-3 R&E (+0.268) and V-1 FALS (+0.160), while NV-1 Cam, V-2 EQVC, and V-3 CONC are near zero or weakly negative.These point-biserial Pearson correlations use per-game cluster atom counts and imposter-win indicators pooled over all 192 games.Source: K RQ1: Cluster-Level Win-Rate… · p. 49, Table 22 · p. 49
• Figure 9 summarizes phase-by-phase atom flow across five phases for the 157 of 192 RQ1 games containing at least one meeting phase.Per-game atom counts are averaged over those games, with atoms color-coded by letter.Source: Figure 9 · p. 50

L RQ1: Arc-Level Deception

• Across the five match phases, task phases are dominated by non-verbal atoms, while meeting phases are dominated by verbal falsification atoms.The arc analysis covers 157 of 192 RQ1 games containing at least one meeting and segments matches into pre-m1, m1, m1–m2, m2, and post-m2.Source: L RQ1: Arc-Level Deception · p. 51
• Non-verbal P&K atoms around kills are typically followed by meeting-phase alibis, counter-accusations, and mutual reinforcement, forming a recurring kill →alibi/counter-accusation arc.Fake-Mission Performance is the largest task-phase mass, while V-1 Falsification dominates both meeting phases; EQVC and CONC remain sparse.Source: L RQ1: Arc-Level Deception · p. 51
• Individual game logs reveal a feedback chain from meeting outcome to game-state inference, kill-timing restraint, reporting choice, and more sophisticated verbal deception that aggregate arc statistics smooth over.The case demonstrates that VLM-agent imposters weigh action costs against the broader game trajectory rather than executing a fixed kill cycle.Source: L RQ1: Arc-Level Deception · pp. 51–52
• In a representative imposter win, explicit post-meeting reasoning about remaining missions produced eight steps of active kill restraint with continued fake-mission performance and scouting before a later witness-aware kill.The imposters deferred kill timing rather than abandoning action, resolving the restraint period with James’s kill of Ethan.Source: L RQ1: Arc-Level Deception · p. 51, Figure 10 · p. 52
• The same case adapted across non-verbal, reporting, and verbal channels by replacing self-report with strategic non-reporting and adding concession-as-defense to the later alibi sequence.The second meeting used T+L+O+M and ended with the wrongful ejection of Steve, who reported the second body.Source: L RQ1: Arc-Level Deception · p. 51, Figure 10 · p. 52

M RQ2: Family- and Scale-Level Win-Rate Patterns

• Closed-source OpenAI and Gemini families achieve higher imposter and crewmate win rates than open-source Qwen and Gemma families, with the same asymmetry in cross-family matchups.Figure 3 places OpenAI and Gemini in the high-imposter/high-crewmate region, while Figure 11 shows closed-source imposters more often defeat open-source crewmates than the reverse.Source: M RQ2: Family- and Scale-Level… · p. 52
• Win rate generally increases with advertised model scale within a family, except that GPT-5-mini is not consistently outperformed by GPT-5 and Gemma4-26B-A4B slightly exceeds Gemma4-31B as a crewmate.These are within-family exceptions to the overall scale trend.Source: M RQ2: Family- and Scale-Level… · p. 52

N RQ2: Per-Case Matchup Matrices

• The per-case RQ2 matrices disaggregate a pooled 12 × 12 imposter-WR heatmap across four crewmate–imposter configurations, with each cell based on two repetitions.Cells take values 0, 50, or 100%, while row marginals aggregate each imposter VLM’s performance against all 12 crewmates over 24 matches.Source: N RQ2: Per-Case Matchup Matrices · pp. 52–53, Figure 11 · p. 53, Table 23 · p. 54
• Case 1A and Case 1B both achieve 50% same-model imposter WR, while Case 2B improves over Case 2A from ≈38% to ≈54%, a +16 pp gain.The lower pooled WR of Case 1B is attributed to cross-model matchups rather than weaker same-model performance.Source: N RQ2: Per-Case Matchup Matrices · p. 54

