Source-linked AI summary
When Extremists Enter LLM Societies: Investigating Extreme Behavior in Multi-Agent Systems
Guo Chen, Huaijin Xie, Ziwen Li, Reed Li, Yu Lu, Haibo Shi, Bingbing Xu, Junjie Huang
TL;DR
LLM social simulations often focus on representative personas and average behavior, while social science documents persistent tail actors’ disproportionate influence on collective dynamics. This paper develops an LLM-native account and EXAM, a controlled framework for configuring extremist agents and measuring collective responses. Across four scenarios, persistent extremist groups are associated with measurable shifts that vary by backbone, scenario, and settings.
Problem
LLM social simulations often emphasize representative or average behavior, although persistent tail actors can disproportionately shape collective dynamics and their behavior in LLM societies cannot be captured as fixed states.
Source: §1 · pp. 1–2Method
The paper analyzes three LLM-native extremist characteristics and introduces EXAM to control task-specific profiles, population share, placement, interaction, and measurement.
Source: §1 · p. 2Results
Collective responses across four controlled scenarios are sensitive to persistent extremists, with observed shifts varying by backbone, extremist share, and interaction setting.
Source: §1 · p. 2Takeaways & Limitations
The findings indicate that tail-agent composition is an important design factor in the tested LLM-based social simulations, alongside backbone choice, interaction structure, and measurement design.
Source: §5 · p. 8LLM agents are approximate proxies for social actors, so translating simulated attitude drift into causal evidence about real human societies remains a challenge.
Source: Limitations · p. 9
Abstract
from arXiv · showhide
Large language model (LLM) agents increasingly serve as computational actors in multi-agent social simulations. While existing work emphasizes representative personas and average-case behavior, social science shows that persistent tail actors can disproportionately shape collective dynamics. We study this regularity in controlled LLM-based multi-agent systems (LLM-MAS). In these systems, such actors cannot be reduced to fixed scalar states: prompts, natural-language histories, and backbone generation mediate their behavior and influence. We first analyzed three properties of extremists in sociology and model the LLM extremist based on LLM-native perspective. We introduce EXAM, an EXtremist Agent Modeling framework that capable of configuring extremist agents for specific tasks and precisely controlling their population proportion, spatial distribution, interaction protocols, and measurement interfaces. Across four scenarios: congressional election, financial crisis, epidemic public opinion, and iterated prisoner's dilemma, we observe that small persistent tail groups produce measurable, backbone- and scenario-dependent collective shifts. EXAM shows how this social-science regularity manifests through language-mediated mechanisms specific to LLM-based social simulation.
1 Introduction
LLM social simulations often emphasize representative or average behavior, while social science documents persistent tail actors’ disproportionate effects on collective dynamics. The paper develops an LLM-native account and EXAM framework, then finds that persistent extremists are associated with collective shifts that vary across backbones, extremist shares, and interaction settings.
1 Introduction
- Many LLM social simulations emphasize representative personas or near-average behavior, while social science documents persistent actors’ disproportionate effects on collective dynamics.The motivating question is how other agents respond when one agent persistently acts at an extreme.Source: §1 · p. 1
- LLM agents generate behavior from textual contexts, so fixed states and explicit influence parameters cannot simply represent tail-actor regularities in LLM societies.The contexts include persona instructions, interaction memories, visible content, task prompts, and measurement interfaces.Source: §1 · p. 2
- The paper analyzes LLM extremists through stance immovability, asymmetric interaction, and behavioral extremity.It presents this as an LLM-native analysis of tail-actor regularities.Source: §1 · p. 2
- EXAM controls task-specific extremist profiles, population share, placement, interaction protocol, and measurement interface.This framework enables controlled study of tail actors in LLM societies.Source: §1 · p. 2
- Collective responses in four controlled scenarios are sensitive to persistent extremists, with shifts varying by backbone, extremist share, and interaction setting.The scenarios include congressional election, financial crisis, epidemic public opinion, and iterated prisoner’s dilemma.Source: §1 · p. 2
2 Related Work
Prior work studies LLM agents in coordinated tasks and social simulations, but systematic analysis of persistent tail agents’ effects on collective outcomes remains limited.
