Jul 1, 2024

Werewolf Benchmark

Luhan Mikaelson, Zach Nguyen, Andy Liu, Jord Nguyen, Akash Kundu

In this work we put forward a benchmark to quantitatively measure the level of strategic deception in LLMs using the Werewolf game. We run 6 different setups for a cumulative sum of 500 games with GPT and Claude agents. We demonstrate that state-of-the-art models perform no better than the random baseline. Our findings also show no significant improvement in winning rate with two werewolves instead of one. This demonstrates that the SOTA models are still incapable of collaborative deception.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

Excellent and thorough work - very well explained. Very interesting comparison of GPT vvs Claude - would be good to explore further. Dividing the results into the different types of deceptive behaviour is very informative, although it might have been good to go into a bit more detail about what each category means/give examples of what they might look like in different scenarios. As a side note, I’d be interested to see similar breakdowns of types of deceptive behaviour by roles in human data, and relating this a bit more explicitly to game strategies.

This was a great read and a thorough exploration of the topic. I really enjoy when you see conflicting statistics that you went ahead and did manual investigation of the games as well. Too few in ML benchmarks do this to a proper degree. I would be interested to see comparisons to human baselines as well as more reasoning about how the different categories of deception might map to real-world scenarios. Similarly, I'm curious to see whether we can have highly capable agents in Villager roles in the game that are incapable of any deception.

Possibly fine-tune a model against this deceptive behavior. Of course, that might mean the Villager loses out to deceptive agents and it could be a general comment for real-world applicability that if we construct multi-agent scenarios where all agents are truthful and can trust each other, this would lead to a Villager like that winning due to a Werewolf losing out because of truthfulness.
Would also be interesting to see a Werewolf being completely honest but truthful Villagers not knowing whether they work with other truthful agents, leading to scenarios where they might not trust the other agent despite it saying it's a Werewolf. As far as I understand, that would e.g. cause a Villager to identify a Werewolf as a minion (not 100% sure about the rules).

Great work! Separately, I'd highly recommend you add a PR to the README of the Werewolf-gpt repo to add a heading called “Research” with your piece of research with a very quick summary. Then you can see if the author might be interested in adding it! I can also help with that if you'd like.

Cite this work

@misc {

title={

Werewolf Benchmark

},

author={

Luhan Mikaelson, Zach Nguyen, Andy Liu, Jord Nguyen, Akash Kundu

},

date={

7/1/24

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.