O RQ2: Deception Profiles of Winning Archetypes

• Winning Archetype A relies on ≈39% NV-1 Cam activity, especially Fake-Mission Performance at 15–18 instances per game, to mimic crewmate labor and move naturally between kills.This archetype comprises Gemini-3-flash and Gemini-3.1-flash-lite.Source: O RQ2: Deception Profiles of Winning… · p. 55
• Winning Archetype B relies on ≈43% V-1 Falsification, driven by Counter-Accusation at 7.0/game and Mutual Reinforcement at 3.7/game, rather than fake tasks.This archetype is represented by Kimi-K2.5, with atom A at only 3.8/game.Source: O RQ2: Deception Profiles of Winning… · p. 55
• Both winning archetypes share a signature in which V-2 Equivocation and V-3 Concealment together comprise ≤1% of the atom budget.The winners therefore do not engage in defensive hedging.Source: O RQ2: Deception Profiles of Winning… · p. 55

P RQ2: Qualitative Failure Modes in Lower-Performing Imposters

• Lower-performing imposters fail through heterogeneous mechanisms: poor target selection despite correct witness perception, hallucinated witnesses, self-disclosing defenses, and teammate-coordination breakdowns.These cases show that similar low imposter WR outcomes can arise from different failures in the perception–decision–communication loop.Source: P RQ2: Qualitative Failure Modes in… · pp. 55–56

Q.1 The original comparison used different metrics

• RQ1 used point-biserial rpb on per-game cluster atom counts versus binary wins across 192 games, whereas RQ2 used Pearson r on per-model cluster shares versus win rates across six models.Because these metrics answer different within-game and cross-model questions, comparing their signs is invalid; RQ2 is re-run with RQ1’s per-game rpb metric on 576 games.Source: §Q.1 · p. 56

Q.2 Method-matched cluster-level rpb

• Four of six clusters share sign under matched metrics; NV-1 Cam and V-2 EQVC are near-zero mismatches rather than strong reversals.The earlier NV-1 Cam contrast of −0.48 versus +0.54 compared incompatible metrics, so the original cross-RQ reversal claim does not survive.Source: Table 24 · p. 56, §Q.2 · p. 56

Q.3 Method-matched atom-level rpb for all 23 atoms

• Across all 23 atoms, the seven exceptions comprise five noise-range atoms and only two substantive mismatches: T, Concession-as-Defense, and A, Fake-Mission Performance.The matched comparison uses per-game raw-count rpb, with RQ1 covering 192 games and RQ2 covering 576 games.Source: Table 25 · p. 57, §Q.3 · p. 57
• 16 of 23 atoms share sign strongly across pools, with E, F, H, and C positive in both and F, E, H positive for all six RQ2 VLMs.These atoms cover the kill-execution loop and remain universal within-game imposter-winning drivers across architecture and model-identity variation.Source: §Q.3 · p. 57, Table 25 · p. 57

R Revisit of Prior Among Us Findings

• Direct numerical comparison with prior Among Us reports is limited because the present setup differs from those studies.The revisit therefore flags directional differences rather than claiming directly comparable effect sizes.Source: R Revisit of Prior Among Us Findings · p. 57
• Equivocation does not dominate in MINEAMONGUS: V-2 EQVC comprises ≈0.6% of observed atoms, versus 36.9% for V-1 Falsification and 29.2% for NV-2 Pursuit & Kill.This contrasts with the text-only finding by Milkowski & Weninger (2026), and the near-zero V-2 cluster-level association suggests action can manage social pressure instead of hedged speech.Source: R Revisit of Prior Among Us Findings · p. 57
• Imposter and crewmate performance correlate strongly within each model, with Pearson r = +0.71 across 12 VLMs, unlike the role-specialization reported by Golechha & Garriga-Alonso (2025).Models separate instead along the closed-source versus open-source axis, according to Figure 3 and Appendix M.Source: R Revisit of Prior Among Us Findings · p. 58
• The differing role relationship may reflect a two-model pairwise comparison versus a 12-VLM aggregate and MINEAMONGUS’s joint verbal, non-verbal, navigation, mission, and chat demands.Those demands may favor role-symmetric general competence rather than role specialization.Source: R Revisit of Prior Among Us Findings · p. 58

