PaperlayerView exact revision on arXiv

Source-linked AI summary

LLM Persuasion Is in the Eye of the Evaluation

Kamile Dementaviciute, Julija Vaitonyte, Tijl De Bie

arXiv:2610.10232v1cs.CLcs.AIcs.CY

TL;DR

Persuasion evaluations differ in what they measure, even though their results are often read as measuring one capability. This paper compares nine automated methods on the same fifteen models and finds weak agreement, with refusals and task type contributing to disagreement.

  • Problem

    Persuasion evaluations vary in their tasks and measures, yet their results are often interpreted as measuring a single capability.

    Source: §2.1 · p. 3

  • Method

    The study compares nine published automated persuasion methods on the same fifteen models under a shared setup.

    Source: §7 · p. 10

  • Results

    Persuasion methods agree only weakly: refusals lower agreement by about a quarter, and rational-persuasion and manipulation methods show different agreement patterns.

    Source: §7 · p. 10

  • Takeaways & Limitations

    A single persuasion score describes a model on one task and may say little about its persuasiveness on others.

    Source: §7 · p. 10

    With fifteen models and nine methods, the analysis can detect agreement but offers only exploratory explanations of disagreement; general capability is measured with two benchmarks.

    Source: §6 · p. 10

Abstract

from arXiv · show

Large language models (LLMs) have already been shown to match or exceed human experts in persuasion. While their persuasive capabilities hold promise for beneficial uses such as education and health communication, they can also be used to manipulate and misinform, making their evaluation a growing priority for developers and regulators. That evaluation, however, remains fragmented: studies differ in what they treat as persuasion, and broad claims often rest on narrow, situation-specific assessments. Automated methods, often modelled on human studies, offer a way to compare such assessments directly, as they can be run on the same models at scale and can include high-risk forms of persuasion that would be difficult or unethical to test on people. In this study, we adapt nine published automated methods to a shared setup, run them on the same fifteen LLMs, and ask whether their rankings agree and why. We find that the methods agree only weakly (mean Spearman $\rho = 0.25$). Our analyses point to two contributing factors. Models that refuse some tasks but not others, directly or indirectly, lower agreement by about a quarter, and these refusals fall mostly on manipulation tasks. General capability also plays a part: most rational persuasion (non-manipulative) methods track it, whereas most manipulation methods do not. Together, these findings suggest that agreement depends more on the task a method sets than on how it scores persuasion, although this pattern is only indicative given the eight methods available for analysis. More broadly, our results suggest that persuasion scores combine a model's ability to persuade with its willingness to do so. A single score is therefore informative about its own setting, but says little about a model's persuasiveness across tasks.

1 Introduction

LLM persuasion evaluations vary in what they treat as persuasion, while broad claims often rest on narrow tasks. This study compares published automated methods on shared models to test whether their rankings agree and what may explain disagreement.

1 Introduction

  • The study addresses fragmented evaluations by comparing published automated methods side by side on the same models, enabling a systematic comparison at scale.Automated methods can include high-risk persuasion settings that may be infeasible to test with people.Source: §1 · p. 1

Statement of Contributions

  • The paper presents the first comparison of existing automated LLM-persuasion methods on a common set of models, adapting nine methods to one setup and testing fifteen LLMs.The comparison spans both rational persuasion and manipulation.Source: Statement of Contributions · p. 2
  • Methods agree only weakly (mean Spearman ρ = 0.25 over eight reliable methods), and seven different models rank first across the nine methods.Figure 1 also shows Claude-Fable-5.1 first on two methods and last on another.Source: Statement of Contributions · p. 2, Figure 1 · p. 2
  • Models that refuse some tasks but not others lower agreement by about a quarter; rational persuasion methods agree moderately, while manipulation methods agree neither with them nor each other.The findings are indicative, given the eight methods available for analysis.Source: Statement of Contributions · p. 2
  • Most rational persuasion methods track general capability, while two of the three manipulation methods do not.The capability check follows Ren et al. (2024).Source: Statement of Contributions · p. 2
  • The authors recommend using several risk-relevant tasks, reporting refusals separately from persuasive success, and stating how scores track general capability.They also recommend multiple judges or persuadees and validation against human judgments where possible.Source: Statement of Contributions · p. 2

2 Background

Prior work defines persuasion broadly and evaluates it through diverse tasks and scoring approaches, although results are often read as measuring one capability. Research on benchmark agreement and capability tracking motivates examining what persuasion rankings actually reflect.

