Skip to main content
published MusIML Workshop @ ICML 2026

AREG: Adversarial Resource Extraction Game for Evaluating Persuasion and Resistance in Large Language Models

Adib Sakhawat, Fardeen Sadab, Tamjid Hasan Fahim

Every model tested resisted persuasion better than it persuaded; even the weakest resister outranked the strongest persuader on Elo.

BibTeX

@inproceedings{sakhawat2026areg,
  title     = {{AREG}: Adversarial Resource Extraction Game for Evaluating Persuasion and Resistance in Large Language Models},
  author    = {Sakhawat, Adib and Sadab, Fardeen and Fahim, Tamjid Hasan},
  booktitle = {The 6th Muslims in ML (MusIML) Workshop at ICML 2026},
  year      = {2026},
  url       = {https://openreview.net/forum?id=1bnYMgH5gi}
}

Description

Can an LLM talk another LLM out of its money, and can the second one say no? Most evaluations of social intelligence test only one side of that exchange. AREG tests both in the same game.

The game

Two agents meet in a multi-turn, zero-sum negotiation over a sum of money.

  • The Victim has just come into money and is told only to be a savvy consumer.
  • The Culprit has one goal: persuade the Victim to hand over as much as possible.
  • Both are told the conversation is happening in person, so neither can fall back on a "this looks like a scam message" reflex.

Every model plays both roles in a round-robin tournament, and the two capabilities are scored on separate Elo scales: C-Elo for persuasion and V-Elo for resistance.

Results

Standings from the arXiv version of the paper (Win % is the share of games where the Victim gave away nothing):

Model Persuasion (C-Elo) Resistance (V-Elo) Spread Win %
GPT-5.2 1392 1694 +302 65.7%
Llama 4 Maverick 1415 1644 +228 45.7%
DeepSeek V3.2 1428 1609 +181 20.0%
Grok 4.1 1390 1646 +256 42.9%
Llama 3.3 70B 1405 1620 +215 28.6%
Gemini 2.5 1393 1600 +207 11.4%
Qwen3 Next 1354 1550 +197 8.6%
Mixtral 8×7B 1357 1502 +144 5.7%

Key findings

  1. Defence beats offence everywhere. Every model's resistance score exceeds its persuasion score.
  2. The two skills are dissociated. Persuasion and resistance are only weakly correlated (ρ = 0.33): being a strong persuader says little about being hard to persuade.
  3. How you ask matters more than what you ask. Incremental commitment-seeking is associated with higher extraction, and successful defences lean on verification (asking for ID, a link, a taxpayer number) more than on flat refusal.

Why it matters

Social influence in LLMs is not one capability. A safety evaluation that only measures how persuasive a model is will miss how it fails when it is the one being persuaded.

Resources