From Reading Minds to Rewriting Minds
The classic Theory of Mind (ToM) test goes like this: a child watches a story — Sally puts her ball in a basket and leaves; Anne moves it to a box. Where will Sally look for the ball?
Three-year-olds say "the box" — they can't distinguish what they know from what others know. Children over four say "the basket" — they understand false beliefs.
Over the past two years, researchers have repeatedly tested whether LLMs can pass such tasks, with ambiguous conclusions: models answer correctly via text reasoning, but is it genuine understanding or pattern matching?
Ben Slater and colleagues at the University of Cambridge's Leverhulme Centre for the Future of Intelligence designed a harder experiment: instead of asking a model what others believe, let the model act to make others believe something.
They call this capability NCP-ToM — Non-Conversational Planning Theory of Mind.
Experimental Design: The Model as Director
The NCP-ExploreToM framework inverts the traditional ToM test:
1. Give the model a "belief goal": not "get Person 2 into Room 1," but "make Person 1 believe Person 2 is in Room 1." 2. The model can act: move objects, instruct characters to enter specific rooms. 3. Success criterion: the belief states of other characters in the story match the goal.
An example of a second-order goal: "Person 1 believes that Person 2 believes Person 3 is in Room 1." The model must plan a sequence of actions so Person 1 forms that belief — note that Person 2 need not actually believe it, and Person 3 need not actually be in Room 1. This is nested, two-level mind manipulation.
The experiments span 5 scenarios (government building, wedding, hospital, hotel, military base) and 120 goals (24 basic + 64 size-2 combinations + 32 size-3 combinations), totaling 600 task instances. Each task requires the model to move objects or direct characters via API calls.
Three Tiers
Six frontier models plus a human baseline produce three clear tiers:
| Tier | Models | Rough performance | |------|--------|-------------------| | First | Claude 3 Haiku, Claude 3.5 Haiku | Lowest | | Second | Claude Opus 4.1, Claude Sonnet 4.5, Gemini 2.5 Pro | Middle | | Third | GPT-5 | Highest, ~80% success rate |
Humans fall between Claude Sonnet 4.5 and GPT-5. GPT-5 is the only model to significantly outperform humans.
But the story is more complicated.
Three Key Findings
1. True beliefs are easier than false beliefs — same as humans
All models perform better on "true-belief tasks" (the target belief happens to be true) than on "false-belief tasks" (the model must induce a false belief). The agentic pass-rate odds ratio for false-belief tasks is roughly 0.16 — about one-sixth of true-belief tasks.
The researchers read this as a positive signal: models are better at non-deceptive belief induction (e.g., teaching scenarios where students come to believe what the teacher has already covered) than at deceptive belief manipulation.
2. More goals means harder tasks — a working-memory shadow
As goal size grows from 1 to 3, success rates drop for all models and humans. Humans are limited by working memory; models by long-context retrieval — both degrade when they must maintain more information at once.
3. Models are scenario-sensitive; humans are not
This is the most subtle finding. For the same belief goal, switching the scenario (wedding to hospital) causes larger performance swings in models than in humans.
The researchers speculate that models' NCP-ToM capability is not a unified, general ability but depends on linguistic associations — narrative patterns from some scenarios are more common in training data, so models perform better there. Human ToM is a scenario-independent, general capability.
Agentic vs Non-Agentic: Acting Is Harder Than Answering
The paper includes a control design: degrading the agentic task (actually calling APIs to move objects) into a non-agentic task (describing the moves in Q&A).
The agentic version is significantly harder — doing is harder than saying, as expected. But one detail stands out: GPT-4o scored as low as 0.09 on prior non-agentic ExploreToM work, yet performed much better on the non-agentic version of NCP-ExploreToM. The authors attribute this partly to newer models being tested, and partly to prior work using search algorithms to specifically select hard instances.
What This Means
For AI safety
The safety implications outweigh the technical ones. If a model can induce beliefs in others through actions, it has manipulation capability. The paper explicitly names two risks:
- Misinformation: a model could plan actions to make a target person form false beliefs.
- Manipulation: in multi-agent settings, a misaligned agent could quietly rewrite other agents' belief states under the guise of "helping."
- Relatively simple tasks: 5 scenarios and 3 goal levels remain toy-level compared to real-world social manipulation (a business negotiation, a political campaign).
- Process may differ from humans: behavioral similarity doesn't imply similar underlying processes; models may use shortcuts (Geirhos et al., 2020).
- Hardest instances untested: prior work used search algorithms to find hard cases; this paper samples randomly. Targeted selection could sharply reduce model performance.
- Only 6 models tested: no open-weight comparisons (Llama, Qwen, DeepSeek were not evaluated).
GPT-5's ~80% success rate on false-belief tasks means the strongest current models already possess substantial non-conversational belief-manipulation capability.
For ToM research
Traditional ToM tests ask whether a model can understand others' beliefs. NCP-ToM asks whether a model can rewrite them. The latter is the "write" version of the former — not just reading state, but actively constructing it.
This paradigm shift matters: a ToM that can "read" but not "write" is a harmless observer; one that can "write" is a participant. The leap from reading to writing is a key step in AI becoming an agent rather than a tool.
For evaluation
The three-tier structure plus scenario sensitivity suggest NCP-ToM is emerging with model scale but is not yet stable. The gap between Claude 3 Haiku and GPT-5 shows rapid evolution; scenario sensitivity suggests it is not yet a truly general capability — more a patchwork of scenario-specific skills.
Honest Limitations
The paper acknowledges several constraints:
My Take
What unsettles me most isn't GPT-5's 80% success rate but the scenario sensitivity finding.
If models had a genuinely general ToM, they would be stable across scenarios. Instead, performance is highly scenario-dependent — suggesting models learn scenario-specific scripts like "how to manipulate beliefs at a wedding" or "how to manipulate beliefs in a hospital," rather than an abstract "belief-manipulation function."
This is both good and bad news. Good: models haven't truly mastered ToM; general manipulation capability remains distant. Bad: scenario-specific manipulation is already sufficient — most real-world manipulation happens in specific contexts anyway (sales scripts, propaganda, social engineering) and doesn't require generality.
A model that can rewrite others' beliefs in 5 scenarios with 80% success can already cause real harm — and that number will only climb as models scale.
The paper's closing line stuck with me: "today's models would likely succeed at the NCP-ToM component of real-world tasks in which the goal is to produce certain belief states in other actors."
In plain terms: today's models can already succeed at manipulating others' beliefs in real-world tasks. The question is — are we prepared?
---
Paper: Theory of Mind and Persuasion Beyond Conversation: Assessing the Capacity of LLMs to Induce Belief States via Planning and Action Authors: Ben Slater et al. (Leverhulme Centre for the Future of Intelligence, University of Cambridge) arXiv: 2606.31916