2.1 Multi-agent Systems
- Security and coordination research examines agent collaboration, while recent studies find that particular agents can play outsized roles in group outcomes.Systematic analysis of persistent tail agents’ effects on collective outcomes remains limited.Source: §2.1 · p. 2
2.2 Social Simulation via LLM Agents
- LLM social simulations span opinion dynamics, elections, markets, and online networks, but predominantly emphasize representative agents and aggregate behavior.EXAM instead studies tail-actor regularities when agent construction and interaction are mediated by textual contexts.Source: §2.2 · p. 2
3 Extremist Agent Simulation
The paper frames LLM extremists through tail-actor regularities, then operationalizes their behavior and studies its collective effects with EXAM, a controlled simulation framework.
3.1 LLM-native Extremist Analysis
- Tail actors are characterized by resisting social influence, exerting disproportionate influence on neighbors, and taking task-relevant extreme actions.These regularities are drawn from sociology, political science, and opinion dynamics.Source: §3.1 · p. 3
- LLM agents lack explicit stance variables and instead generate responses from textual contexts and backbone-conditioned generation, making precomputed rule-based predictions unsuitable.The same message may elicit different responses across LLMs.Source: §3.1 · p. 3
3.2 Extremist Agent Formulation
- EXAM represents a society as agents, an interaction protocol and communication topology, and a task, with agents generating responses from textual contexts.Its characterization distinguishes specified extremist behavior from relational patterns arising during interaction.Source: §3.2 · p. 3
- Extremist profiles specify persistent extreme responses or actions, while the backbone and evolving history shape their verbal realization and the responses they elicit.Opinion profiles use the lowest or highest value on relevant seven-point scales; the iterated prisoner’s dilemma profile specifies persistent defection.Source: §3.2 · p. 4
3.3 EXAM Framework
- EXAM configures task-specific extremist profiles, their population share and placement, interaction settings, and a shared measurement interface for comparing collective responses with a reference condition.The workflow specifies the scenario, constructs agents, places and interacts them, then measures and compares outcomes.Source: §3.3 · pp. 4–5
- For opinion scenarios, extremist-directed drift compares final population means with a reference condition, with positive Δ_k indicating movement toward the extremist-specified value.The mean includes all agents, including extremists whose responses remain at specified values.Source: §3.3 · p. 5
4 Experiments
Across four scenarios, the experiments test how backbone, extremist share, placement and propagation, and repeated interaction shape system-level responses. Results vary across settings: extremist-associated shifts appear in each scenario, with their magnitude and collective pattern depending on the backbone and configuration.
