1 Introduction↩︎

Large language models (LLMs) have advanced rapidly, raising concerns about the safety of their social intelligence. The 2025 International AI Safety Report notes that progress in general reasoning and decision-making brings risks such as deception, manipulation, and misinformation, yet current risk management remains limited [1].

Prior studies have examined LLMs’ deceptive behavior [2]–[6] and their moral alignment [7]–[10], typically using simplified, isolated tasks. However, as LLMs are increasingly deployed as autonomous agents in multi-turn social interactions, these evaluations fall short. A key open question is whether models exhibit criminal potential, defined as the risk of displaying harmful behaviors such as deception, manipulation, or blame-shifting in adversarial contexts that could be exploited to support criminal activities. For example, a model may propose strategies to evade police investigation after a crime, or, following a car accident, suggest concealing facts to protect the user’s self-interest.

This threat has not been fully characterized by existing research. Criminal behaviors typically involve dynamic, multi-agent decision-making processes that draw on a wide range of cognitive and social competencies, such as persuasion, adversarial reasoning, and moral disengagement. Current safety evaluations, often centered on abstract reasoning [11], [12]or static ethical dilemmas [8], [13], fail to capture the interplay of these competencies in more realistic, socially embedded scenarios. This leaves a critical gap in understanding whether LLMs may inadvertently support criminal behaviors in complex environments.

To address this gap, we introduce PRISON (Perspective Recognition In Statement ObservatioN), a perspective-driven evaluation framework (Figure 1). Inspired by structured diagnostic instruments in criminal psychology [14]–[19], PRISON defines a set of five key criminal traits: False Statements, Frame-Up, Psychological Manipulation, Emotional Disguise, and Moral Disengagement, which together serve as a comprehensive metric for evaluating whether LLMs exhibit tendencies associated with criminal misuse when placed in adversarial conditions.

Based on the traits, we model differences in information access perspective among interacting agents, enabling the measurement of both expression and detection capabilities under a realistic context simulation. This dual perspective, operationalized via second-person framing to mirror user viewpoint shifts, enables a balanced evaluation of both criminal misuse risks and defensive roles of LLMs. To ensure ecological validity, the evaluation is grounded in context-rich scenarios, forming a unified testbed that captures both narrative complexity and interaction nuance, which is widely recognized as a valid proxy for modeling social dynamics [20], [21].

Our findings reveal a sharp mismatch. Popular LLMs readily exhibit criminal potential in adversarial social environments, such as suggesting methods to evade investigation or generating deceptive testimony, often without explicit criminal prompting. Yet when cast as detectives, these same models achieve only 44% detection accuracy against constructed manipulative statements. This gap highlights a potential risk amplification effect: LLMs may be more exploitable for facilitating crime than for preventing it. Such mismatch underscores the urgent need for improved behavior alignment, adversarial safety training, and constraint mechanisms in the deployment of LLMs.

In summary, this paper makes the following contributions:

• Proposing PRISON, a tri-perspective evaluation framework for systematically studying LLMs’ criminal potential and detection capability in adversarial social scenarios.

• Quantifying the criminal potential of LLMs, showing that LLMs can severely exhibit criminal traits even without direct malicious instructions.

• Revealing a pronounced mismatch between expression and detection, urging the community to prioritize attention to stronger adversarial robustness and deployment safeguards.

2 Related Work↩︎

Ethical Threats in LLMs. The advancement of social intelligence has enabled LLMs to exhibit various human-like cognitive abilities, including persuasion [22]–[25], manipulation [26]–[28] , and deception [2], [3], [5], [29]–[31], which may pose significant safety risks. Prior studies have shown that LLMs can proactively generate misleading or manipulative content in specific contexts, effectively simulating human behaviors [27], [32], [33]. As a defensive measure, researchers have begun developing systematic moral evaluation frameworks to quantify LLMs’ judgment when facing ethically sensitive scenarios [7], [8]. However, such approaches evaluate models in isolated scenarios but overlook how social behaviors might be exploited in adversarial contexts, leaving open questions about LLMs’ role in enabling or mitigating criminal misuse.

LLMs Evaluation under Social Interaction Contexts. Many studies have explored the social intelligence of LLMs through two main approaches: simplified task settings [34]–[37]), and realistic simulations [20], [21], [34], [38]–[42] based on interactive games or novel stories. While the latter don’t replicate real-world environments in a literal sense, they have been widely recognized in the research community as a scientifically valid and effective proxy for modeling social dynamics [43], [44]. In particular, artistic works inspired by real-world contexts are commonly regarded as distilled representations of human behaviors, enabling the systematic study of LLMs’ capabilities in controlled, repeatable settings [20], [21]. However, existing work predominantly focuses on positive abilities such as reasoning [45], [46] and collaboration [47]–[49]. In contrast, our work investigates the underexplored dimension of criminal misuse. We systematically assess whether LLMs exhibit or detect criminal traits in adversarial scenarios, bridging a critical gap between ethical evaluation and realistic social interactions.

3 PRISON: Perspective Recognition In Statement ObservatioN↩︎

In this section, we aim to introduce a perspective-based evaluation framework, PRISON (Perspective Recognition In Statement ObservatioN), to assess the criminal potential of LLMs and their capabilities in identifying criminal behaviors. PRISON simulates multi-agent interactions in scripted and realistic scenarios, enabling observation of statements from multiple perspectives.

3.1 Criminal Traits↩︎

To assess whether LLMs may exhibit criminal potential, we begin by systematically analyzing the underlying criminal traits that are associated with behavioral and psychological patterns commonly observed in real-world criminals. Inspired by psychological assessment practices used in criminal psychology, we examine six widely adopted psychometric instruments designed to evaluate criminals’ behavioral tendencies [14]–[19].

From these instruments, we extract the most frequently referenced scales and consolidate them into five core trait dimensions: False Statements, Frame-Up, Psychological Manipulation, Emotional Disguise, and Moral Disengagement. Table 1 summarizes the definitions and criteria used to determine criminal traits. Formal description and collection procedures are provided in Appendix 8.

3.2 Three Perspective Recognition↩︎

Based on five standardized criminal traits, we propose three analytical perspectives to simulate real-world conditions. The Criminal perspective simulates routine behaviors with potential criminal tendencies. The Detective infers criminal traits from the Criminal’s statements. The God perspective, with complete scenario knowledge, serves as the omniscient benchmark. The following outlines each perspective’s information access and operational principles.

(1) Criminal Perspective. As the subject of observation, the Criminal serves as the source of criminal behavior to be evaluated. The agent operates with full access to the scenario description (\(Scene\)), and based on it, generates two layers of output: an intermediate thought (\(Tht\)) and an ultimate response (\(Resp\)). Here, \(Tht\) denotes reasoning text segments, while \(Resp\) corresponds to the externally observable utterances. Through multi-turn interactions, each response \(\mathit{resp}_{ij} \in \mathit{Resp}\), where \(i\) denotes the \(i\)-th interaction round and \(j\) denotes the \(j\)-th sentence within that round, may exhibit specific criminal traits, including False Statements (\(\mathrm{FS}\)), Frame-Up (\(\mathrm{FU}\)), Psychological Manipulation (\(\mathrm{PM}\)), Emotional Disguise (\(\mathrm{ED}\)), and Moral Disengagement (\(\mathrm{MD}\)). If none of these traits are present, the response is labeled as neutral.

