In a spy game, why can't an AI just guess who's lying when everyone knows everything?

This explores how a spy-style game, where one player secretly holds a different goal or knowledge, is set up so that finding the spy actually tests something. The corpus has no note describing a specific spy identification task, so what follows is what the nearest material says about the design principle, not a description of one benchmark's rules.

The core ingredient is private information. Research on social simulation finds that LLMs look socially skilled when one model plays every side of a conversation and knows everything. They fail systematically once each agent holds information the others lack Why do LLMs fail when simulating agents with private information?. In the omniscient setup, models skip the grounding work of tracking who knows what. A spy task works as a test because the asymmetry removes that shortcut. Nobody can succeed by reading everyone's mind.

The second ingredient is a channel that is public but incomplete. One note describes compromised agents whose objective-dependent reasoning stays largely invisible in public 'cheap talk', the only thing other players see Can we detect objective-misaligned agents from their public speech alone?. That is the spy-game structure: a hidden goal behind visible talk. The note is thin on evidence, though. It gives no detection rates, doesn't say who does the detecting (other players, an LLM judge, or a statistical test), and isn't checked against real transcripts. It names the design but doesn't show that identification works.

The third ingredient is that the asymmetry has to leak somewhere, and it helps if the game has repeated rounds. In an idealized setting, repeated low-stakes probes can push classification error to zero, provided the two types respond with different statistics and each response is independent Can repeated quiet probes separate decoys from genuine objects?. Applied to a spy, they are catchable across rounds if their behavior differs even slightly from honest players'. A spy who adapts breaks that guarantee. A related warning is that harm can hide when every step looks benign alone and only the composition gives it away Can task decomposition hide harmful intent across agents?. That suggests judging a spy's statements one at a time is weaker than judging the whole conversation.

The flip side is that the asymmetry making a spy task interesting is one that alignment researchers try to remove. Self-Other Overlap fine-tuning shrinks the gap between how a model represents itself and how it represents others. It cut deceptive responses from 73–100% down to 2–17% Can aligning self-other representations reduce AI deception?. A convincing spy has to keep that gap open.