2.1 LLM Persuasiveness Evaluation

  • Persuasion is defined as intentional communication to influence opinions, beliefs, or behaviour through cognitive decision-making; it includes rational persuasion and manipulation.Rational persuasion openly engages reasoning with arguments and evidence, whereas manipulation covertly exploits it, for example through deception.Source: §2.1 · p. 2
  • Automated evaluations vary in task, from single texts to simulated conversations and debates, and in scoring, from judges to belief reports, rules, or dataset answers.Their tasks range from honest advocacy to attempts to persuade someone to accept a false claim.Source: §2.1 · p. 2
  • Despite these differences, evaluation results are often read as measures of one capability, while human validation covers only some methods and gives mixed agreement across outcome types.Human-study results also appear to depend on the model, conversation design, and domain.Source: §2.1 · p. 3

2.2 Evaluating the Evaluations

  • Benchmark agreement can depend on which and how many models are compared and whether the full ranking or only top positions are considered; safety benchmarks also often agree weakly.Perlitz et al. (2025) formalize agreement testing; Desai et al. (2026) examine 56 capability and safety benchmarks.Source: §2.2 · p. 3
  • Capability tracking complicates interpretation because two methods may agree simply by tracking general capability, while persuasion’s precise relationship to capability remains unclear.Prior work reports that a larger-model persuasion advantage mostly disappeared after accounting for basic task completion.Source: §2.2 · p. 3
  • A prior study of six models across six manipulation environments found barely correlated rankings across environments (mean Spearman ρ = 0.055) and concluded models lacked a stable propensity to manipulate.The environments were built within a single framework.Source: §2.2 · p. 3

3 Study Design

The study adapts nine published persuasion-evaluation methods to a shared setup and applies them to the same fifteen LLMs. Its design compares model rankings while examining reliability, refusals, task differences, and general capability.

3 Study Design

  • Nine published persuasion-evaluation methods were adapted to a shared setup and run on the same fifteen LLMs.The study compares methods selected from prior work whose code could be checked and run, excluding arena-style tournaments and methods that could not be adapted feasibly.Source: §3 · p. 3, §3.1 · p. 3

3.2 Evaluated Models

  • The fifteen models span families, parameter counts, release dates, countries of origin, and a wide range of capability.Ten open-weight models ran locally; five models were accessed through provider APIs.Source: §3.2 · p. 3

3.3 Analysis Plan

  • Methods are compared by their rankings of the fifteen models, with agreement and reliability analyses used to distinguish measurement noise from disagreement.The plan also examines whether capability, refusals, or task and measurement differences align with agreement patterns; analyses of method groupings are exploratory given eight reliable methods.Source: §3.3 · p. 3, RQ1: Do the Methods Agree? · p. 4, RQ2: What Explains It? · pp. 4–5

3.4 Experimental Setup

  • Where methods require simulated persuadees or judges, the study pins a single model to each role and uses the same sampling seed across evaluated models.The pinned models are GPT-4.1-mini-2025-04-14 as persuadee and GPT-4o-2024-11-20 as judge; temperatures follow the original studies, with stated exceptions.Source: §3.4 · p. 5

3.5 Sample Sizes

  • Sample sizes were planned from initial runs on five models and twenty sampling units, targeting reliability of 0.90 for each model’s mean.Where budgets allowed, the estimated sample size was multiplied by 1.5; otherwise the method was retained and its reliability reported.Source: §3.5 · p. 5

3.6 Unscored Attempts

  • Refusals and empty responses score zero, while unreadable outputs are excluded as format-compliance or instrument failures.Indirect refusals are scored like other attempts; the study examines them more closely for False Claim, where they are frequent and clearly defined.Source: §3.6 · p. 6

3.7 Reliability and Robustness Checks

  • Seven robustness checks assess run-to-run consistency and sensitivity to judges, persuadees, temperature, refusals, human verdicts, reporting choices, and rewrite length.The checks also compare rankings across pooled versus separate task strategies or datasets and recompute agreement after removing cells with substantial refusals or unreadable attempts.Source: §3.7 · p. 6

4 Results

The nine methods were first checked for reliability, then compared by how they ranked the models. Their agreement was weak; refusals and task type contributed to disagreement, while capability affected which methods agreed.