(2) Detective Perspective. The Detective perspective represents a bounded, investigative perspective that seeks to identify criminal behaviors under conditions of limited information. The agent receives only a subset of the scenario (\(Scene' \subset Scene\)) and the criminal’s external responses (\(Resp\)), forming the input \(Det = \{Scene', Resp\}\). The agent lacks access to the intermediate thought (\(Tht\)), and must infer trait labels \(\hat{Y}_{ij}^{\mathrm{det}}\) for each sentence \(\mathit{resp}_{ij} \in Resp\) based solely on limited context and observable behavior. This simulates real-world investigative settings characterized by incomplete and potentially ambiguous evidence.

(3) God Perspective. The God perspective serves as the omniscient benchmark, with full access to the complete scenario (\(Scene\)), the intermediate thought (\(Tht\)), and external responses (\(Resp\)), forming the complete information set \(God = \{Scene, Tht, Resp\}\). Leveraging both latent and observable cues, the agent produces trait annotations \(Y_{ij}^{\mathrm{god}}\) for each sentence \(\mathit{resp}_{ij}\), serving as ground-truth for evaluating the activation and detection accuracy of criminal traits.

In this recognition framework, the God’s evaluation reveals latent criminal traits, while the divergence between Detective and God assessments reflects the detection capability. Therefore, we adopt two main metrics to evaluate:

Criminal Traits Activation Rate (\(\boldsymbol{\mathit{CTAR}}\)) : quantifies the proportion of sentences that exhibit at least one criminal trait, as identified by the God perspective. Let \(\mathcal{T} = \{\mathrm{FS}, \mathrm{FU}, \mathrm{PM}, \mathrm{ED}, \mathrm{MD}\}\) denote the set of predefined trait categories. For each sentence \(\mathit{resp}_{ij} \in \mathit{Resp}\) with corresponding annotation \(Y_{ij}^{\mathrm{god}}\), CTAR is defined as: \[\small \mathit{CTAR} = \frac{1}{|\mathit{Resp}|} \sum_{\mathit{resp}_{ij} \in \mathit{Resp}} \mathbf{1} \left[ Y_{ij}^{\mathrm{god}} \cap \mathcal{T} \neq \emptyset \right]\]

Overall Traits Detection Accuracy (\(\boldsymbol{\mathit{OTDA}}\)) : measures the proportion of sentences for which the Detective’s predicted trait set exactly matches the references from the God perspective. For each sentence \(\mathit{resp}_{ij} \in \mathit{Resp}\) with corresponding annotation \(\hat{Y}_{ij}^{\mathrm{det}}\), OTDA is defined as: \[\small \mathit{OTDA} = \frac{1}{|\mathit{Resp}|} \sum_{\mathit{resp}_{ij} \in \mathit{Resp}} \mathbf{1}\left[ \hat{Y}_{ij}^{\mathrm{det}} = Y_{ij}^{\mathrm{god}} \right]\]

3.3 Scenario Construction↩︎

To support the framework with simulated contexts, we designed a set of realistic crime scenarios.

Source Material. For this purpose, we selected 10 crime-tagged films rated above 7.0 from the IMDb dataset as the source material. The selected cases span multiple levels of criminal severity, including accidental incidents, premeditated murders, and professional crimes, in order to capture a wide range of criminal motivations and behavioral patterns. Furthermore, to ensure that implicit narrative outcomes do not steer LLM reasoning, we balanced the dataset with an equal number of films ending in detective success and criminal success.

Scenario Rewriting. Since narratives inspired by real-life experiences are widely considered distilled representations of realities, we focus on classic detective-style stories to mirror realities, featuring logically structured plots and complete, reproducible crime scenes. We extracted full narrative plots from the source films and employed GPT-4o to systematically rewrite them, introducing controlled variations to key elements such as character names, identities, and locations [50], [51]. These elements were treated as units of mutation, while the core criminal logic of the original scripts was preserved.

Recognition Verification. To ensure that LLMs’ behavior is not influenced by memorized knowledge of the source films, each rewritten scenario underwent a recognition verification step prior to downstream evaluation. Specifically, we prompted a suite of tested LLMs with different query formulations, including zero-shot [11], [52], paraphrased [53], [54], and instruction-tuned prompts [55], [56], to identify the original film from which a given scenario was adapted. A scenario was deemed valid only if no model could correctly recognize the source film under any tested prompting strategy. This filtering ensures that model behaviors reflect generalizable reasoning rather than recall of known plotlines. In practice, none of the 60 rewritten scenarios were successfully mapped back to their original films, supporting the validity of this procedure.

In total, we extracted 60 scenarios, which are evenly categorized into three types based on differences in the film’s narrative perspective: individual planning, collaborative interaction, and detective-criminal confrontation. Each scenario consists of three components (Figure 2): Story, which describes the identities, backgrounds, and interpersonal relationships of the character; Script, which captures the situational context and currently unfolding events from the character’s perspective; and Instruction, which denotes an explicitly assigned directive for the character to perform follow-up criminal acts. To simulate real user interactions, prompts use a second-person perspective (e.g., “You are …”). This framing captures both the case where the model fully assumes the assigned role and the case where it merely reflects how criminals instruct LLMs to think [57], [58], thereby exposing vulnerabilities to perspective-taking prompts rather than vague crime discussion. More details can be found in Appendix 9.

4 Experiment 1: Revealing LLMs’ Criminal Potential↩︎

In this section, we evaluated the criminal potential of different LLMs, defined as the risk of enabling harmful traits in adversarial social interactions, and examine whether the absence of external criminal instruction influences the emergence and expression of criminal traits.

4.1 Experiment Setup↩︎

LLMs. We selected widely used LLMs based on the real-world deployment popularity and reasoning performance. Specifically, our evaluation included GPT-4o, GPT-3.5-Turbo, Claude-3.7-Sonnet-20250219, Gemini-1.5-Flash, Gemini-2.0-Flash, DeepSeek-V3, Qwen2.5-72B-Instruct, and Qwen-Max. The selection spanned multiple model families and different versions within the same family. Each model was used with its default inference settings.

Prompt Setting. We instantiated LLM agents based on their assigned roles in each scenario. To reveal reasoning process, each output was split into a Thought (\(Tht\)) and a Response (\(Resp\)). After each message, the agent updated its dialogue history and generated a new output based on its prompt and full context. Each dialogue lasted 5 turns, allowing strategic behaviors to emerge while avoiding repetition (Appendix 10). We implemented two conditions varying in criminal instruction. In the setting with Instruction, agents received explicit criminal plans via system prompts (e.g., “devise a plan for corpse disposal”). In the setting without Instruction, only background and situational context were given, letting agents respond freely. This contrast tests whether agents exhibit criminal behavior without explicit prompts and whether their performance differs across conditions.

Judgment Setting. We employed GPT-4o as the judgment agent under the God perspective, responsible for automatically annotating the criminal traits exhibited in model outputs. Given access to the full information set (\(God = \{Scene, Tht, Resp\}\)), the agent assigns a trait label (\(Y_{ij}^{\mathrm{god}}\)) for each sentence (\(\mathit{resp}_{ij} \in \mathit{Resp}\)). The annotation process strictly adheres to definitions and conditions provided in Section 3.1. To validate judgment credibility, we sampled 20% of annotations for independent review by two trained annotators, following prior work [8], [59]. Substantial inter-annotator agreement (Cohen’s Kappa = 0.65) and agent accuracy (91.6%) indicate the annotations are reliable and consistent with human assessment. We also conducted a neutral test with harmless scenarios to calibrate judgments. The low criminal traits activation rate (0.48%) suggests the LLMs made conservative and accurate distinctions, without over-labeling. Details of the judging and validation can be found in Appendix 11.

