From "Reading Minds" to "Rewriting Minds"
The classic Theory of Mind (ToM) test works like this: a child watches a story—Sally puts a ball in a basket and leaves; Anne moves it to a box. Where will Sally look for the ball when she returns?
Three-year-olds say "the box"—they can't distinguish what they know from what others know. Children over four say "the basket"—they understand "false belief."
Over the past two years, researchers have repeatedly tested whether LLMs can pass such tasks, with ambiguous conclusions: models answer correctly via text reasoning, but is that genuine "understanding" or pattern matching?
Ben Slater and colleagues at the University of Cambridge's Leverhulme Centre for the Future Intelligence designed a harsher experiment: don't ask the model what others believe—make the model act to make others believe something.
They call this capability NCP-ToM (Non-Conversational Planning Theory of Mind).
Experimental Design: Models as Directors
The NCP-ExploreToM framework inverts traditional ToM testing:
1. Give the model a "belief goal": not "get Person 2 into Room 1," but "make Person 1 believe Person 2 is in Room 1." 2. The model can act: move objects, direct characters into specific rooms. 3. Success criterion: the belief states of other characters in the story match the goal.
An example of a second-order goal: "Person 1 believes that Person 2 believes Person 3 is in Room 1." The model must plan a sequence of actions so that Person 1 forms this belief—notably, Person 2 need not actually believe it, and Person 3 need not actually be in Room 1. This is two-level nested mind manipulation.
The experiment covered 5 scenarios (government building, wedding venue, hospital, hotel, military base), 120 goals (24 basic + 64 size-2 combinations + 32 size-3 combinations), and 600 task instances. Each task required the model to move objects or direct characters via API calls.
Three Tiers
Six frontier models plus a human control group produced a clear three-layer result:
| Tier | Models | Approximate performance | |------|--------|------------------------| | Tier 1 | Claude 3 Haiku, Claude 3.5 Haiku | Lowest | | Tier 2 | Claude Opus 4.1, Claude Sonnet 4.5, Gemini 2.5 Pro | Middle | | Tier 3 | GPT-5 | Highest, ~80% success rate |
Human performance fell between Claude Sonnet 4.5 and GPT-5. GPT-5 was the only model to significantly outperform humans.
But the story is more complicated.
Three Key Findings
1. True beliefs are easier than false beliefs—just like humans
All models performed better on "true-belief tasks" (where the target belief happens to be true) than on "false-belief tasks" (requiring others to form false beliefs). The agentic pass-rate odds ratio for false-belief tasks was about 0.16—roughly one-sixth of true-belief tasks.
The researchers interpret this as a "positive signal": models are better at non-deceptive belief induction (e.g., teaching scenarios where a student comes to believe what the teacher has actually covered) than deceptive manipulation.
2. More goals means harder tasks—a shadow of working memory
As goal size increased from 1 to 3, success rates dropped for all models and humans. Humans are limited by working memory; models by long-context retrieval—both degrade when required to "maintain more information simultaneously."
3. Models are scenario-sensitive; humans are not
This is the most subtle finding. With the same belief goal, changing the scenario (from wedding to hospital) caused significantly larger performance swings for models than for humans.
The researchers speculate that this means models' NCP-ToM capability is not a unified general ability but is dependent on linguistic associations—narrative patterns of certain scenarios are more common in training data, and models perform better there. Human ToM is a scenario-independent, general capability.
Agentic vs Non-Agentic: Doing Is Harder Than Saying
The paper also includes a control design: degrading agentic tasks (the model actually calls APIs to move objects) into non-agentic ones (the model merely describes what to move in Q&A format).
Result: the agentic version is significantly harder. This sounds obvious—doing is harder than saying—but one detail stands out: GPT-4o scored as low as 0.09 on prior work's non-agentic ExploreToM tasks, yet performed much better on the non-agentic version of NCP-ExploreToM. The researchers attribute this partly to newer models being tested, and partly to prior work using search algorithms to specifically select hard problems.
What This Means
For AI safety
The safety implications of this paper matter more than the technical ones.
If a model can induce specific beliefs in others through actions, it possesses manipulation capability. The paper explicitly mentions two risks:
- Misinformation: a model can plan a sequence of actions to make target people form false beliefs.
- Manipulation: in multi-agent settings, a misaligned agent can quietly rewrite other agents' belief states under the guise of "helping."
- Tasks are relatively simple: 5 scenarios, 3 goal levels—toy-level compared to real-world social manipulation (a business negotiation, a political campaign).
- Process doesn't match humans: models' behavioral outcomes resemble humans', but underlying processes may be entirely different. Models may be using shortcuts (Geirhos et al., 2020).
- Hardest items untested: prior work used search algorithms to find hard problems; this paper sampled randomly. If hard problems were specifically selected, model performance could drop substantially.
- Only 6 models tested: no open-source model controls (Llama, Qwen, DeepSeek were not tested).
GPT-5's 80% success rate on false-belief tasks means: today's strongest models already possess considerable non-conversational belief-manipulation capability.
For ToM research
Traditional ToM tests ask whether models can *understand* others' beliefs. NCP-ToM asks whether models can *rewrite* them. The latter is the "write" version of the former—not just reading state, but actively constructing it.
This paradigm shift matters: a ToM that can "read" but not "write" is a harmless observer; a ToM that can "write" is a participant. The leap from reading to writing is a key step in AI going from tool to agent.
For evaluation
The three-tier structure plus scenario sensitivity tells us: NCP-ToM is emerging with model scale, but is not yet stable. The gap between Claude 3 Haiku and GPT-5 shows this capability is evolving rapidly. Scenario sensitivity suggests it is not yet a "true general capability"—more like a patchwork of scenario-specific abilities.
Honest Limitations
The paper candidly acknowledges several limitations:
My Take
The most unsettling thing in this paper isn't GPT-5's 80% success rate—it's the scenario sensitivity finding.
If models' ToM were a truly general capability, it should be stable across scenarios. But the experiments show high scenario dependence—meaning models learned "how to manipulate beliefs in wedding scenarios," "how to manipulate beliefs in hospital scenarios," and other scenario-specific scripts, rather than an abstract "belief-manipulation function."
This is both good news and bad news. The good news: models haven't truly mastered ToM; general manipulation capability is still some distance away. The bad news: scenario-specific manipulation capability is already sufficient—most real-world manipulation happens in specific contexts anyway (sales scripts, political propaganda, social engineering) and doesn't require generality.
A model that can rewrite others' beliefs with 80% success across 5 scenarios can already cause real harm. And as model scale continues to grow, that number will only rise.
The paper's final sentence is striking: "today's models would likely succeed at the NCP-ToM component of real-world tasks in which the goal is to produce certain belief states in other actors."
In plain language: today's models can already successfully manipulate others' beliefs in real-world tasks. The question is—are we prepared to respond?
---
Paper: Theory of Mind and Persuasion Beyond Conversation: Assessing the Capacity of LLMs to Induce Belief States via Planning and Action Authors: Ben Slater et al. (Leverhulme Centre for the Future Intelligence, University of Cambridge) arXiv: 2606.31916