I Want to Break Free! Persuasion and Anti-Social Behavior of LLMs in Multi-Agent Settings with Social Hierarchy

TL;DR

This paper addresses the safety and behavior of autonomous LLM agents operating in social hierarchies. It introduces zAImbardo to simulate one guard vs one prisoner interactions across 240 scenarios and 2,400 conversations among six LLMs, measuring persuasion and anti-social behaviors using human annotations and toxicity/harassment proxies. Key findings show that the prisoner's goal and agent personas strongly influence persuasion, while anti-social behavior is largely driven by the guard's personality and can arise without explicit prompts; Granger-causality tests indicate no robust cross-agent predictive dynamics. The work highlights AI-safety implications for multi-agent systems and advocates for proactive oversight, governance, and mitigation strategies as AI agents increasingly interact autonomously.

Abstract

As LLM-based agents become increasingly autonomous and will more freely interact with each other, studying the interplay among them becomes crucial to anticipate emergent phenomena and potential risks. In this work, we provide an in-depth analysis of the interactions among agents within a simulated hierarchical social environment, drawing inspiration from the Stanford Prison Experiment. Leveraging 2,400 conversations across six LLMs (i.e., LLama3, Orca2, Command-r, Mixtral, Mistral2, and gpt4.1) and 240 experimental scenarios, we analyze persuasion and anti-social behavior between a guard and a prisoner agent with differing objectives. We first document model-specific conversational failures in this multi-agent power dynamic context, thereby narrowing our analytic sample to 1,600 conversations. Among models demonstrating successful interaction, we find that goal setting significantly influences persuasiveness but not anti-social behavior. Moreover, agent personas, especially the guard's, substantially impact both successful persuasion by the prisoner and the manifestation of anti-social actions. Notably, we observe the emergence of anti-social conduct even in absence of explicit negative personality prompts. These results have important implications for the development of interactive LLM agents and the ongoing discussion of their societal impact.

Figures (38)

• Figure 1: Visual depiction of the architecture of our experimental framework based on our zAImbardo toolkit. Top left: a mock conversation between the guard and the prisoner agent. Bottom left: the list of the LLMs employed in our experiments. Right: Prompt structure for prison and guard agents. Prompt sections describing agent's personality and goal are distinct for each agent. Sections highlighting communication rules and environment description are shared, together with research oversight and section describing potential risks of the experiment, with the last two being optional.
• Figure 2: Left: Top row shows the distribution (in %) of persuasion outcomes, divided by goal, excluding fatally flawed conversations; bottom row shows when the goal is achieved (1st 1/3 refers to the first 3 turns, 2nd 1/3 refers to turns 4-6, 3rd 1/3 refers to turns 7-9), by goal type. Right: Odds ratios (with 95% CI) for the logistic regression having as $Y$ whether the prisoner reached its goal (conditional on having tried to achieve it). Dashed line indicates OR=1 (no effect on outcome).
• Figure 3: Drivers of Toxicity per conversation ($N$=1,381). All estimated models are OLS.
• Figure 4: Distribution of overall toxicity (% of toxic messages in each conversation) across persuasion outcomes, LLMs and goals ($N$=1,381). The plot shows the average % of toxic messages along with the standard deviation per each setting for overall toxicity, harassment and violence.
• Figure 5: Average toxicity per scenario. each scenario refers to the combination of goal, prisoner personality and guard personality. In each subplot, we report the % of toxic messages according to ToxiGen-Roberta per LLM and agent type. Vertical bars indicate the standard deviation.