Technical Summary: Auditing Belief-Conditioned LLM Agents in Hidden-Information Social Deduction Games

Problem Statement

Evaluating Large Language Model (LLM) agents in hidden-information, multi-agent environments is challenging because final outcomes (e.g., win/loss) are high-variance signals that rarely reveal the causal mechanisms behind agent decisions. In social deduction games like Werewolf, agents operate under partial observability, must reason about private information, interpret deceptive communication, and make decisions where quality is only clear post-hoc. Standard black-box evaluation fails to distinguish whether a failure stems from missing evidence, poor belief tracking, prompt-induced behavior, infrastructure load, or a valid strategic override. There is a need for an evaluation infrastructure that makes agent cognition observable, auditable, and replayable.

Methodology

The authors implement a 9-player Werewolf environment designed as an auditable experimental platform. The system enforces strict code-level information isolation, ensuring agents only receive public events and role-specific private observations, while the game engine retains ground-truth role assignments for post-hoc evaluation.

The framework consists of five core components:

1. Auditable Belief Layer: An external system maintains a belief state (role probabilities for all players) updated from structured game events. This layer operates in two modes:
   • Shadow Mode: Beliefs are maintained for evaluation only, not shown to the agent.
   • Active Mode: Belief summaries (e.g., top suspected werewolves) are injected into the agent's context as decision support.
2. Factorized Belief Updates: Instead of a monolithic rule table, belief updates are decomposed into interpretable factors: event type (base weight), evidence direction, and source credibility. Updates occur in log-odds space to ensure stability and traceability.
3. Deviation-Guided Diagnosis: The system compares the action suggested by the belief state against the LLM's actual action. Deviations are classified conceptually as harmful (ignoring useful signals), justified (override based on other context), or strategic (intentional deception).
4. Defensive Offline Improvement Loop: Strategy updates are not applied after single games. Instead, the system aggregates batches of games, mines "bad cases" (e.g., harmful deviations, wrong poison actions), generates candidate insights, and requires human review before versioning any prompt or rule changes.
5. Strict Information Isolation: The context builder ensures agents receive only legal, role-visible data. Ground truth is never used during runtime, only for post-game metric computation.

The evaluation involved 1,080 frozen games across multiple experimental arms, including belief-disabled ablations, active-belief conditions, camp-restricted variants (belief given only to good or bad teams), kernel ablations (additive vs. factorized), and high-load replicas.

Key Contributions

1. Auditable Framework: A system for hidden-information games featuring strict information isolation, structured event logging, replayable state, and post-game evaluation.
2. External Belief Layer: A mechanism for hidden-role reasoning that includes shadow/active variants, factorized updates, and traceable snapshots, serving as a cognitive baseline rather than a hard controller.
3. Deviation Instrumentation: A conceptual taxonomy for post-hoc inspection of belief-action deviations (harmful, justified, strategic) and a workflow for large-scale automatic classification.
4. Defensive Offline Loop: A workflow that mines bad cases from game batches to support reviewed, versioned strategy updates, avoiding the risks of single-game online learning.
5. Empirical Evidence: A large-scale evaluation (1,080 games) demonstrating the association between active belief and improved outcomes, while simultaneously using the audit layer to diagnose low consistency and reject unreliable interventions.

Results

The study presents a coherent but guarded set of findings from a 200-seed paired A/B comparison (A0: belief-disabled vs. A1: active-belief):

• Outcome Shift: The active-belief condition is associated with a significantly higher good-side win rate, rising from 0.205 to 0.390 (paired McNemar $\chi^2 = 16.4, p < 0.001$).
• Error Reduction: The active-belief condition co-occurs with a reduction in irreversible "wrong poison" errors by the Witch role (wrong poison rate dropped from 76% to 36%).
• Low Direct Consistency: Despite the outcome improvement, direct action–belief consistency is low (≈0.21). Agents frequently deviate from the top belief recommendation.
• Camp-Restricted Anomaly: Giving belief only to the werewolves improved the good-side win rate (0.313) more than giving it only to the good side (0.253). This contradicts a simple "holder-benefit" hypothesis where belief improves the inference of the agent holding it.
• Failed Intervention: A "forced consumption" policy, which attempted to mandate alignment with belief, failed to improve win rates and only marginally increased consistency. This suggests that forcing agents to follow flat or weak belief signals is counterproductive.
• Load Robustness: High-concurrency replicas showed no increase in LLM errors or context budget violations, confirming that the observed outcome shifts were not artifacts of infrastructure load.

Significance and Claims

The paper positions external belief in high-noise hidden-information games primarily as an auditable cognitive baseline rather than a proven controller of play.

• Measurability over Optimality: The framework's primary value is making agent decisions measurable and replayable. It transforms opaque behavior into evidence that can be contested and analyzed.
• Diagnosis of Mechanism: The authors explicitly state they do not attribute the win-rate shift specifically to the quality of belief content. Due to the low action–belief consistency and the anomalous camp-restricted results, the causal mechanism remains unresolved. The effect may stem from the presence of the belief section altering agent behavior or prompt structure, rather than the consumption of the belief signal itself.
• Safety in Iteration: The framework enables safer iteration by allowing researchers to separate strategy effects from infrastructure confounds (like load-induced failures) and to reject interventions (like forced consumption) with evidence.
• Generalizability: While tested in Werewolf, the underlying pattern applies to any adversarial, partially observable setting where final outcomes are noisy and decisions require interpretation. The authors argue that before such agents can be safely improved, their cognition must be made observable and contestable through an audit infrastructure.

The paper concludes that evaluation infrastructure is a first-class component of hidden-information LLM agents, necessary to distinguish between weak inference, strategic overrides, and system failures.