Can a game of hidden loyalties teach AI to spot deception?

How should an AI assistant respond when someone offers a plausible explanation that serves a hidden agenda? Checking individual facts may not be enough: a speaker can selectively disclose accurate information, redirect suspicion or exaggerate their contribution without telling a straightforward lie.

In an arXiv preprint, Fardin Saad and colleagues investigate this problem through Avalon, a game built around concealed loyalties. Their dataset, AVCORP, pairs dialogue with communication-tactic labels and written analyses of players’ possible beliefs and intentions. Training improved a language model’s performance within this setting, but the study does not establish a general-purpose defense against deception.

A controlled setting for hidden intentions

The researchers use a modified five-player game with three Good players and two Evil players. Teams undertake quests, submitting anonymous pass or fail cards. Good players always pass; Evil players can sabotage a quest or pass to preserve their cover. Discussions give players opportunities to interpret results, defend themselves and accuse others.

One Good player becomes the Investigator, tasked with identifying the two opponents among the other four players. This creates a useful distinction between uncertainty and certainty. A failed quest usually implicates several possible players. But if the Investigator joins just one other player on a failed quest, that partner must be Evil.

The setup is deliberately simplified. Special roles are removed, quest outcomes are selected in advance, and every proposed team receives enough votes to proceed. These choices make dataset construction manageable, but exclude some strategic behavior found in ordinary play.

Connecting statements to possible motives

AVCORP contains 5,000 utterances across 250 games: 4,000 statements with tactic annotations and 1,000 Investigator statements accompanied by structured reasoning traces. The dialogue is model-generated, with human annotations retained for 25 opening-round seed samples.

A taxonomy organizes 37 tactics by how information is presented and what social goal it serves. It includes honest evidence sharing and sincere mistakes alongside cherry-picking, misdirection and fabrication. That breadth matters: an inaccurate statement need not be intentional deception, while a truthful statement can still mislead.

The reasoning traces consider competing explanations for each player’s behavior, assign suspicion levels and describe possible beliefs. This is the study’s operational use of “theory of mind”: reasoning about what another participant believes and what they want others to believe. It is not evidence that the detector has human-like mental understanding.

Separate models generate and judge candidate dialogue and traces. Although trace generators do not receive the hidden roles, the final trace-selection judge does, using them to break ties. Two human annotators, blinded to the roles, selected the same preferred trace on 97 of 100 sampled pairs. That supports agreement about trace quality, not independent confirmation of every inferred motive.

What training changed

The team trained Qwen3-8B on 225 games and tested it on 25 separate games. Training first taught the model to imitate annotated examples, then used reinforcement learning to reward selected output properties and correct deductions. Some variants also learned to name communication tactics.

The strongest configuration identified both Evil players, without falsely naming anyone else, in 18 of 25 test games: 72%, compared with 48% for the untrained model using the corresponding tactic prompt. Claude Opus 5.5 also resolved 18 games; GPT-5.6 Sol resolved 16, Gemini 3.1 Pro 14 and DeepSeek-V4-Pro 12. These are small-sample task comparisons, not general rankings. Claude also required reworded instructions after refusing the original prompt.

Reward design mattered. Revised rewards assessed whether role judgments were correct and whether Evil players attracted more suspicion than Good players. With the original rewards, reinforcement learning sometimes reduced exact identification despite improving F1, a score balancing correct accusations against missed opponents. Naming extra suspects can earn partial credit without solving the game.

Human dialogue exposes the limits

The researchers also tested 20 existing games played by six humans, including special roles absent from training. Every trained configuration improved pooled F1 across all rounds relative to its matching untrained baseline. However, exact final identification did not improve consistently. The best synthetic-game detector resolved 35% of human games; the untrained trace-prompt baseline resolved 40%.

Training also supplied judge-selected reference traces from earlier rounds, whereas evaluation used the detector’s own previous outputs. These reference traces were not uniformly correct: their final deductions identified the exact Evil pair in 233 of 250 corpus games, including 23 of the 25 held-out games. The authors explicitly avoid using reference traces at test time because these can reveal answers. Nevertheless, the mismatch leaves room for early mistakes to compound.

AVCORP therefore offers a controlled resource for studying deception detection, not a demonstrated safeguard for deployed assistants. Its synthetic English dialogue, small evaluations and game-specific rules constrain the conclusions. Transfer to deception outside Avalon remains untested.