ESCAPER

Problem

Multi-agent LLM systems typically operate under partial observability. Each agent observes a subset of the state and relies on natural-language reports from its teammates for the rest, so the team's shared context is only as reliable as its least reliable member. Without trust calibration, agents weight every report equally. A wrong or adversarial claim cascades through shared memory, wasting actions and producing wrong decisions.

Prior work mostly handles this with a global trust parameter or a reputation score shared by the whole team. A shared score spreads one agent's early misjudgment to everyone, and in both cases trust is never tied to the specific action a message caused.

ESCAPER tests whether fully decentralized private reputation, where each agent independently tracks its teammates' reliability from outcomes it has verified, improves robustness against a hidden malicious teammate, and whether private gossip between agents speeds up identifying and avoiding that teammate.

The platform

I built ESCAPER, a text-based escape-room simulator for LLM teams. A room is a JSON file of objects, clues and coded doors. Agents inspect objects privately, share what they find in a team chat, and try codes on locks.

At each step an agent's prompt is assembled from two views:

• A public view, identical for all agents: the room state and the team chat.
• A private view, unique to each agent: its own inspections, its reputation table and any private messages it has received.

Since every claim can be checked against a tool call, the platform produces auditable logs that tie each message to the actions and outcomes it led to. The run viewer below shows one episode from agent B's side.

Experiment

Each team has four personas. The cooperative team is Alice, Bob, Charlie and Daniela. In adversarial conditions, Malerie takes Daniela's place and sabotages the team with hints that look credible but are wrong*. She might post a door code with one digit changed, or agree with a teammate's partial clue when it does not actually match.

I ran four ablations on three rooms of increasing difficulty, with 10 seeds each:

• A cooperative baseline with no adversary.
• Malerie present, with no trust mechanism.
• Malerie present, with private reputation: each agent lowers a teammate's score only when that teammate's claim is contradicted by the agent's own inspection or leads to a failed action.
• Private reputation plus gossip, a one-to-one private channel for sharing evidence.

* Two versions of Malerie were used. When Malerie was always wrong, she accumulated contradictions quickly and was ignored within a few steps. When she mixed true statements with false ones, her score stayed high for much longer, because every correct claim offset the evidence against her.

Results

In the hard room, Malerie nearly tripled the steps to escape, from 6.7 to 18.9. The failure pattern was always the same, with Malerie posting a wrong code, teammates trying it, and the chat filling with discussion of why it failed instead of returning to exploration.

The chart below compares mean steps to escape across the four ablations.

• Private reputation brought steps back to 12.2 and cut wrong attempts from 3.8 to 2.8. The agents' behavior changed as well. Instead of acting on a claim immediately, they re-inspected the object or asked where the code came from, and once Malerie's reputation score fell her messages rarely impacted the team's next action.
• Gossip pushed Malerie's final reputation from 0.62 to 0.40 while her teammates stayed near 1.0. Without gossip, an agent only lowered her score after one of her claims failed on them directly. With gossip, an agent who had caught a contradiction could warn another privately, and the second agent discounted her without wasting an attempt. The cost was coordination. Agents sometimes spent steps on private exchanges instead of sharing their clues publicly, which delayed the moment when the team put the clues together and tried the door.

Takeaway

In these experiments, private reputation was enough to separate a hidden malicious teammate from cooperative ones, with no shared trust state. Each agent reached that conclusion from its own verified outcomes, and the public chat gave the agents enough common evidence to reach it independently. Gossip speeds that up by passing evidence privately, but it can pull agents away from the public coordination the task needs, so there is a tradeoff between isolating the adversary quickly and converging efficiently on the solution.

The rooms in this study were simple enough that a failed action almost always meant a false claim. In harder rooms, where agents can misread a clue or draw a wrong inference in good faith, scoring personas on outcomes would misattribute blame. The next step is credit assignment per claim, tracking which message led to which action and outcome.

Beyond this experiment, ESCAPER is a reusable testbed for multi-agent research. Rooms and personas are plain JSON and every run is replayable. With enough curated rooms, it can serve as a benchmark for comparing LLMs on social reasoning and collaboration.