4 Experiments
- The experiments vary one EXAM configuration component per research question: backbone, extremist share, placement and propagation, or repeated interaction.RQ1–RQ3 measure system-level change from the initial state, while RQ4 compares rounds against a no-extremist baseline.Source: §4 · p. 5
4.1 Scenarios
- The four scenarios pair congressional elections with backbone comparisons, financial crisis with extremist-share variation, epidemic opinion with placement and propagation comparisons, and IPD with repeated pairwise play.The election task assesses voting intentions and candidate support; the financial-crisis task models reactions to defaults, hidden losses, and tightening credit; the epidemic scenario covers health information spread.Source: §4.1 · p. 5
4.2 Implementation Details
- Experiments use 104-agent populations, three-seed averages, and scenario-specific extremist profiles; five extremists are randomly placed by default unless otherwise specified.Opinion scenarios use 7-point Likert responses, while RQ4 also records per-action payoffs; simulations stop when mean absolute response change falls below 0.15 or five rounds are reached.Source: §4.2 · p. 6
4.3 Effect of Backbone Models (RQ1)
- Across backbones, all four election models drift toward extremist values, but Claude Sonnet 4.6 shows a smaller mean drift (+0.899) than GPT-5.5 (+2.782), DeepSeek-V4-Flash (+2.894), and Qwen3.6-Plus (+2.861).For three backbones, more than 77% of agents end near a pole and BC is at least 0.650; Claude instead has BC 0.540 and 41.8% near a pole.Source: §4.3 · p. 6, Table 1 · p. 7, Table 2 · p. 7
4.4 Effect of Extremist Share (RQ2)
- At 1%, 5%, and 10% extremist shares, financial-crisis row-averaged drift is 2.796, 2.830, and 2.825, respectively, with no more than 0.034 change across tested nonzero shares.Every nonzero share produces positive drift on all four displayed dimensions; the near-flat pattern is specific to this scenario and backbone, and lacks uncertainty estimates.Source: §4.4 · p. 6, Table 3 · p. 7
4.5 Effect of Placement and Propagation (RQ3)
- Across epidemic placement–propagation settings, drift from the shared pre-propagation initialization has a consistent direction on all six dimensions; Central+SIR has the largest displayed mean (+3.662), versus +3.109 to +3.372 for others.Source: §4.5 · p. 7
4.6 Repeated Strategic Interaction (RQ4)
- In the five-round IPD, extremist-agent conditions show lower cooperation and social welfare than baselines across all three backbones, with the separation persisting across rounds.GPT-5.5 cooperation is 0.830 versus a 0.954 baseline; DeepSeek-V4-Flash average per-action payoff is 1.538, more than 30% below its reported baseline.Source: §4.6 · pp. 7–8, Figure 3 · p. 8
5 Conclusion
The paper frames persistent tail behavior in LLM societies as prompt- and language-mediated, then introduces EXAM to study its collective effects. Across four scenarios, it finds that tail-agent composition is an important design factor alongside backbone choice, interaction structure, and measurement design.
5 Conclusion
- Persistent tail behavior in LLM societies is realized through prompts and natural-language interaction rather than explicit symbolic influence rules.The paper first analyzes LLM-native extremist characteristics and models them.Source: §5 · p. 8
- EXAM anchors extremist agents and examines collective phenomena across settings including backbones, injection ratios, and propagation strategies.The study applies the framework across four scenarios.Source: §5 · p. 8
- Tail-agent composition is an important design factor in the tested LLM-based social simulations, alongside backbone choice, interaction structure, and measurement design.Source: §5 · p. 8
Limitations
The study's findings are bounded by the limits of LLM agents as proxies for people, prompt-based extremist profiles, and a restricted empirical scope.
Limitations
- LLM agents are approximate proxies whose responses reflect pretraining, alignment, safety policies, instruction following, and prompt phrasing.Translating simulated attitude drift into causal evidence about real human societies remains a challenge for future work.Source: Limitations · p. 9
- Prompt-based extremist profiles may make observed drift depend on profile phrasing, rhetorical intensity, anchor design, and task framing.The authors say safety guardrails should be re-examined when EXAM extends to other scenarios or backbones.Source: Limitations · p. 9
- Experiments cover limited scenarios, a fixed population size, specific network structures, and selected LLM backbones.Opinion scenarios use a single no-extremist reference survey and do not estimate its repeated-sampling variation; broader robustness tests remain future work.Source: Limitations · p. 9
Potential Risks
The paper identifies dual-use and overgeneralization risks, while its appendices specify extremist profiles, ordinary-agent prompts, and scenario-specific response dimensions.
