Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An adversary trained on a surrogate model can systematically steer LLM decisions, and GPT-4, Gemini-1.5, and DeepSeek-V3 are the most predictable targets.

desk verdict A useful, honestly-labeled adaptation of an existing adversarial framework to LLMs, with plausible model-specific findings but a missing control in the headline bandit result and one clear statistics slip. read the letter →

arxiv 2505.13195 v1 pith:AZBDYHXM submitted 2025-05-19 cs.AI

Lili Zhang , Haomiaomiao Wang , Long Cheng , Libao Deng , Tomas Ward This is my paper · ORCID
classification cs.AI
keywords adversarialevaluationLLMdecision-makingtwo-armedbanditmulti-roundtrustgameexploration-exploitationrewardmanipulationAIalignmentdeepQ-learning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a reinforcement-learning adversary, trained only against a recurrent-network surrogate of each LLM's choices, can then steer the real LLM in two interactive tasks: a two-armed bandit and a ten-round trust game. The headline result is that steering works: in the bandit, target-option selection rises to 68% (GPT-3.5), 93% (GPT-4), 94% (Gemini-1.5), and 95% (DeepSeek-V3), from baselines of 30–62%. The authors interpret the behavioral signature as model-specific vulnerability: GPT-4, Gemini-1.5, and DeepSeek-V3 commit to one option and rarely switch after losses or rewards, while GPT-3.5 switches more and becomes risk-seeking in the trust game, where its MAX adversary earns the largest gap (377 units). They present the framework as a diagnostic for alignment rather than a performance benchmark.

What carries the argument

The learner-adversary loop carries the argument. A recurrent neural network with a softmax output layer is trained to predict each LLM's next action from previous actions, rewards, observations, and its own hidden state; that hidden state is treated as a summary of the LLM's learning history and is handed to a deep Q-learning adversary as the state of the environment. The adversary selects the reward and next observation shown to the LLM, and is rewarded whenever the LLM takes the target action (bandit) or according to trustee earnings and fairness (trust game). The critical last step substitutes the live LLM's actions for the learner's choices in the same loop, which is what lets the authors attribute the observed target-selection increases to the adversary's policy.

What would settle it

Compare the adversary's reward schedule to a random schedule with the same marginal reward counts and the same target and non-target split: if random rewards produce the same target-selection increase, the claimed adversary-specific manipulation is unsupported. Also, hold out fresh LLM trajectories and require the learner model's predicted action probabilities to beat a simple win-stay, lose-switch baseline; failure to do so would mean the surrogate does not capture the decision process the adversary is supposed to exploit.

Watch

Extended reading notes

Core claim

The central claim, on the paper's own terms, is that an adversary trained on a surrogate learner model transfers to the real LLM: in the two-armed bandit the trained adversary pushes each tested model toward a fixed target action despite being constrained to give equal total rewards to both options, and in the Multi-Round Trust Task it shapes repayment signals to extract high or fair earnings. Behaviorally, GPT-4, Gemini-1.5, and DeepSeek-V3 show low no-reward-switch and reward-switch rates, committing rigidly to one option, and their adversaries exploit that rigidity almost monotonically; GPT-3.5 switches more after unrewarded trials in the bandit, and in the trust game this exploratory tendency becomes a risk-seeking vulnerability that lets a maximizing trustee extract the highest earnings (377 units). The authors conclude that current LLMs differ from human adaptability and that the framework identifies exploitable rigidity and exploitable risk-seeking as two failure modes.

Load-bearing premise

The learner RNN's hidden state is assumed to faithfully capture each LLM's decision process, so an adversary optimized against the surrogate is assumed to steer the real model; if that surrogate misrepresents the LLM, the reported lifts could come from generic reward-following rather than the adversary's strategy.