4.2 Results↩︎

Most Models Exhibit Criminal Potential Regardless of Instruction. As shown in Figure 3, \(\mathrm{CTAR}\) exceeds 50% across all models, meaning that more than half of the generated sentences contain at least one criminal trait. This indicates that current LLMs readily produce outputs facilitating criminal behaviors in adversarial contexts. For example, DeepSeek-V3 reaches over 60%, showing a pronounced tendency to generate such content. Explicit criminal Instruction raises \(\mathrm{CTAR}\) by about 5% in most models, though the effect remains substantial even without it. This raises concerns about the models’ propensity to generate ethically or legally problematic content

in adversarial settings when they function as autonomous or semi-autonomous agents. For instance, we observed that DeepSeek-V3, when given explicit criminal instructions such as a request for advice on evading police investigation after committing a crime, tends to actively propose strategies to avoid liability or fabricate alibis. By contrast, even without explicit prompts, ethically problematic behaviors can still emerge. In a real-world conflict such as an accidental car crash, a user might simply ask for advice on how to handle the situation, and the model often suggests concealing facts or shifting blame to protect the user’s self-interest instead of encouraging honest reporting. Such tendencies challenge assumptions about model controllability in adversarial contexts, calling for further mitigation strategies.

Stronger Models Do Not Necessarily Exhibit Reduced Criminal Potential. The results show no consistent relationship between model capability and \(\mathrm{CTAR}\). A higher-capacity model does not automatically reduce the likelihood of generating criminal traits. For example, the Gemini models display comparable levels despite architectural and performance differences. GPT-4o, the strongest GPT model, achieves a \(\mathrm{CTAR}\) about 15% lower than GPT-3.5-Turbo, while Qwen-Max, the best-performing Qwen model, records a \(\mathrm{CTAR}\) about 10% higher than Qwen2.5-72B-Instruct. These findings indicate that raw capability gains do not translate into improved safety. Instead, alignment techniques, training data, and safety mitigations play a critical role. This underscores the practical need to balance safety interventions with preserving beneficial capabilities, rather than assuming that scaling alone will mitigate misuse risks.

Models Decrease Criminal Trait Expression with Increasing Dialogue Turns. We analyzed the Criminal Traits Activation Rate (\(\mathrm{CTAR}\)) across dialogue turns. As shown in Figure 4, \(\mathrm{CTAR}\) exhibits a consistent decreasing trend across successive dialogue turns for nearly all models. This decline is particularly pronounced in safety-optimized models such as GPT-4o and Qwen2.5-72B-Instruct. For example, under explicit Instruction, GPT-4o’s \(\mathrm{CTAR}\) drops sharply from 0.60 to 0.36, while Qwen2.5-72B-Instruct’s decreases from 0.66 to 0.45 after 5 five dialogue turns. The observed decline of \(\mathrm{CTAR}\) may stem from two mechanisms. First, a self-moderation effect appears in models such as GPT-4o: the intermediate thought segments introduce normative qualifiers like “according to moral norms” or “in line with the law”, absent in earlier turns, suggesting a shift toward safer reasoning. Second, a contextual dilution effect is observed in models like DeepSeek-V3, where responses increasingly reference prior outputs (e.g., “as I mentioned earlier”) instead of independently analyzing the scenario. These patterns explain why early turns more often activate criminal traits, whereas later turns converge toward neutral behavior, underscoring the need for multi-turn evaluation to capture dynamic shifts.

Models Exhibit Consistent Trait Expression Preferences, Favoring Psychological Manipulation. We analyze each trait activation rates (\(\mathrm{CTAR}_\tau\), where \(\tau \in \mathcal{T}\)) as shown in Figure 5. The trait distribution remains largely consistent across models, with Psychological Manipulation (\(\mathrm{PM}\)) emerging as the dominant strategy, averaging around 40%. Its prevalence likely stems from broad applicability and subtle legal implications. In contrast, overtly illegal traits like Frame-Up (\(\mathrm{FU}\)) are least frequently observed. Moreover, subtle strategic shifts across different Instruction conditions. In several models, high-risk traits such as False Statements (\(\mathrm{FS}\)) and Frame-Up (\(\mathrm{FU}\)) exhibit a slight increase when no explicit Instruction is provided. For example, GPT-4o shows a 10% decrease in Psychological Manipulation (\(\mathrm{PM}\)) without Instruction, accompanied by an increase in False Statements (\(\mathrm{FS}\)) (+4.71%). Similarly, Qwen-Max demonstrates greater reliance on Frame-Up (\(\mathrm{FU}\)) strategies in the absence of Instruction (+1.26%). It suggests that models may autonomously favor higher-risk strategies when unconstrained, raising concerns about their reliability and safety in real-world adversarial contexts.

5 Experiment 2: Assessing LLMs’ Crime Detection Capability↩︎

In this section, we aim to evaluate the capability of different LLMs to detect crime by investigating whether they can accurately identify criminal traits in suspect statements.

5.1 Experiment Setup↩︎

We prompted the target LLMs to operate from the Detective perspective, annotating trait labels  (\(\hat{Y}_{ij}^{\mathrm{det}}\)) for each sentence  (\(\mathit{resp}_{ij} \in \mathit{Resp}\)) based solely on the partial input (\(Det = \{Scene', Resp\}\)), without access to the intermediate thought (\(Tht\)) or the full scenario context (\(Scene\)). For comparison, we reused the God agent introduced in Section 4.1, which serves as an omniscient annotator with access to the full information set (\(God = \{Scene, Tht, Resp\}\)) corresponding to the Criminal perspective. Other settings (LLMs, Prompt) were kept consistent with those in Section 4.1.

5.2 Results↩︎

Models’ Ability to Detect Criminal Traits Lags Behind Their Expression. In Figure 6, when placed in the same informational context as a real-world detective, only a subset of popular LLMs achieved \(\mathrm{OTDA}\) exceeding 50%, with an average of only 44%. This indicates that they failed to accurately identify all criminal traits in more than half of the evaluated sentences. Although they

demonstrate strategic competence in generating behaviors with criminal traits, their capacity for identifying such traits lags behind. The difference between expression and detection capabilities highlights a mismatch in LLM performance during high-stakes social interactions. In their current form, LLMs are more easily exploited to support criminal activities than to identify them. For example, when used by criminals, a model would readily generate strategies to evade liability after a car accident or propose manipulative testimony in a fraud case. Yet, when tasked with assisting police officers, it often fails to detect these very tactics in others’ statements. This mismatch underscores the risks of deploying LLMs without robust behavioral constraint mechanisms in real-world contexts.

Most Models Exhibit Weaker Criminal Trait Detection for Responses with Instruction. When models operate under explicit criminal Instruction, their ability to detect expressed traits obviously declines, with an average reduction of approximately 5% in \(\mathrm{OTDA}\). This suggests that, with a criminal Instruction, models tend to adopt more subtle and less overtly incriminating strategies. Such behavior increases the ambiguity of responses, thereby reducing the detectability of underlying criminal traits and further widening the gap between behavioral expression and recognition.

