Does agent architecture determine susceptibility to dark patterns?

DECEPTICON's third research question tests whether "existing defenses make agents robust against dark patterns" and finds that "existing agent defenses such as structured system prompts and guardrail models, only partially reduce dark pattern effectiveness, and are inconsistently effective across different attack types." Comparing agent scaffolds, the paper reports "no significant differences in DP rates between all Simple agents," while "standalone agents demonstrate greater resistance to dark patterns" — leading it to conclude that "the vulnerabilities to dark patterns are primarily a function of the underlying LLMs rather than the agents' architectural scaffolding." Modality matters only slightly: coordinate-based agents (Magnitude + Claude Sonnet 4) show a 68.3% dark-pattern (DP) success rate against a 74.7% average for Set-of-Marks-based agents, a gap the paper calls "relatively small."

The paper locates the failure in reasoning rather than perception: inspecting agent chains-of-thought, it finds that "errors of the third category (erroneous reasoning...) predominate, indicating that reasoning misalignment is core to the weakness of LLMs to dark patterns." Guardrail-model agents detect dark patterns at a higher rate than prompting-based defenses, but detection does not translate into resistance — the paper notes chains-of-thought "indicating ignorance of the dark pattern or confusion of instruction authority" even after flagging it. Because the weakness sits in "the underlying LLMs" rather than in prompting or orchestration, scaffold- or system-prompt-level fixes can only patch around a problem that originates inside the model, which the paper argues points toward "building adversarial robustness during agent post-training" instead.

This cuts against the premise of Can structural design patterns block prompt injection attacks?, which achieves provable resistance to prompt injection by restricting the scaffold's action space — a structural fix that works because the exploit it targets (untrusted input reaching a consequential action) is a control-flow property the scaffold can own. DECEPTICON's dark patterns instead corrupt the LLM's own reasoning about legitimate-looking content, which scaffold-level restriction does not reach, so the two findings mark out where architectural defenses stop being sufficient. The result also adds a concrete cause to the detection/attribution/arms-race difficulties in What makes detecting AI agent traps fundamentally difficult?: even when a guardrail model detects the pattern, the underlying reasoning failure persists.

The finding that scaffolding barely matters comes from comparing a specific set of "Simple agents" against "standalone agents" on this benchmark, not a survey of all possible scaffold designs, and the paper does not test the post-training interventions it recommends — it only argues for them by elimination, after showing that two prompt- and architecture-level defenses underperform. Whether post-training robustness generalizes beyond DECEPTICON's own dark-pattern set is left open.