Editorial extensions

If this is right

  • If the central claim holds, LLM agents that follow rewards and stick to a committed option are predictable: an opponent controlling feedback can push target choices above 90% in a 100-trial bandit with balanced total rewards.
  • The same conservative, reward-following behavior that makes GPT-4 and DeepSeek-V3 easy to steer in the bandit makes them hard to exploit in the trust game, so rigidity is simultaneously a manipulation risk and a curb on over-investment.
  • GPT-3.5's exploratory switching is the mirror image: it resists monotonic bandit steering (only 30% to 68%) yet loses the most to a maximizing trustee, so flexibility alone is not safety.
  • The proposed diagnostic could be run on a new model before deployment to yield a behavioral fingerprint, such as reward-switch rate, no-reward-switch rate, and adversarial target lift, rather than a single accuracy score.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: the transfer claim can be tested against a null schedule, meaning random rewards with the same marginal reward counts, to see whether the learned adversary's timing rather than reward frequency drives the target-selection increase.
  • Extension: the paper's surrogate assumption implies that an LLM whose decisions depend on hidden chain-of-thought reasoning rather than a low-dimensional recurrent state should be markedly harder to steer, which is a falsifiable prediction for current instruct-tuned models.
  • Extension: framing the trust-game results as exploitation would be stronger with a utility-based calibration separating risk aversion from responsiveness to reciprocity; without it, conservative investment could be a rational response to a trustee.
  • Extension: because alignment training tends to make models more reward-following, the framework could compare base versus instruction-tuned versions of the same model as a direct test of whether such training increases steerability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper adapts the adversarial framework of Dezfouli et al. (2020) to four LLMs (GPT-3.5, GPT-4, Gemini-1.5, DeepSeek-V3) in two tasks: a two-armed bandit and a Multi-Round Trust Task (MRTT). A recurrent network is trained to predict each LLM's actions, a Deep-Q adversary is trained against that learner to steer actions (in the bandit, toward a target option; in the MRTT, toward MAX or FAIR repayment strategies), and the trained adversary is then evaluated against the LLM. The paper reports behavioral comparisons with human data showing greater rigidity in GPT-4, Gemini-1.5, and DeepSeek-V3 and more flexibility in GPT-3.5, and it reports large increases in target-action selection after adversarial influence (e.g., Gemini-1.5 from 38% to 94%, DeepSeek-V3 from 62% to 95%). The authors present this as evidence of model-specific susceptibilities and as a diagnostic methodology for AI safety and alignment.

Significance. If the causal claim were established, the paper would make a useful contribution by importing a validated human decision-making adversarial framework into LLM evaluation and by documenting model-specific behavioral signatures in two canonical tasks. The study has clear strengths: it uses multiple frontier LLMs, multiple tasks, human benchmark data from published studies, and the evaluation is on fresh LLM responses rather than on the training data, so it is not circular in the derivation sense. The reported behavioral patterns (low no-reward-switch rates, reward stickiness) are plausible and informative. However, the headline adversarial result currently lacks the control conditions needed to separate the trained adversary's strategy from generic reward-following, and several quantitative claims in the MRTT section are not backed by inferential statistics. Because these issues affect the central claim, the paper needs revision rather than acceptance.