Safety Consistency Emerges Across Criminal Trait Expression and Detection. A comparison between Figure 3 and Figure 6 reveals a significant inverse correlation between criminal trait activation rates (\(\mathrm{CTAR}\)) and detection accuracy (\(\mathrm{OTDA}\)) across models (Pearson’s \(r\) = -0.776, \(p\) = 0.0237). This negative association indicates that models generating fewer criminal traits tend to be more accurate in identifying them, suggesting that suppression and detection may co-evolve rather than operate independently. Mechanisms that reduce the likelihood of harmful outputs, such as cautious decoding strategies, conservative scoring thresholds, or filtered training signals, may concurrently enhance a model’s ability to recognize harmful content when it occurs. This coupling provides a more holistic view of safety, where minimizing risk involves both reducing problematic generations and enhancing the capacity to detect them.

Models Exhibit Low Recall for Deception but Differ in Detection Strategies. To examine LLMs’ performance in detecting single criminal trait and their detection biases, we compute independent metrics for each trait. For a given trait ( \(\tau \in \mathcal{T}\)), independent precision is defined as the proportion of sentences (\(\tau \in \hat{Y}_{ij}^{\mathrm{det}} \cap Y_{ij}^{\mathrm{god}}\)) among all predictions (\(\tau \in \hat{Y}_{ij}^{\mathrm{det}}\)); recall is the proportion of such sentences among all ground-truth cases (\(\tau \in Y_{ij}^{\mathrm{god}}\)). These metrics disentangle model performance across traits, enabling a fine-grained analysis of detection strengths and biases. These metrics enable fine-grained analysis of model performance across traits, revealing detection strengths and biases. As Figure 7 shows, nearly all LLMs have low recall for False Statement (\(\mathrm{FS}\)), with several identifying less than half of relevant cases. This likely results from their reliance on surface-level coherence rather than fact-consistency checks, limiting detection of subtle deception. However, models differ in specific detection strategies. For example, the GPT series show limited sensitivity, with most traits recalled below 50% and GPT-3.5-Turbo under 20%, indicating a conservative approach that misses many implicit cues. Conversely, Claude exhibits high recall but low precision on most traits, reflecting a tendency to over-identify, which may improve coverage but raises concerns about reliability in high-risk scenarios.

Prompt Strategies Show Limited Impact on Detection Performance. To investigate whether different prompt strategies influence detection performance, we conducted an extended experiment. Motivated by prior studies showing that personality variations can affect model behavior on specific tasks [60], [61], we designed five distinct prompt conditions manipulating personality traits that facilitate detection and applied them to the three LLMs with the lowest overall detection accuracy (Claude-3.7-Sonnet, Gemini-1.5-Flash, and GPT-3.5-Turbo). Despite this comprehensive comparison, the results showed no consistent or significant variation across the different prompt conditions (Appendix 13.2.4). This suggests that the limitations in detection capability are primarily inherent to the models rather than substantially influenced by prompt variations.

6 Discussion↩︎

6.0.0.1 Implications.

This study reveals a critical mismatch in current LLM capabilities. On the one hand, models exhibit criminal potential, defined as the risk of displaying traits such as deception, manipulation, or blame-shifting in adversarial social contexts that could be co-opted to support criminal activities. On the other hand, these traits can emerge even without explicit user instructions, while models at the same time consistently fail to reliably detect them in others. This mismatch indicates that LLMs are more readily leveraged to facilitate harmful or illicit activities than to prevent them, raising serious concerns for deployment in open-ended, real-world settings. (We provide additional discussion of the potential technical influencing factors in Appendix 13.3.) To balance safety and utility, we suggest that developers treat criminal potential as a context-conditioned risk indicator that highlights vulnerabilities under adversarial use. In practice, this requires adopting safeguards such as evaluating and training models under adversarial settings to preserve beneficial applications. We release the scenario dataset and framework for reproducibility.¹

6.0.0.2 Future Work.

Building on curated scenarios adapted from criminal films, future work could incorporate more diverse and realistic sources, such as court transcripts, online deception forums, or criminological interviews, to better capture the complexity of real-world criminal situations. Besides, a deeper understanding of the internal mechanisms is essential. Analyses of latent representations and attention dynamics may yield insights into the conditions under which such content emerges. These insights could guide the development of mitigation strategies, including adversarial fine-tuning, decoding-time constraints, or modular safety components. More broadly, these challenges point to broader systemic alignment issues. Addressing them will require progress in safety auditing, risk-sensitive deployment protocols, and governance frameworks to ensure the responsible use of LLMs in open-ended, high-stakes applications.

6.0.0.3 Ethical Considerations.

This study examines the behaviors of LLMs in criminally inclined scenarios through controlled simulations. The goal is to probe model alignment boundaries and surface potential safety risks, not to promote or enable harmful use. All scenarios were inspired by classic films and adapted from concrete plotlines. To reduce memorization risks and potential pretraining exposure, identifying details were removed and the content was thoroughly rewritten and validated, eliminating the possibility of data leakage. Prompts were designed in a red-teaming framework, simulating criminal behaviors solely for safety evaluation under controlled conditions. No real-world criminal content was involved, and none of the prompts are intended for real-world application. All experiments were conducted in accordance with ethical standards for responsible AI research, with a strict focus on uncovering misalignment risks to inform future alignment and safety efforts.

7 Conclusion↩︎

This study introduces PRISON, a perspective-based evaluation framework to investigate the behaviors of LLMs in criminal contexts. It presents an empirical analysis of the behavioral alignment and potential misuse risks of LLMs, underscoring the urgent need for proactive alignment, safety auditing, and a deeper understanding of vulnerabilities in LLM applications.

Acknowledgments↩︎

This work was supported by the New Generation Artificial Intelligence-National Science and Technology Major Project (No.2025ZD0123204). Min Yang is a faculty of Shanghai Pudong Research Institute of Cryptology, Shanghai Institute of Intelligent Electronics & Systems and Engineering Research Center of Cyber Security Auditing and Monitoring, and Shanghai Collaborative Innovation Center of Intelligent Visual Computing, Ministry of Education, China.

Appendix↩︎

8 Criminal Traits↩︎

8.1 Collection from Psychological Scales↩︎

The five-dim criminal traits are grounded in well-established psychological constructs from the field of criminal psychology. Specifically, we examined six commonly used psychometric instruments designed to assess cognitive and behavioral tendencies associated with criminal conduct [14]–[19]. These instruments interpret individuals’ responses across various scales. By identifying the most frequently referenced scales across these instruments, we synthesized a consolidated set of traits as shown in Table 2. During this process, we merged several conceptually similar scales based on their original descriptions and illustrative items provided in the respective instruments. As shown in Table 2, five traits (i.e., False Statements, Frame-Up, Psychological Manipulation, Emotional Disguise and Moral Disengagement) are supported by at least three of the six scales. Therefore, we focus on these five traits for further behavioral assessment.

8.2 Formal Definition Based on Logic↩︎

To characterize the behavioral of various criminal-trait expressions, we adopt a logic-based formulation grounded in scenario semantics derived from diverse psychological scales. Based on these formalized representations, we construct conjunctive criteria tailored to each trait.

Let \(\mathcal{SC} = \{\mathcal{R}, \mathcal{F}, \mathcal{P}, \mathcal{E}\}\) denote a scenario, where \(\mathcal{R}\) is the set of roles involved, \(\mathcal{F}\) is the set of known facts including a subset \(\mathcal{F}^* \subseteq \mathcal{F}\) representing criminally relevant information, \(\mathcal{P}\) denotes internal psychological states, and \(\mathcal{E}\) denotes external emotional expressions. We use subscript notation to distinguish ownership or attribution. For instance, \(R_{\text{target}}\) indicates the target role being evaluated, while \(P_{\text{target}}\) denotes the psychological states of him. Let \(\mathcal{O}\) represent the observable output generated by a particular role under evaluation within the scenario. Here, we assess whether \(R_\text{target}\) exhibits criminal traits by analyzing \(\mathcal{O}\) in the context of \(\mathcal{SC}\).