Potential Risks
- EXAM is designed to stress-test simulated-system robustness, but similar methods could optimize extremist prompts or identify high-impact injection points.The authors also warn that reading simulation results as direct evidence about human societies could reinforce misleading assumptions.Source: Potential Risks · p. 9
A.1 Prompt for RQ1
- The RQ1 profile shapes a fanatical outsider-candidate supporter who spreads election-fraud narratives and campaigns against the establishment.Source: §A.1 · p. 12
A.2 Prompt for RQ2
- The RQ2 profile depicts a maximally extreme subprime-crisis panic agent advocating bank runs, market sell-offs, and alarming economic rumors.Source: §A.2 · p. 12
A.3 Prompt for RQ3
- The RQ3 profile depicts a public-health antagonist rejecting preventive measures and spreading unverified medical disinformation.Source: §A.3 · p. 12
A.4 Prompt for RQ4
- The RQ4 profile depicts an exploitative hardliner who refuses cooperation and retaliates to maximize personal payoff at social welfare's expense.Source: §A.4 · p. 12
B Ordinary-Agent Prompt
- Ordinary agents receive individual population-derived personas and a directionally neutral measurement interface, without an anchored profile.They remain neutral toward the questions and use the same metrics and output format across scenarios.Source: B Ordinary-Agent Prompt · p. 12
C Metrics
- The metrics section defines scenario-specific response dimensions to quantify behaviors and attitudes associated with each profile.Source: C Metrics · p. 12
C.1 Metrics for RQ1
The metrics quantify election-related attitudes and population structure, financial-crisis responses, and epidemic-opinion responses across specified dimensions.
C.1 Metrics for RQ1
- RQ1 uses six election-related behavioral dimensions and aggregate indicators of polarization, bimodality, extremist/non-extremist separation, and non-extremist dispersion.Ratings use a 1–7 scale across 104 agents; the indicators are computed per dimension and averaged over six dimensions, with dispersion excluding extremists.Source: §C.1 · pp. 12–13
C.2 Metrics for RQ2
- RQ2 measures six financial-crisis responses, while the main text discusses four discriminative dimensions: bank-run intention, panic selling, rumor sharing, and economic doom belief.Trust in financial institutions and mortgage-risk concern are also measured but contribute little additional signal across tested extremist-agent proportions.Source: §C.2 · pp. 13–14
C.3 Metrics for RQ3
- RQ3 compares epidemic-opinion responses across placement and propagation settings using vaccination willingness, mask compliance, expert trust, misinformation sharing, policy compliance, and personal-freedom concern.Source: §C.3 · p. 14
D Round-by-Round Trajectories
Round-by-round trajectories differ across scenarios and backbones: some converge quickly, while financial-crisis drift continues across the five-round cap. In the epidemic scenario, most drift appears immediately.
D Round-by-Round Trajectories
- Round 0 is the reference state with ∆=0; trajectories report mean extremist-directed drift averaged across six dimensions in RQ1 and RQ3 and four displayed dimensions in RQ2.The final round matches the corresponding main-table value.Source: D Round-by-Round Trajectories · p. 14
- Claude Sonnet 4.6’s election drift falls from +2.534 after round 1 to +0.899 at convergence in round 5, while the other three backbones reach their final shifts after round 1.For Claude, non-extremist drift also falls from +2.455 to +0.738; the largest drop occurs in round 2.Source: D Round-by-Round Trajectories · pp. 14–15
- In the financial-crisis scenario, drift rises throughout five rounds; 1- and 5-extremist conditions still change by 0.21 and 0.16 between rounds 4 and 5.The gap among the three extremist-count conditions shrinks from 0.21 at round 1 to 0.03 at round 5.Source: D Round-by-Round Trajectories · p. 15
- In the epidemic scenario, over 96% of final drift appears in round 1, and all six conditions converge within two or three rounds.Central+SIR has the largest drift at every round, followed by Cluster+SIR.Source: D Round-by-Round Trajectories · p. 15
E Illustrative IPD Trace
The illustrative IPD trace shows extremists holding to defection while non-extremists update actions and memories in response to their repeated interactions.