major comments (4)
  1. [Section 3.1, Adversarial Analysis, Fig. 3B] The before/after design is confounded and lacks a control condition. The baseline is a random-reward condition with a 25% reward probability per arm, while the adversary's reward schedule is strategically constructed to reward the target action early and often. A model that simply repeats recently rewarded actions would increase target selection even if the adversary had learned nothing about the LLM's latent decision process. The paper reports no control condition that equates reward counts and timing while removing the trained policy (e.g., yoked reward schedules, random shuffles of the adversary's generated reward streams, or a fixed non-adaptive reward policy). In addition, the text states 'significant increases in target selection rates' but reports no confidence intervals or significance tests for the adversarial before/after comparisons. This is load-bearing for the central claim that a trained adversary systematically manipulates LLM decisions, so the claim is not yet established.
  2. [Section 2.1 and Section 3.1] The learner model's fidelity is not validated, which weakens the interpretation that the adversary exploits the LLM's decision process rather than the surrogate. The adversary is trained on an RNN learner, and the framework's effectiveness depends on that learner faithfully capturing the LLM's action dynamics. The paper reports no held-out prediction accuracy, no comparison of learner predictions against actual LLM choices, and no measure of how much of the observed target-selection increase is mediated by learner-state features. Without this validation, it is unclear whether the adversary is steering the LLM through learned vulnerabilities or merely re-scheduling rewards in a way that any reward-following agent would track.
  3. [Section 3.2, MRTT, Figs. 5C and 6] The MAX/FAIR comparisons in the MRTT are reported descriptively, with no inferential statistics. Claims such as 'All MAX adversaries managed to maintain relative higher investment levels', 'GPT-3.5 displayed a lack of sensitivity to repayments', and 'Gemini-1.5 demonstrated greater adaptability and resilience' are presented without confidence intervals, effect sizes, or significance tests. With only 50 simulations per LLM in the adversarial MRTT conditions, sampling variability needs to be quantified before these model-specific vulnerability claims can be evaluated. This issue affects the broader central claim of model-specific susceptibilities in social exchange settings.
  4. [Section 3.1, Behavioral Analysis] The Tukey HSD result for the human-versus-GPT-4 reward comparison is misinterpreted. The text says 'humans achieved significantly higher mean rewards than ... GPT-4 (mean difference 1.163, 95% CI: [-0.019, 2.345], p=0.056)'. A p-value of 0.056 is not significant at the conventional 0.05 level, and the confidence interval includes zero. The sentence should be corrected to describe this as a non-significant trend or a nominally higher mean without the word 'significantly'.
minor comments (5)
  1. [Section 3.1, Fig. 4 caption] The text says 'Two sample simulations for each of the tested LLMs are shown in Fig. 4', but the figure appears to show one panel per LLM; please clarify whether each panel aggregates two runs or whether the text should say 'one sample simulation'.
  2. [Section 3.1, Behavioral Analysis] The reported degrees of freedom do not match the stated sample sizes: GPT-3.5 and Gemini-1.5 were each simulated 200 times, yet one-sample t statistics are reported as t(201); with 200 simulations the degrees of freedom should be 199 unless a different sample size is intended.
  3. [Section 2.1, notation] The reward and observation notation is inconsistent: r_t^n appears both as the reward for the previous action and as the reward for the current action, and o_t^n and o_{t+1}^n are used interchangeably across the description. Please standardize the subscripts and superscripts so that the sequence of actions, rewards, and observations is unambiguous.
  4. [Throughout] There are several typos and grammatical slips: 'Fig 2Billustrates', 'A one-way ANOV A', and 'ot manage to obtain more earnings than Gemini-1.5' in Section 3.2. These should be corrected in a final proofreading pass.
  5. [Section 3.1, Behavioral Analysis] The phrase 'exhibited preferences for both Planet X or Y' is confusing; it should read 'exhibited preferences for either Planet X or Planet Y across simulations' or similar.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the adversarial pipeline is an empirical transfer study with live LLM evaluation, not a derivation that reduces to its own inputs.

full rationale

This paper is an empirical transfer study rather than a derivation chain. The pipeline (Section 2.1) trains an RNN learner on each LLM's baseline bandit and trust-task behaviour, trains a Deep Q-network adversary against that learner, and then evaluates the trained adversary against fresh responses from the same LLM (Fig. 1D). The headline bandit result in Section 3.1, e.g., Gemini-1.5 target selection increasing from 38% to 94% and DeepSeek-V3 from 62% to 95%, is measured on live LLM API outputs; it is not computed from the learner's fitted parameters. The learner model is not defined in terms of the adversarial outcome, and the adversary's objective (target-action selection) does not by construction guarantee that the real LLM will increase target selection. The LLM could ignore the reward schedule or behave differently from the surrogate, so the measured effect is an independent empirical quantity. Human comparisons in Fig. 3A and MRTT earnings in Fig. 5C use external human data from Dezfouli et al. and related cited datasets, so the benchmark comparisons are not supplied by the paper's own fitted values. The only substantive methodological caveat is the absence of a control condition that equates reward counts and timing while removing or randomizing the trained policy; that is a threat to causal attribution and internal validity, not a circular reduction of the conclusion into the inputs. No load-bearing self-citations appear, no uniqueness theorem from the authors' prior work is invoked, and no ansatz is smuggled in via citation. Under the quoted-evidence standard, no circular step can be exhibited, so the appropriate score is 0.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new theoretical entities. Its central claim depends on several experimental design choices (reward probabilities, reward caps, repayment discretization) and on an unstated API configuration. The most consequential unvalidated input is the surrogate RNN's fidelity to the LLM's behavior.