4.1 Reliability

  • Eight of nine methods were reliable, with split-half reliability from 0.82 to 0.99; Mislead Debate scored 0.74 and was excluded from RQ2 and RQ3.Its 512-token limit appeared to contribute to lower reliability; without the limit, regenerated answers reached 0.93 reliability but ranked models differently (ρ = 0.21 with the study ranking).Source: §4.1 · p. 6

4.2 RQ1: The Methods Agree Only Weakly

  • No two methods produced the same ranking; mean pairwise Spearman ρ was 0.252 over the eight reliable methods, with a highest pairwise ρ of 0.73.Mean agreement was 0.35 among the ten local models and 0.00 among the five API models.Source: §4.2 · p. 6, Figure 3 · p. 8

4.3 RQ2: Refusals and the Type of Task

  • Excluding refused or empty attempts raised mean pairwise ρ over the reliable eight from 0.252 to 0.342, a difference of 0.090 [0.06, 0.14]—about a quarter.Much of the increase came from MakeMeSay and MakeMePay refusals; five of seven cells with refusal rates above a quarter involved manipulative tasks.Source: §4.3 · p. 7, Table 4 · p. 8
  • The five rational-persuasion methods agreed at 0.56, while the three manipulative methods agreed at 0.03 and with the other methods at 0.06.The task-type gap fell from 0.40 to 0.13 after removing capability, and to 0.16 under refusal exclusion; after correction, no grouping remained significant, so these patterns are indicative rather than conclusive.Source: §4.3 · p. 8, Table 5 · p. 9

4.4 RQ3: Capability Shapes Which Methods Agree

  • Five methods tracked capability at 0.58 to 0.90, while MakeMePay did not (−0.04) and False Claim ran against it (−0.57).Removing capability lowered mean pairwise ρ from 0.252 to 0.152 (p = 0.01) and changed 21 of 28 pairwise correlations, affecting which methods agreed.Source: §4.4 · pp. 8–9, Table 6 · p. 9

5 Discussion

The methods’ rankings depend on the persuasion task: rational-persuasion and manipulation evaluations can rank the same model very differently. Because scores combine ability and willingness to persuade, a low manipulation score may reflect refusal rather than inability.

Discussion

  • The methods agree only weakly, especially on more capable models, and their rankings depend on the task; a high score in one setting does not guarantee a high score in another.The methods mostly place smaller models near the bottom but differ on how to order more capable models, which are a focus of regulation.Source: §5 · p. 9

Rational persuasion vs manipulation

  • Rational-persuasion methods agree with one another, while manipulation methods agree neither with them nor with one another; this pattern is indicative given only eight methods.Claude-Fable-5.1 ranks among the top two on four of five rational-persuasion methods but among the bottom two on all three reliable manipulation methods.Source: §5 · p. 9

The role of general capability

  • Most methods rank more capable models higher, but capability adjustment changes which methods agree, suggesting some agreement reflects capability rather than persuasion.Subjective Opinion ranks models more like the capability score than like other persuasion methods, consistent with findings from Ren et al. (2024) and Hackenburg et al. (2025).Source: §5 · p. 9

Ability vs willingness

  • Persuasion scores combine a model’s ability to persuade when it tries with its willingness to try, and both differ from unprompted persuasion (Kowal et al. 2025).Rational-persuasion tasks are rarely refused, whereas some capable models decline manipulation tasks; a low manipulation score may therefore reflect safeguards rather than weaker ability.Source: §5 · pp. 9–10

Implications for regulation and deployment

  • Because a low score on one task can coexist with a high rank on another, a single result may give a false sense of safety in release decisions.The authors recommend that regulators ask which tasks were used, what the model was asked to do, and how refusals were scored.Source: §5 · p. 10

Recommendations

  • Assess persuasiveness across multiple risk-relevant tasks, report refusals separately from success, report general capability, and, where possible, use multiple judges or persuadees and validate against human judgments.Source: §5 · p. 10

6 Limitations

The study’s conclusions are bounded by its shared agents, adapted methods, limited model and method counts, and approximate refusal measurements.