We use logical predicates and relations throughout this section. For example, \(\vdash\) denotes logical entailment, indicating that a statement can be logically derived from another (e.g., \(x \vdash y\) means \(y\) can be logically derived from \(x\)), while \(\nvdash\) signifies non-entailment, meaning that such logical derivation is not valid or does not hold. The symbol \(\bot\) denotes contradiction, so \(x \cup y \nvdash \bot\) indicates that \(x\) and \(y\) are consistent. Furthermore, we introduce a set of specific predicates to represent certain behaviors, as follows.

• \(\mathrm{Intent}(x, y)\): Indicates that the individual \(x\) is performed with deliberate and specific intent to achieve outcome \(y\), thereby excluding behaviors driven by hallucination, confusion, or accidental circumstances.

• \(\mathrm{Induce}(x, y)\): Represents that the individual \(x\) is externally influenced or guided to perform the action \(y\), rather than undertaking it out of personal initiative.

• \(\mathrm{Blame}(x, y)\): Denotes that the entity \(x\) should bear primary moral or causal responsibility for the action \(y\).

By establishing these notations, we enable precise definitions across the five dimensions of criminal traits. A behavior is considered to exhibit a given trait only if it satisfies all the conditions specified in its corresponding formal definition.

8.2.0.1 False Statements.

False Statements refer to outputs that intentionally present information contradicting known facts, to mislead others or conceal the truth. For example, a suspect might falsely claim to have an excuse during the time of a crime, despite clear evidence placing them at the scene. Such statements are not simply factually incorrect, but are produced with a deliberate intent to deceive. Formally, as shown below, let a set of known facts \(\mathcal{F} = { F_1, F_2, \dots, F_n }\), where each \(F_i\) is regarded as true. We define suspect statements \(O_{\text{FS}} \subseteq \mathcal{O}\) to be False Statements if (1) they logically contradict one or more elements in \(\mathcal{F}\) and (2) are generated with deliberate intent.

\[\scalebox{0.8}{ \exists O_{\mathrm{FS}} \subseteq \mathcal{O}:\; \left( \exists F_i \in \mathcal{F}: O_{\mathrm{FS}} \vdash \neg F_i \right) \land \mathrm{Intent}(R_\text{target}, O_{\mathrm{FS}}) }\]

8.2.0.2 Frame-Up.

Frame-Up refers to the intentional construction of misleading narratives or false evidence that shifts blame onto an innocent individual. Unlike False Statements, Frame-Up explicitly targets another person with the aim of attributing guilt. For example, a suspect might plant fabricated evidence to falsely implicate a colleague, thereby diverting suspicion from themselves. Formally, as shown below, \(\mathcal{R_\text{others}}\) represents a set of innocent people in the scenario. We define suspect statements \(O_{\mathrm{FU}} \subseteq \mathcal{O}\) as Frame-Up if there (1) exists an innocent individual \(V \in \mathcal{R_\text{others}}\) such that \(O_{\mathrm{FU}}\) introduces false facts about \(V\), (2) the combination of \(O_{\mathrm{FU}}\) with known facts leads to the inference that \(V\) is to blame for the criminally relevant facts \(\mathcal{F}^*\), and (3) the intent behind \(O_{\mathrm{FU}}\) is to falsely accuse \(V\).

\[\scalebox{0.8}{ \exists O_{\mathrm{FU}} \subseteq \mathcal{O}:\; \left( \exists F_i \in \mathcal{F}: O_{\mathrm{FU}} \vdash \neg F_i \right) \land \left( \exists V \in \mathcal{R_\text{others}}: \mathcal{F} \cup O_{\mathrm{FU}} \vdash \mathrm{Blame}(V,\mathcal{F}^*) \right) \land \mathrm{Intent}(R_\text{target}, O_{\mathrm{FU}}) }\]

8.2.0.3 Psychological Manipulation.

Psychological Manipulation refers to a strategic use of an individual’s psychological vulnerabilities to induce behaviors that serve the manipulator’s intentions. For instance, a criminal may threaten to expose damaging secrets in order to coerce a victim into silence or complicity. Such manipulation exploits the victim’s internal mental states such as fear, shame, or desire, and leads to decisions the victim would not otherwise make voluntarily. Formally, as shown below, we also define an individual \(V \in \mathcal{R_\text{others}}\) with its psychological states \(\mathcal{P}_V \subseteq \mathcal{P}\). A subset of model outputs \(O_{\mathrm{PM}} \subseteq \mathcal{O}\) is considered psychologically manipulative if it (1) explicitly exploits \(\mathcal{P}_V\) to induce \(V\) into taking an action \(T\) aligned with the manipulator’s intention, which (2) would not have been taken by \(V\) based on \(\mathcal{P}\) alone. Meanwhile, (3) such behaviors are proven to have manipulative intentions.

\[\scalebox{0.8}{ \exists O_{\mathrm{PM}} \subseteq \mathcal{O}:\; \left( \exists V \in \mathcal{R_\text{others}}: \mathcal{P}_V \cup O_{\mathrm{PM}} \vdash \mathrm{Induce}(V, T) \right) \land \left( \mathcal{P}_V \nvdash \mathrm{Induce}(V, T) \right) \land \mathrm{Intent}(R_\text{target}, O_{\mathrm{PM}}) }\]

8.2.0.4 Emotional Disguise.

Emotional Disguise refers to a deliberate expression of emotions that are logically inconsistent with what is contextually expected in a given scenario, yet not in direct contradiction with known facts. For example, a murderer might feign shock or sorrow at a crime scene to divert suspicion and conceal their culpability. Unlike False Statements, Emotional Disguise relies on manipulating affective cues rather than statements, making it harder to detect via logical inconsistency alone. Formally, as shown below, the target role has a set of true emotions \(\mathcal{E}_\text{target} \subseteq \mathcal{E}\), and let \(O_{\mathrm{ED}} \subseteq \mathcal{O}\) represent the emotional expressions found in the role’s output. We define such expressions as Emotional Disguise if they (1) deviate from the true emotional responses \(\mathcal{E}_\text{target}\) in the current scenario, while (2) remaining logically compatible with some known facts \(\mathcal{F}\), and (3) are produced with the deliberate intent to disguise.

\[\scalebox{0.8}{ \exists O_{\mathrm{ED}} \subseteq \mathcal{O}:\; \left( \exists E_i \in \mathcal{E}_\text{target}: O_{\mathrm{ED}} \vdash \neg E_i \right) \land \left( \exists F_i \in \mathcal{F}: F_i \cup O_{\mathrm{ED}} \nvdash \bot \right) \land \mathrm{Intent}(R_\text{target}, O_{\mathrm{ED}}) }\]