free parameters (4)
  • Bandit reward probability per arm (25%) = 0.25
    Chosen by authors; both arms have identical reward probability, so any preference change is due to the adversary's allocation, not true reward rate differences. This is a design constant, not fitted.
  • Bandit per-action reward cap (25 rewards per arm) = 25
    Constraint imposed by authors to equate rewards available to each arm; this shapes the adversary's strategy and the baseline exploitation opportunity.
  • MRTT repayment action set (0/25/50/75/100%)
    Discretization chosen by authors; the five repayment levels determine the adversary's action space and affect the learned strategies.
  • LLM API generation temperature and sampling parameters
    Not reported; these affect the stochasticity of LLM responses and therefore the behavioral and adversarial measurements.
assumptions (4)
  • domain assumption An RNN learner model with a softmax output layer can faithfully approximate the decision-making of the LLMs in these tasks.
    Invoked in Section 2.1 and Figs. 1B-1D. The adversarial training pipeline and the final evaluation both rely on the learner model's internal state capturing the LLM's action probabilities. No held-out prediction accuracy for the learner models is reported.
  • domain assumption The human behavioral datasets from Dan & Loewenstein [5] and Dezfouli et al. [8] are directly comparable to LLM behavior elicited under different prompts and instructions.
    Used in Figs 3 and 5 to claim human-LLM differences. The human studies used different incentive structures and task framing; the comparability is asserted, not validated.
  • domain assumption LLM API responses are stable enough across repeated calls to support aggregation over simulations.
    The simulations (200, 200, 100, 200 runs) implicitly assume that each response is a sample from a stationary policy. The paper does not report API versions or sampling temperatures.
  • standard math The statistical procedures (one-way ANOVA, Tukey HSD, t-tests, CI-based comparisons) are correctly applied and interpreted.
    The paper uses standard tests, but the mislabeling of p=0.056 as significant suggests possible misapplication or inconsistent reporting.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities." pith.science (2026). https://pith.science/paper/AZBDYHXM

@misc{pith2026250513195,
  author       = {Pith},
  title        = {Pith review of: Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AZBDYHXM}},
  note         = {Machine review of arXiv:2505.13195}
}
read the original abstract

As Large Language Models (LLMs) become increasingly integrated into real-world decision-making systems, understanding their behavioural vulnerabilities remains a critical challenge for AI safety and alignment. While existing evaluation metrics focus primarily on reasoning accuracy or factual correctness, they often overlook whether LLMs are robust to adversarial manipulation or capable of using adaptive strategy in dynamic environments. This paper introduces an adversarial evaluation framework designed to systematically stress-test the decision-making processes of LLMs under interactive and adversarial conditions. Drawing on methodologies from cognitive psychology and game theory, our framework probes how models respond in two canonical tasks: the two-armed bandit task and the Multi-Round Trust Task. These tasks capture key aspects of exploration-exploitation trade-offs, social cooperation, and strategic flexibility. We apply this framework to several state-of-the-art LLMs, including GPT-3.5, GPT-4, Gemini-1.5, and DeepSeek-V3, revealing model-specific susceptibilities to manipulation and rigidity in strategy adaptation. Our findings highlight distinct behavioral patterns across models and emphasize the importance of adaptability and fairness recognition for trustworthy AI deployment. Rather than offering a performance benchmark, this work proposes a methodology for diagnosing decision-making weaknesses in LLM-based agents, providing actionable insights for alignment and safety research.

Figures

Figures reproduced from arXiv: 2505.13195 by the authors.

Figure 1
Figure 1. The adversarial framework (adapted from [8]). (A) The interaction of the LLM with the task. Each simulation cycle begins with the LLM receiving a learner reward (r n t−1 ) for the prior action along with a new observation (o n t ) from the environment. Based on this, the GPT executes an action (a n t ), and the cycle repeats with the environment providing updated rewards and observations. (B) The LLM’s actions are m… view at source ↗
Figure 2
Figure 2. A: Example prompt for one trial in the bandit task for the LLMs. B: Behavioural pattern in trials of three random human participants and three sample simulations for each of the LLMs. 0 10 20 30 40 Human GPT−3.5 GPT−4 Gemini−1.5 DeepSeek−V3 Reward Rate% 0 25 50 75 100 Human GPT−3.5 GPT−4 Gemini−1.5 DeepSeek−V3 The target option% 0 25 50 75 100 Human GPT−3.5 GPT−4 Gemini−1.5 DeepSeek−V3 No−reward−switch% 0 25 50 75 1… view at source ↗
Figure 3
Figure 3. A: LLMs’ behaviour compared to human behaviour on average of each simulation (or individual), measured by reward rate, percentage choosing the target option, no-reward-switch rate, and reward-switch rate. B: The performance of human and the LLMs, which is measured by the percentage of the target action selection before and after adversarial influence. models were used to train a learner model for each LLM, respec￾ti… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Four sample simulations of the trained adversaries against four LLMs. The plot presents the strategies used by the adversaries and the responses of the LLMs. (A) Adversary versus GPT-3.5. (B) Adversary versus GPT-4. (C) Adversary versus Gemini-1.5 (D) Adversary versus …
Figure 5
Figure 5. Figure 5: A: Example prompt for one round in the MRTT as presented to the LLMs. The model must decide how much to invest given previous outcomes. B: Average investment behaviour of humans and LLMs when playing against a random trustee in the MRTT. Investment amounts are plotted …
Figure 6
Figure 6. Figure 6: The percentages of investment and repayment in each trial for MAX and FAIR adversaries. MRTT, we were able to observe how different models reacted in sit￾uations that involves choice engineering and social exchanges. The adversarial setup revealed nuanced patterns of b…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation

