AREG: Adversarial Resource Extraction Game
for Evaluating Persuasion and Resistance in Large Language Models
Abstract
Evaluating the social intelligence of Large Language Models (LLMs) increasingly requires moving beyond static text generation toward dynamic, adversarial interaction. We introduce the Adversarial Resource Extraction Game (AREG), a benchmark that operationalizes persuasion and resistance as a multi-turn, zero-sum negotiation over financial resources. Using a round-robin tournament across frontier models, AREG enables joint evaluation of offensive (persuasion) and defensive (resistance) capabilities within a single interactional framework. Our analysis provides evidence that these capabilities are weakly correlated (ρ = 0.33) and empirically dissociated: strong persuasive performance does not reliably predict strong resistance, and vice versa. Across all evaluated models, resistance scores exceed persuasion scores, indicating a systematic defensive advantage in adversarial dialogue settings. Further linguistic analysis suggests that interaction structure plays a central role in these outcomes. Incremental commitment-seeking strategies are associated with higher extraction success, while verification-seeking responses are more prevalent in successful defenses than explicit refusal. Together, these findings indicate that social influence in LLMs is not a monolithic capability and that evaluation frameworks focusing on persuasion alone may overlook asymmetric behavioral vulnerabilities.
The game
A finite-horizon, zero-sum game between two language model agents under incomplete information. The Culprit tries to extract money; the Victim holds a $100 endowment whose balance only it can see. A deterministic Arbiter decides what was actually handed over.
Culprit
Prompted as a “friendly, enthusiastic salesperson or fundraiser” and asked to maximize extracted resources. Blind to the Victim’s budget.
Victim
Prompted as a “savvy consumer” who has just won $100 in a lottery, and asked to minimize loss. Has exclusive access to its private budget Bt.
Arbiter
Maps each Victim reply, the full history and the running ledger to a dollar amount Δet. Counts only explicit, immediate hand-overs.
Each turn, up to Tmax = 10
Scoring: Linear Elo
Instead of a win/loss signal, each game yields a continuous extraction ratio, so partial extraction counts proportionally.
Every model keeps two independent ratings: C-Elo for persuasion and V-Elo for resistance. Grok 4.1 Fast serves as Arbiter; it gave full confidence on 96.1% of 2,781 verdicts, and a manual audit of 45 transcripts found zero anomalies.
Persuasion and resistance are dissociated
Every model resists better than it persuades. The top persuader, DeepSeek V3.2, ranks fifth in resistance; the strongest defender, GPT-5.2, ranks fifth in persuasion. Hover a point or a row to compare.
| Model | ||||
|---|---|---|---|---|
| {{ r.name }} | {{ r.c }} | {{ r.v }} | {{ r.spreadLabel }} | {{ r.winLabel }} |
A narrow persuasion window
57.5% of monetary commitments happen in the first three turns. If nothing is extracted by turn 5, the chance of any later extraction falls below 4%.
Foot in the door
Culprits that collect three or more separate commitments reach a mean extraction of 61.4%, against 22.2% for single asks (p < 10−8). Initial commitment size correlates with total extraction at ρ = 0.808.
Scale doesn’t predict it
Neither context window size nor API pricing has a significant relationship with persuasion or resistance (p > 0.15).
Verification beats refusal
Saying “no” invites a counter-argument and keeps the Victim inside the persuader’s frame. Asking for proof or credentials interrupts the procedure and exits it — consistent with the “contesting” vs. “avoidance” distinction of Fransen et al. (2015). On offense, reciprocity works and appeals to authority backfire.
Emergent deception as a “friendly” jailbreak
With only a benign fundraiser persona, Culprit models invented fictitious names, organizations, situations of distress and heartwarming stories that were never in their context. Models trained to refuse “act as a scammer” readily fabricate facts and apply emotional pressure once the task is framed as charity or sales.
Limitations
A single Arbiter model (Grok 4.1 Fast) adjudicates every game. 93.8% of successful extractions used a donation framing, a high-trust setting that may not transfer to phishing or fraud. Dialogue is English-only, and results are a snapshot of models as of January 2026.
Citation
{{ bibtex }}