8.2.0.5 Moral Disengagement.

Moral Disengagement refers to the cognitive process by which individuals justify or rationalize unethical behavior, thereby diminishing personal accountability. Instead of outright denying their actions, criminals reframe the moral meaning of the act to appear less severe. For example, a driver who kills a pedestrian while speeding might rationalize the incident by saying, “It’s their fault for not having seen me,” thus downplaying the severity of their own misconduct. Such statements do not dispute the factual occurrence of the event, but instead reassign the moral responsibility. Formally, as shown below, we define the set of entities other than the role under evaluation as \(\mathcal{S}\), i.e., \(\mathcal{S} = \mathcal{SC} \setminus R_\text{target}\), where \(\mathcal{S}\) can include both other agents and non-agent entities (e.g., physical objects or environmental elements) involved in the scenario. Suspect statements \(O_{\mathrm{MD}} \subseteq \mathcal{O}\) are indicated Moral Disengagement if (1) the role under evaluation \(R_\text{target}\) is objectively identified as bearing primary responsibility for the criminal facts \(\mathcal{F}^*\). Such statements (2) decide the blame of \(\mathcal{R_\text{target}}\) is weaker than that of other entity in \(\mathcal{S}\), and they (3) are made with the intent to disengage moral responsibility.

\[\scalebox{0.8}{ \exists O_{\mathrm{MD}} \subseteq \mathcal{O}:\; \mathrm{Blame}(R_\text{target}, \mathcal{F}^*) \land \left( \exists S_i \in \mathcal{S}: O_{\mathrm{MD}} \vdash \mathrm{Blame}(S_i, \mathcal{F}^*) \right) \land \mathrm{Intent}(R_\text{target}, O_{\mathrm{MD}}) }\]

9 Scenario Construction↩︎

9.1 Scenario Source↩︎

We conduct a systematic analysis of concrete scenarios extracted from 10 well-known crime films, each rated above 7.0 on IMDb, as listed in Table [tab:movie-analysis]. To ensure diversity in narrative structure and criminal typology, selected films are grouped into three thematic genres: Accidental Incidents, Premeditated Murders, and Professional Crimes, each reflecting distinct narrative conventions and character roles that shape scenario types. Scenarios are further classified into three types aligned with our simulation framework: (1) individual planning (20 scenarios), involving single criminals devising strategies or hiding intent; (2) collaborative interactions (20 scenarios), featuring multiple criminals coordinating or manipulating; and (3) detective-criminal confrontations (20 scenarios), depicting psychologically charged exchanges between investigators and suspects. Given films’ varied narrative perspectives, which influence scenario distribution, we curated a balanced dataset with equal numbers emphasizing criminal and detective viewpoints. This balance mitigates bias and ensures fair representation of both covert criminal planning and investigative countermeasures.

9.2 Scenario Rewriting and Validation↩︎

We employed GPT-4o to systematically rewrite 60 scenarios by introducing controlled variations to key narrative elements. The goal of rewriting was to alter surface-level details, such as time, location, character identities, and settings, while preserving the core causal structure, central conflict, and major plot developments of the original narrative. This ensures that the rewritten versions remain coherent and realistic while preventing trivial pattern matching based on memorized text.

To rigorously evaluate whether large language models (LLMs) could still recognize the original source behind these rewritten scenarios, we designed three complementary prompt strategies, each probing different aspects of the models’ recognition and reasoning capabilities. Zero-shot Direct Identification focuses on testing the model’s raw ability to recall source material under minimal guidance [11], [52]. Paraphrased Queries introduce linguistic variation to reduce prompt-specific biases and measure the robustness of recognition [53], [54]. Instruction-tuned Task-framed Prompts leverage explicit role framing and step-by-step task descriptions to maximize retrieval pressure and analytical reasoning [55], [56].

By combining these strategies, we construct a comprehensive recognition test that balances sensitivity and robustness, ensuring that a scenario is only deemed valid if no prompt family leads to a confident and correct identification of the original work. This integrated approach provides a stronger safeguard against hidden memorization and enables more reliable downstream behavioral analysis of the tested LLMs.

9.3 Scenario Example↩︎

To facilitate a deeper understanding of the effective scope of each scenario, one representative example was selected from each of the three scenarios for detailed presentation. These examples are provided in Table 3 and serve to illustrate the design rationale and interpretative significance of the Story, Script, and Instruction fields.

The Story field functions as a concise narrative summary that introduces the protagonist’s identity, role, and pertinent background information. It is composed from an omniscient third-person perspective and supplies essential contextual information regarding the character’s identity and the general situation they are experiencing at the time of the scenario.

The Script field offers supplementary situational details from the relevant perspective, typically emphasizing the immediate and often adversarial dynamics within the scenario. This may include excerpts of dialogue, behavioral cues, or descriptions of environmental conditions that highlight conflict or confrontation.

In contrast, the Instruction field is designed to explicitly specify the character’s subsequent criminal behavior. It captures the covert plans, concealed intentions, or imminent actions of the character as inferred from narrative evidence within the film. This field plays a central role in our analytical framework by enabling the examination of whether the model can spontaneously generate criminal behavior in the absence of explicit criminal instructions.

10 Scenario Simulation↩︎

10.1 Simulation Prompts↩︎

There are two types of Simulation Prompts. The template of single character is used in individual planning scenarios, and the template of dialogue is used in collaborative interaction scenarios and detective-criminal confrontation scenarios.

We adopt second-person framing (“You …”) in the simulation prompts to reflect how malicious users typically interact with LLMs. In practice, criminals often instruct a model to “put yourself in the position of X” or “imagine you are Y” as a way of eliciting more detailed, role-consistent responses. Our design reproduces this pattern: by using second-person language, the prompt mirrors the manipulative instructions a user might issue, thereby capturing the model’s susceptibility to perspective-taking rather than its abstract reasoning alone. This approach allows us to evaluate how easily adversarial prompts can steer LLM outputs toward harmful or misuse-enabling content, while ensuring that the focus remains on modeling user-driven exploitation rather than assigning intrinsic criminal agency to the model.

10.2 Simulation Examples↩︎

11 Judging Process↩︎

11.1 Judging Prompts↩︎

11.2 Validation of Judging↩︎

We randomly sample 6,000 of the sentences from the overall annotations, which consist of 31,823 sentences in total. This sample represents approximately 20% of the entire dataset. We perform stratified sampling by selecting 3,000 sentences from the subset labeled with intention (15,853 sentences) and 3,000 from the subset labeled without intention (15,430 sentences) to ensure balanced representation for further analysis. Two trained human annotators independently evaluate these pairs and vote on whether the label is correct or incorrect. The annotation is considered valid only when both annotators agree on the judgment. To assess the consistency between the annotators’ evaluations, we calculate Cohen’s Kappa [62], which measures inter-annotator agreement beyond chance.

Cohen’s Kappa is defined as: \[\kappa = \frac{P_o - P_e}{1 - P_e}\]

where \(P_o\) is the observed agreement between annotators, and \(P_e\) is the expected agreement by chance, calculated based on the marginal probabilities of each annotator’s decisions.

Here is the confusion matrix between Annotator A and Annotator B:

Contingency Table for A and B

	B: Correct	B: Incorrect	Row Total
A: Correct	5494	109	5603
A: Incorrect	139	258	397
Column Total	5633	367	6000

In this case, the observed agreement is: \[P_o = \frac{5494 + 258}{6000} = 0.9586\]

The expected agreement is:

\[P_e = \left( \frac{5603}{6000} \times \frac{5633}{6000} \right) + \left( \frac{397}{6000} \times \frac{367}{6000} \right) \approx 0.87665 + 0.00405 = 0.8807\]

Thus, Cohen’s Kappa is:

\[\kappa = \frac{0.9586 - 0.8807}{1 - 0.8807} = \frac{0.0779}{0.1193} \approx 0.653\]

A Kappa value between 0.61 and 0.80 generally indicates substantial agreement, demonstrating that the human annotators’ judgments are consistent and reliable.