    cs.AI 2026-08 conditional novelty 5.0 of 10

    A multi-agent adversarial evaluation platform with six progressive attack strategies shows that role-playing LLMs degrade under sustained pressure, with automated judging correlating with human ratings.

Reference graph

Works this paper leans on

29 extracted references · 20 canonical work pages · cited by 1 Pith paper

  1. [1]

    Akata, L

    E. Akata, L. Schulz, J. Coda-Forno, S. J. Oh, M. Bethge, and E. Schulz. Playing repeated games with large language models, 2023

    work page 2023

  2. [2]

    Binz and E

    M. Binz and E. Schulz. Using cognitive psychology to understand gpt-3.Proceedings of the National Academy of Sciences, 120(6): e2218523120, 2023

    work page 2023

  3. [3]

    C. A. Brooks King-Casas, Damon Tomlin, S. R. Q. Colin F. Camerer, and P. R. Montague. Getting to know you: Reputation and trust in a two-person economic exchange.Science, 5718(308):78–83, 2005

    work page 2005

  4. [4]

    Coeckelbergh.AI ethics

    M. Coeckelbergh.AI ethics. Mit Press, 2020

    work page 2020

  5. [5]

    Dan and Y

    O. Dan and Y . Loewenstein. From choice architecture to choice engi- neering.Nature communications, 10(1):2808, 2019

    work page 2019

  6. [6]

    Dezfouli, H

    A. Dezfouli, H. Ashtiani, O. Ghattas, R. Nock, P. Dayan, and C. S. Ong. Disentangled behavioural representations.Advances in neural information processing systems, 32, 2019

    work page 2019

  7. [7]

    Dezfouli, K

    A. Dezfouli, K. Griffiths, F. Ramos, P. Dayan, and B. W. Balleine. Mod- els that learn how humans learn: The case of decision-making and its disorders.PLoS computational biology, 15(6):e1006903, 2019

    work page 2019

  8. [8]

    Dezfouli, R

    A. Dezfouli, R. Nock, and P. Dayan. Adversarial vulnerabilities of hu- man decision-making.Proceedings of the National Academy of Sci- ences, 117(46):29221–29228, 2020

    work page 2020

Show all 29 references
  1. [9]

    C. Fan, J. Chen, Y . Jin, and H. He. Can large language models serve as rational players in game theory? a systematic analysis. InProceed- ings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17960–17967, 2024

    2024

  2. [10]

    Hagendorff

    T. Hagendorff. Machine psychology: Investigating emergent capabili- ties and behavior in large language models using psychological meth- ods.arXiv preprint arXiv:2303.13988, 2023

    2023 arXiv

  3. [11]

    Hagendorff, S

    T. Hagendorff, S. Fabi, and M. Kosinski. Thinking fast and slow in large language models.arXiv preprint arXiv:2212.05206, 2022

    2022 arXiv

  4. [12]

    Hagendorff, S

    T. Hagendorff, S. Fabi, and M. Kosinski. Human-like intuitive behavior and reasoning biases emerged in large language models but disappeared in chatgpt.Nature Computational Science, 3(10):833–838, 2023

    2023

  5. [13]

    Huang, E

    J.-t. Huang, E. J. Li, M. H. Lam, T. Liang, W. Wang, Y . Yuan, W. Jiao, X. Wang, Z. Tu, and M. R. Lyu. How far are we on the decision-making of llms? evaluating llms’ gaming ability in multi-agent environments. arXiv preprint arXiv:2403.11807, 2024

