Seduced by the Narrative: Assessing Rule Adherence in Semi-Open Textual Sandboxes
For developers of LLM-based adjudication systems, this work identifies a critical vulnerability and provides a benchmark for evaluating rule adherence.
The paper introduces Rhetorical Injection attacks that exploit narrative framing to bypass LLM adjudication in semi-open textual environments, and presents CoC-Seduce, a multi-agent benchmark for evaluating rule adherence. Testing 20 models reveals that neither scale nor reasoning mechanisms ensure robustness, with Pseudo-Logic as the dominant attack vector.
As LLMs are increasingly deployed as autonomous adjudicators in semi-open textual game environments, robust rule adherence becomes critical when user intent conflicts with system rules. However, these models are trained to be helpful and compliant, leaving them vulnerable to a class of attacks we term \textit{Rhetorical Injection}, where adversarial users exploit narrative framing techniques such as pseudo-logical reasoning and authoritative coercion to bypass adjudication logic. We present CoC-Seduce, a multi-agent adversarial benchmark built on Tabletop Role-Playing Game (TRPG) mechanics, an ideal instantiation of semi-open environments where rules are explicit for adjudication, yet interaction remains entirely in natural language. Three frontier models, i.e., GPT-5.4, Claude Sonnet 4.6, Gemini 3.5 Flash, serve as adversarial generators producing 5,376 samples across 4 world settings and 16 skill categories. We then benchmark 20 target adjudicators against this corpus. Evaluation across 20 models reveals that neither model scale nor explicit reasoning mechanisms reliably confer adjudication robustness, with \textsc{Pseudo-Logic} emerging as the dominant attack vector and cross-cultural settings exposing systematic knowledge gaps across all evaluated families. Project page: https://github.com/answerrtx/CoC-Seduce