E Illustrative IPD Trace
- The section illustrates the three modeled properties through five extremist–non-extremist pairs and a five-round trace for one pair.Table 8 summarizes the pairs; Table 9 presents the trace.Source: E Illustrative IPD Trace · p. 15
- Across five illustrated pairs and five rounds, extremists choose D in all 25 decisions, including after opponents cooperate or retaliate.Their cooperation rate is 0, matching the profile’s specified unconditional-defection strategy.Source: E Illustrative IPD Trace · p. 15
- Non-extremist agents continue updating actions and memories, with illustrated memories recording greater caution after repeated defection.The extremist action remains anchored while the opponent’s behavior and memory change.Source: E Illustrative IPD Trace · p. 15
F Non-Extremist Drift and the Compositional Term
The appendix separates system-level drift into non-extremist change and an extremist-composition term, then describes the shared network and interaction contexts used across scenarios.
F Non-Extremist Drift and the Compositional Term
- System-level drift includes all agents and decomposes exactly into non-extremist drift plus a compositional term because extremist responses are fixed.The compositional term is constant within a run, so system-level and non-extremist drift share a round-level trajectory up to a fixed offset.Source: F Non-Extremist Drift and the… · p. 15
- Non-extremist agents contribute 88–99% of system-level drift in RQ2 and RQ3, and about 93% in RQ1 for GPT-5.5, DeepSeek-V4-Flash, and Qwen3.6-Plus, versus 78% for Claude Sonnet 4.6.Under non-extremist drift, Claude remains least affected and Central+SIR remains the largest placement–propagation setting.Source: F Non-Extremist Drift and the… · pp. 15–16
- In RQ2, the compositional term rises from 0.033 at 1% extremists to 0.329 at 10%, while non-extremist drift is 2.790, 2.800, and 2.761 at 1%, 5%, and 10%.The non-extremist values differ by at most 0.039 and do not increase with extremist share; the slight system-level increase from 1% to 5% is compositional.Source: F Non-Extremist Drift and the… · p. 16
- Removing extremist responses changes PolRate by at most 0.03 and BC by at most 0.02; the three other backbones remain above the 0.555 bimodality threshold while Claude remains below.ID and Stdn are unaffected by removal because their definitions use the extremist/non-extremist partition.Source: F Non-Extremist Drift and the… · p. 16
G Network, Agent Context, and Interaction Protocol
- All four scenarios use an undirected small-world network of 104 agents, with six nearest neighbors per agent and edge-rewiring probability 0.2.The network has 312 edges and mean degree 6, defining neighbors, placement degrees, propagation paths, and IPD opponents.Source: G Network, Agent Context, and… · p. 16
- In opinion scenarios, non-extremists receive persona, social-environment, propagation, and diary context, then add a round-tagged diary entry; extremists use their profile and measurement prompt without a diary.The diary accumulates across rounds and enters the agent’s next-round context.Source: G Network, Agent Context, and… · pp. 16–17
- In IPD, each network edge hosts a repeated game across five rounds, with simultaneous choices; non-extremists use opponent identity, recent game records, and private memory, while extremists do not keep memory.Non-extremists can recognize a specific extremist opponent and condition later actions on that opponent’s record.Source: G Network, Agent Context, and… · pp. 17–18
H Propagation Models
The propagation models begin with extremist agents as persistent sources and determine which non-extremists are reached and how strongly they are exposed.
H Propagation Models
- Both propagation models run over the agent network, start from extremist agents, and use them as narrative sources throughout the simulation.The models determine which non-extremists are reached and their exposure strength.Source: H Propagation Models · p. 18
- In SI, only extremists are initially infected; infection spreads from infected agents to susceptible neighbors and remains permanent, with exposure accumulating through repeated contact.Once reached, an agent stays infected and can pass the narrative onward.Source: H Propagation Models · p. 18
- SIR adds recovery: infected agents infect susceptible neighbors with probability β=0.45 and non-extremist infected agents recover with probability γ=0.1 by default.Recovered agents stop spreading and cannot be reinfected; extremists never recover, and final infection status determines exposure strength.Source: H Propagation Models · p. 18