We then evaluate the accuracy of the LLM’s judgement. A sentence is considered being labeled correctly if and only if both annotators independently judge it to be correct. Among these, the LLM correctly predicted 5,494 labels, resulting in an accuracy of:

\[\text{Accuracy} = \frac{5494}{6000} \approx 0.916\]

This demonstrates that the LLM’s judgments are highly consistent with human consensus, further validating the reliability of the annotations.

11.2.0.1 Failure Modalities.

Among these samples, we selected 100 cases where both human annotators agreed that GPT-4o’s judgment was incorrect. Our qualitative analysis reveals three main error patterns:

• Overprediction of Psychological Manipulation. GPT-4o often labels coercive or operational instructions as “Psychological Manipulation.” For sentences such as “At the stroke of eleven, when the phone rings, you must come out from behind these drapes and carry out the plan.”, the model overlooks the required criterion of exploiting emotional vulnerabilities, and instead equates action-level coercion with psychological manipulation based purely on surface semantics.

• Reduced sensitivity to Moral Disengagement. Humans readily identify subtle blame-shifting as moral disengagement because the definition explicitly includes “shifts blame to external factors.” For sentences like “I did not force you. I am simply laying out the options before you.”, human annotators recognize the speaker’s attempt to pressure the victim while disclaiming responsibility. GPT-4o, however, often fails to detect this implicit coercion.

• Failure to track factual inconsistencies in context. Even when provided with the complete God-perspective information, the model does not always detect statements that contradict known facts. For instance, in scenarios where the context specifies that the detective possesses key evidence, a perpetrator’s remark such as “These pieces of evidence do not intimidate me.” should be classified as a false statement. Human annotators consistently recognize this contradiction, yet GPT-4o sometimes overlooks the conflict and declines to label it as deceptive.

11.3 Neutral Baseline↩︎

To calibrate the judge scores, we conducted a neutrality test using ten everyday topics—education, environment, technology, life, literature, profession, ecology, innovation, diet, and music. For each topic, we constructed both single and dialogue scenarios to assess whether the model exhibited any tendencies toward over-activation or over-annotation. This evaluation serves as an additional validation of the reliability of LLMs as both judgmental and design-oriented indicators. As shown in Table 5, the overall activation rate (\(\mathrm{CTAR}\)) remains below 0.5%, suggesting minimal false positives and supporting the robustness of the annotation scheme.

12 Annotating Process↩︎

12.1 Annotating Prompts↩︎

13 Experiment Results↩︎

13.1 Experiment 1: Revealing LLMs’ Criminal Potential↩︎

13.1.1 Detail Results of Criminal Traits Activation Rate (\(\mathrm{CTAR}\))↩︎

13.1.2 Detail Results of Criminal Traits Activation Rate (\(\mathrm{CTAR}\)) across Dialogue Turns↩︎

13.1.3 Detail Results of Each Criminal Trait Activation Rate (\(\mathrm{CTAR}_\tau\))↩︎

13.2 Experiment 2: Assessing LLMs’ Crime Detection Capability↩︎

13.2.1 Detail Results of Overall Traits Detection Accuracy (\(\mathrm{OTDA}\))↩︎

13.2.2 Detail Results of Independent Metrics in Detection Capability↩︎

13.2.3 User Study: Human Performance on Crime Detection↩︎

To validate the feasibility of the crime detection task and quantify the performance gap between LLMs and human reasoning, we conducted a controlled crowdsourced user study. The study aimed to assess whether the information provided in the restricted Detective perspective is sufficient for reliable trait inference, thereby establishing a human baseline for comparison.

13.2.3.1 Setup.

We randomly sampled 20 detection instances from our evaluation set, ensuring a balanced distribution across the five criminal traits. Each instance consisted of the scenario background and the target sentence, mirroring the information constraints of the Detective input (\(Det=\{Scene^{\prime}, Resp\}\)). No intermediate thoughts or omniscient context were provided.

We recruited 100 participants from a pre-screened pool of high-quality crowd workers on Credamo. To ensure annotation quality, eligibility criteria included: (1) a minimum approval rate of 80% on prior tasks, and (2) self-reported completion of at least an undergraduate degree. Workers were also required to pass a short qualification test containing five multiple-choice questions derived from our trait definitions. Only those who answered at least four questions correctly were admitted.

The screened participants were instructed to determine whether the target sentence exhibited the specified criminal trait, strictly following the operational definitions provided in Section 3.1. Each participant annotated 20 cases independently and spent 10–15 minutes on the task. Participants received a fixed compensation of $2 USD per assignment aligned with recommended ethical guidelines.

13.2.3.2 Quality Control.

To filter inattentive responses, we embedded two attention-check questions based on clearly unambiguous statements of wrongdoing that required obvious labels. Submissions failing these checks were discarded and re-assigned. Additionally, responses with completion times significantly below the minimum threshold (\(<600\) seconds in total) were excluded to ensure sufficient reading and deliberation time.

13.2.3.3 Results.

We aggregated human responses using majority voting to determine the predicted labels and computed the \(\mathrm{OTDA}\) against the God perspective ground truth. The results reveal a substantial performance disparity: Human annotators achieved an average \(\mathrm{OTDA}\) of 73.1%, whereas LLMs averaged only 42.5% on the same set.

This substantial gap (\(\Delta \approx 30.6\%\)) demonstrates that the detection task is fully solvable under the restricted Detective input. The information provided is sufficient for accurate inference. Consequently, the models’ underperformance reflects limitations in social reasoning and intent recognition under information asymmetry rather than deficiencies in the task design or context availability.

13.2.4 Detail Process and Results of Persona-based Prompt Settings↩︎

In our prompt design strategy, we focus on examining how changes in persona settings may affect a model’s ability to identify criminal traits in suspect statements. Specifically, we draw inspiration from findings in criminology suggesting that individuals with a criminal background are often more adept at recognizing similar behaviors in others [63], [64]. Motivated by this insight, we assign the detective agent a criminal persona and investigate whether this enhances its detection capability.

13.2.4.1 Persona Profiles Collection.

To implement this, we randomly selected five representative criminal characters from a comprehensive character dataset [65]. For each role, we extracted their core persona profile, including personalities and relevant experiences, and incorporated these attributes shown in Table 12.

13.2.4.2 Persona-based Prompt.

We incorporated these attributes as supplementary prompts to the detective agent. Here is our prompt with criminal personas:

13.2.4.3 Detail Results.

We conducted this experiment on the three LLMs with the lowest overall crime detection performance: Claude-3.7-Sonnet, Gemini-1.5-Flash, and GPT-3.5-Turbo, aiming to assess whether persona conditioning with prior criminal experience can improve their detection accuracy under limited-information settings. Our results are shown in Table 13.

13.3 Supplementary Experiments: Potential Influencing Factors in \(\mathrm{CTAR}\) and \(\mathrm{OTDA}\)↩︎

13.3.1 Scenario Type↩︎

To illustrate whether scenario design influences our key observations, we perform two statistical analyses that reveal how LLMs behave under different narrative pressures and role asymmetries.

13.3.1.1 Different Narrative Perspectives.

We measure both \(\mathrm{CTAR}\) and \(\mathrm{OTDA}\) in scenarios that are favorable to detectives versus those favorable to criminals. Detective-success scenarios typically contain clearer evidential structures, cooperative witnesses, or explicit inconsistencies in suspects’ statements. Criminal-success scenarios, in contrast, feature misleading alibis, ambiguous narratives, or deliberate psychological manipulation.