S Exploratory: MASK Honesty Score vs. Imposter Win Rate

• MASK honesty and imposter WR showed the predicted negative association, but neither model-level nor game-level tests were statistically significant.Pearson r = −0.163 (p = 0.612) and Spearman ρ = −0.175 (p = 0.586) across 12 VLMs; logistic regression gave odds ratio 0.918, 95% CI [0.80, 1.06], p = 0.240.Source: Figure 12 · p. 58, S Exploratory: MASK Honesty Score vs.… · pp. 58–59
• MASK measures truthful responses under adversarial pressure, and the study reran its Public Test on all 12 RQ2 VLMs before comparing scores with imposter WR.The benchmark is intended to separate honesty from accuracy and provides a single-axis comparison for deception resistance.Source: S Exploratory: MASK Honesty Score vs.… · p. 58
• The MASK comparison is exploratory only: its single-turn honesty score differs from multi-step embodied deduction, so no causal or predictive claim is made.Gemma4-26B-A4B and Kimi-K2.5 had similar honesty scores but imposter WRs of 36.5% and 66.7%, respectively.Source: S Exploratory: MASK Honesty Score vs.… · p. 59

T Exploratory: Sensitivity to Inference-Time Reasoning Effort

• 58% to 21%: increasing GPT-5-mini’s reasoning effort reduced imposter WR across 24 matches (p < 0.01), with wins shifting toward step-cap outcomes rather than successful kills.Only 2/5 high-effort wins involved successful kills; repeated deferral while waiting for witness-free opportunities allowed crewmates more time to complete missions.Source: T Exploratory: Sensitivity to… · p. 59
• Higher reasoning effort materially changed strategy even with the VLM backbone and ARIA configuration fixed, shifting behavior toward conservative waiting rather than active kill execution.This is treated as an exploratory GPT-5-mini result, not a general effect of reasoning effort.Source: T Exploratory: Sensitivity to… · p. 59

U.1 Research question

• The behavior-cloning question asks whether a small crewmate can be trained into an efficient deception detector that defeats a strong imposter without scaling the backbone.This motivation follows RQ2’s finding that imposter and crewmate win rates correlate strongly within a VLM.Source: §U.1 · p. 59

U.2 Setup

• Behavior cloning fine-tunes Qwen3.5-9B on expert RQ2 gameplay and evaluates it against fixed Qwen3.5-9B, Qwen3.5-27B, and Qwen3.6-27B imposters.Each ARIA call is represented as a supervised (X, S, Y) example; BCwin, BCvote, and BCwin+vote provide trajectory-level, voting-only, or combined data.Source: §U.2 · pp. 59–60

U.2.1 Behavior-Cloning Details

• The study evaluates crewmate WR alongside ejection recall and precision, covering planning, memory, reflection, skill memory, and verbal/non-verbal decision modules.Examples may include egocentric RGB observations or text alone; LoRA SFT freezes the vision tower while updating language-side reasoning.Source: §U.2 · p. 60, §U.2.1 · p. 60

U.3 Result

• BCwin+vote is the most balanced crewmate, combining win rates of 50/38/25% with improved detection against stronger imposters.It is the only configuration strong across win rate, recall, and precision, though it tops no single column.Source: §U.3 · p. 60, §U.4 · p. 61
• BCwin more than doubles baseline crewmate win rates against every imposter, from 25→56, 13→50, and 13→38%, but does not improve recall against stronger imposters.Its wins mainly come through non-verbal mission completion rather than imposter ejection.Source: §U.3 · p. 60, §U.4 · p. 61
• BCvote improves ejection precision against every imposter, from 64→67, 38→46, and 25→42, while increasing recall against harder 27B-scale imposters.Its lower recall against the weak 9B imposter reflects conservative voting, with ejected imposters per game decreasing from 0.88→0.50.Source: §U.3 · p. 60, §U.4 · p. 61
• BCwin+vote recovers much of BCvote’s 27B-scale detection while retaining high win rates, with recall improving 19→28 and 22→28 over BCwin.Its precision also improves from 38→43 and 35→39 over BCwin.Source: §U.3 · p. 60
• BCwin targets the win-rate channel, achieving the best win rate in every column while maintaining recall at or below baseline against 9B/27B imposters.This specialization reflects mission completion rather than reliable ejection.Source: §U.3 · p. 60

U.4 Answer to the research question

• BCvote targets the detection channel despite using 6× fewer samples, training on 2.2K examples and improving precision across all imposters.It improves win rate only modestly while learning correct voting behavior.Source: §U.3 · p. 60, §U.4 · p. 61
• Filtered behavior cloning yields competent 9B crewmates without changing the backbone, with strengths determined by the selected data filter.BCwin+vote concatenates complementary behaviors inherited from the win-oriented and vote-oriented filters.Source: §U.4 · p. 61