Limitations

  • All methods share one persuadee and one judge, and an LLM persuadee may respond differently from people; the judge was validated against human verdicts for Rationale only.Consistent biases and model-family preferences cannot be ruled out, including because pinned agents share developers with evaluated models.Source: §6 · p. 10
  • Fifteen models and nine methods support detecting agreement but are too few to explain disagreement beyond suggestion, making the eighteen-grouping analysis exploratory.Nine methods do not cover every published approach, and general capability was measured with only two benchmarks.Source: §6 · p. 10
  • Findings concern the methods as adapted, not as published, and token limits particularly affect Mislead Debate, whose uncapped version was not rerun.Its reliability falls below the target partly because of its 512-token cap; the uncapped rerun was left to future work.Source: §6 · p. 10
  • Refusal rates are approximate because only direct refusals enter the main results; indirect refusals were measured separately for False Claim.Both refusal types score close to zero, so the main results treat them alike.Source: §6 · p. 10

7 Conclusion

Across nine automated methods evaluated on fifteen models, rankings agree only weakly, and sampling noise is unlikely to explain the disagreement. Refusals and task type contribute to the disagreement, so a single score may say little about performance across tasks.

7 Conclusion

  • The nine methods agree only weakly on rankings, with agreement weakest among the most capable models, and sampling noise is unlikely to explain the result.Source: §7 · p. 10
  • Refusals lower agreement by about a quarter, while general capability shapes which methods agree; rational-persuasion methods agree moderately, unlike manipulation methods.This task-type split is indicative given eight methods, and a low manipulation score may reflect stronger safeguards rather than weaker persuasive ability.Source: §7 · p. 10
  • A single persuasion score may say little about other tasks, so evaluations should use multiple risk-relevant tasks, report refusals separately, and report general capability alongside.Source: §7 · pp. 10–11

A Detailed Method Descriptions

The appendix describes ten adapted methods, spanning persuasion to reduce meat consumption, change opinions, rewrite text, influence debate, deceive, gain compliance, and obtain money or a secret codeword.

Reduce Meat; Subjective Opinion

  • Reduce Meat measures change in a three-item intention questionnaire after five conversation rounds, while Subjective Opinion measures normalized change in support ratings after a seven-message exchange.Source: A Detailed Method Descriptions · p. 12

Rationale

False Claim

  • False Claim measures how often a persuadee answers with a specified false answer after reading misleading evidence written using one of eleven persuasion strategies.Source: A Detailed Method Descriptions · p. 13

Benign Request

  • Benign Request measures a pinned judge’s rating of persuasion toward a benign request; the persuadee’s accept-or-reject decision does not enter the score.Source: A Detailed Method Descriptions · p. 13

MakeMePay

MakeMeSay

Rewrite Text; Mislead Debate

  • Rewrite Text scores a model’s revision against its original using a frozen DeBERTaV3-Large scorer, while Mislead Debate measures change in agents selecting an adversary’s assigned wrong answer.Source: A Detailed Method Descriptions · pp. 12–13

B Method Adaptations

The adaptations standardize recipients, judges, and scoring across methods while retaining selected method-specific settings. Tables document sampling units, capability measures, and RQ2 groupings and statistics.

B Method Adaptations

  • A fixed persuadee and shared judge give methods the same recipient and scorer, while a fixed GPT-4 rationale makes rationale scores independent across models.The original rationale method dropped items when models chose differently; the adaptation has every model justify the same choice.Source: B Method Adaptations · p. 13
  • Benign Request uses ethically neutral scenarios and a persuadee instructed to resist; 26 conversations with unreadable verdicts are excluded, 22 of them scored zero.The adaptation also uses temperature 0 rather than 1; other method-specific changes include using trained-on texts for Rewrite Text and capping debate messages at 512 tokens.Source: B Method Adaptations · pp. 13–14
  • Sampling design records scored attempts and bootstrap or split-half units, resampling units within fixed conditions rather than resampling the conditions themselves.Table 3 counts only units scored for all fifteen models.Source: Table 7 · p. 14
  • The RQ2 tables define eighteen method groupings and report within-group, between-group, gap, permutation, and adjusted p statistics, with 95% intervals over sampling units.The intervals hold the eight reliable methods fixed.Source: Table 8 · p. 15, Table 9 · p. 16
  • General capability C averages z-scored MMLU-Pro and IFEval accuracies; the two benchmarks rank the fifteen models similarly (Spearman ρ = 0.87).MMLU-Pro uses 300 questions, five-shot chain of thought; IFEval uses all 541 prompts, zero-shot.Source: Table 10 · p. 16

Related papers

Loading 2610.10232v1…