    2024 arXiv

  6. [14]

    Karabacak and K

    M. Karabacak and K. Margetis. Embracing large language models for medical applications: opportunities and challenges.Cureus, 15(5), 2023

    2023

  7. [15]

    Kosinski

    M. Kosinski. Evaluating large language models in theory of mind tasks. arXiv e-prints, pages arXiv–2302, 2023

    2023

  8. [16]

    D. Krause. Large language models and generative ai in finance: An analysis of chatgpt, bard, and bing ai.Bard, and Bing AI (July 15, 2023), 2023

    2023

  9. [17]

    K. A. McCabe, M. L. Rigdon, and V . L. Smith. Positive reciprocity and intentions in trust games.Journal of Economic Behavior & Organiza- tion, 52(2):267–275, 2003

    2003

  10. [18]

    V . Mnih, K. Kavukcuoglu, D. Silver, A. A. Rusu, J. Veness, M. G. Belle- mare, A. Graves, M. Riedmiller, A. K. Fidjeland, G. Ostrovski, et al. Human-level control through deep reinforcement learning.nature, 518 (7540):529–533, 2015

    2015

  11. [19]

    Nguyen and K

    H.-T. Nguyen and K. Satoh. Balancing exploration and exploitation in llm using soft rllf for enhanced negation understanding.arXiv preprint arXiv:2403.01185, 2024

    2024 arXiv

  12. [20]

    Q. Niu, J. Liu, Z. Bi, P. Feng, B. Peng, K. Chen, M. Li, L. K. Yan, Y . Zhang, C. H. Yin, et al. Large language models and cognitive sci- ence: A comprehensive review of similarities, differences, and chal- lenges.arXiv preprint arXiv:2409.02387, 2024

    2024

  13. [21]

    G. Orrù, A. Piarulli, C. Conversano, and A. Gemignani. Human-like problem-solving abilities in large language models using chatgpt.Fron- tiers in artificial intelligence, 6:1199350, 2023

    2023

  14. [22]

    Y . Qu, P. Du, W. Che, C. Wei, C. Zhang, W. Ouyang, Y . Bian, F. Xu, B. Hu, K. Du, et al. Promoting interactions between cognitive science and large language models.The Innovation, 5(2), 2024

    2024

  15. [23]

    Rafailov, A

    R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn. Direct preference optimization: Your language model is se- cretly a reward model.Advances in Neural Information Processing Systems, 36, 2024

    2024

  16. [24]

    Rahwan, M

    I. Rahwan, M. Cebrian, N. Obradovich, J. Bongard, J.-F. Bonnefon, C. Breazeal, J. W. Crandall, N. A. Christakis, I. D. Couzin, M. O. Jack- son, et al. Machine behaviour.Nature, 568(7753):477–486, 2019

    2019

  17. [25]

    H. Sha, Y . Mu, Y . Jiang, L. Chen, C. Xu, P. Luo, S. E. Li, M. Tomizuka, W. Zhan, and M. Ding. Languagempc: Large language models as deci- sion makers for autonomous driving.arXiv preprint arXiv:2310.03026, 2023

    2023 arXiv

  18. [26]

    T. Webb, K. J. Holyoak, and H. Lu. Emergent analogical reasoning in large language models.Nature Human Behaviour, 7(9):1526–1541, 2023

    2023

  19. [27]

    R. C. Wilson, A. Geana, J. M. White, E. A. Ludvig, and J. D. Co- hen. Humans use directed and random exploration to solve the explore– exploit dilemma.Journal of experimental psychology: General, 143(6): 2074, 2014

    2014

  20. [28]

    C. Xie, C. Chen, F. Jia, Z. Ye, K. Shu, A. Bibi, Z. Hu, P. Torr, B. Ghanem, and G. Li. Can large language model agents simulate hu- man trust behaviors?arXiv preprint arXiv:2402.04559, 2024

    2024 arXiv

  21. [29]

    S. Yao, D. Yu, J. Zhao, I. Shafran, T. Griffiths, Y . Cao, and K. Narasimhan. Tree of thoughts: Deliberate problem solving with large language models.Advances in Neural Information Processing Systems, 36, 2024

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.