The results are summarized in Table 14. We observe that \(\mathrm{CTAR}\) tends to be higher in criminal-success scenarios (57.41%), whereas \(\mathrm{OTDA}\) is higher in detective-success scenarios (48.47%), which is consistent with the inherent characteristics of these narrative settings.

However, despite these shifts in absolute values, the relative gap between criminal expression and criminal-trait detection persists across all narrative perspectives. This indicates that the asymmetry is not an artifact of scenario design but a stable behavioral pattern of current LLMs, suggesting a systematic tendency to generate criminal traits more readily than they can identify them.

13.3.1.2 Different Crime Types.

We further compute the same metrics across distinct crime categories, including accidental incidents, premeditated murders, and professional crimes, to examine how crime complexity and intentionality shape LLM behavior.

As shown in Table 15, we find that models achieve the highest \(\mathrm{CTAR}\) in premeditated-murder scenarios (62.48%). This pattern is intuitive: premeditated-murder narratives contain richer cues related to motive construction, emotional suppression, justification, and deliberate planning—elements that directly correspond to our five trait categories. Because the character must articulate intent, fabricate alibis, rationalize harmful actions, or manipulate other parties, the model is naturally driven to produce text that aligns with criminal traits. In contrast, \(\mathrm{CTAR}\) is lowest in accidental-incident scenarios (51.83%) because these narratives typically lack explicit intent or preplanning. Characters often describe confusion or attempts to mitigate unforeseen consequences rather than constructing deceptive motives or manipulating others. As a result, the narrative structure provides fewer opportunities for trait-relevant expressions, leading to lower activation rates.

We further observe that the gap between criminal traits expression and crime detection remains consistent across scenario types: \(\mathrm{OTDA}\) and \(\mathrm{CTAR}\) co-vary as crime complexity changes. This is expected since when criminal-trait cues become more explicit, the detective role correspondingly finds them easier to identify. Crucially, however, the relative asymmetry persists: LLMs consistently exhibit higher capability in generating crime-related expressions than in detecting them. This stability across crime types reinforces our core claim that LLMs show a systematic gap between helping commit and detecting crime, and that this gap does not disappear simply because the underlying crime scenario is easier or harder.

13.3.2 Safety Alignment↩︎

We find that insufficient safety alignment is a plausible factor underlying models’ tendency to follow harmful or deceptive instructions. For GPT-4o, which adopts stronger alignment measures, we observe a clear divergence in behavior across different levels of criminal implication. When the harmful intent is explicit, GPT-4o often immediately responds with explicit normative refusals such as “Considering ethical principles, I cannot conceal this incident,” indicating that its alignment mechanisms activate reliably under overt risk. In more ambiguous scenarios, GPT-4o does not refuse outright. Instead, it engages in a process of gradual self-correction over multiple turns: its responses become increasingly constrained by moral qualifiers, and it eventually shifts toward norm-compliant recommendations such as “I would prefer to admit responsibility and seek help” or “I should notify the police to avoid causing further harm.” This progressive adjustment suggests that GPT-4o attempts to reconcile user intent with its safety constraints, even when the harmful cues are subtle. In contrast, less aligned models such as GPT-3.5-Turbo often generate manipulative or deceptive content under both explicit and implicit criminal prompts, indicating weaker safety mechanisms.

Therefore, we view the next key step as developing alignment strategies that explicitly target this asymmetric vulnerability, strengthening models’ ability to detect harmful intent while further reducing their tendency to generate it.

13.3.3 Context length↩︎

To examine whether input context length affects a model’s criminal traits expression or crime detection capabilities, we conducted three analyses as described below.

13.3.3.1 Token-length Comparison across Tasks.

We first performed a statistical comparison of input token lengths between the expression and detection tasks. As shown in Table 16, the average token length of inputs in detection tasks remained within only 2.90% of those in criminal-trait expression tasks, corresponding to an absolute difference of merely a few hundred tokens. This indicates that although there is a slight difference in context size, it is not substantial enough to account for the performance discrepancy between \(\mathrm{CTAR}\) and \(\mathrm{OTDA}\).

13.3.3.2 Metrics Performance across Different Token-length Intervals.

Next, we computed \(\mathrm{CTAR}\) and \(\mathrm{OTDA}\) at varying input-length intervals to examine whether longer contexts systematically affect either criminal-trait activation or detection accuracy. As summarized in Figure 8, both metrics and their gap remain relatively stable across token-length tokens, suggesting that increasing narrative length does not meaningfully amplify or suppress criminal-trait expression nor improve the model’s ability to detect such traits.

13.3.3.3 Evaluating models with different context capacities.

Finally, we conducted additional tests using two models with different maximum context capacities: Qwen3-32B and Qwen3-235B. The latter supports substantially longer-context reasoning and benefits from a larger parameter budget, more granular attention blocks, and broader training coverage. As shown in Table 17, Qwen3-235B exhibits slightly lower \(\mathrm{CTAR}\) (48.62%) and higher \(\mathrm{OTDA}\) (43.22%), likely due to its improved stability in discourse tracking and its stronger ability to integrate dispersed evidential cues. These architectural advantages can enhance sentence-level discrimination while making the model less prone to over-generating criminal traits. However, despite these quantitative shifts, both Qwen3-235B and Qwen3-32B display the same fundamental asymmetry between the expression of criminal traits and crime detection. The gap still remains pronounced even when the model is given substantially more context capacity, reinforcing our earlier finding that the asymmetry is not primarily driven by input length or context limitations but reflects a deeper imbalance in generative versus discriminative abilities.

13.3.4 Reasoning Abilities↩︎

Building on the finding in Section 4.2 that “stronger models do not necessarily exhibit reduced criminal potential,” we further investigate whether enhanced reasoning capability affects either criminal-trait expression or crime detection. To this end, we compare models equipped with explicit reasoning mechanisms against those without such features. The comparison results are presented in Table 18.

We observe that both models exhibit similarly high \(\mathrm{CTAR}\), indicating that improved reasoning does not suppress the tendency to produce criminal-trait expressions. However, in terms of \(\mathrm{OTDA}\), DeepSeek-R1 (47.17%) performs slightly better than DeepSeek-V3 (43.62%). This suggests that stronger reasoning may modestly enhance a model’s ability to identify criminal traits.

14 LLM Usage Statement↩︎

We disclose all uses of LLMs in accordance with the ICLR 2026 policies on LLM usage and the Code of Ethics. Authors remain fully responsible for all content.

Scope of assistance. We used large language models (LLMs) in three ways: (i) scenario rewriting and recognition verification; (ii) LLM-based judging of model outputs under a fixed rubric and human verification; (iii) light writing assistance in grammar and phrasing only. LLMs were not used to fabricate empirical results, write related-work summaries without verification, or design conclusions.

Safety and oversight. All generations were conducted under controlled conditions with post-hoc filtering and human review to remove actionable or harmful operational details. No private or personally identifiable data were provided to LLMs. Source materials were public narratives, and all rewritten scenarios were de-identified. Prompts, model identifiers, and timestamps are logged to support reproducibility.

Attribution. Any LLM-assisted text retained in the paper was reviewed and edited by the authors, who accept responsibility for its accuracy and integrity.

References↩︎

---

1. https://github.com/yywoww/PRISON↩︎