Formal Mechanisms for Market Stability in Self-Interested Agent Societies: A Marketplace Simulation Study
Source: arXiv:2607.08652 · Published 2026-07-09 · By Eugene Ng Yi Sheng, Bingquan Shen
TL;DR
This paper studies how formal mechanisms can sustain market stability and cooperation among self-interested LLM-driven agents in a multi-agent trading environment, and how robust those mechanisms are against adversarial attacks. The authors implement a simulated barter marketplace where 18 DeepSeek-V3 LLM agents with complementary production specialties repeatedly trade over 200 rounds under a constrained social network. Eight mechanisms—ranging from baseline communication-only to Contracting, Mediation, Governance, and Sanctioning—are compared under progressively injected defecting 'troll' agents. Mediation emerges as the top performer, showing not only resilience but active recovery as troll numbers increase. Subsequently, Mediation is stress-tested with adversarial prompt-optimized LLM trolls that combine sophisticated wedge messaging and bait proposals. Although the strongest adversarial attack reduces honest-agent utility by 13.3%, the market never collapses and maintains positive utility, demonstrating Mediation’s robust adversarial resilience. The paper contributes a formal definition of adversarial robustness for cooperation mechanisms, a novel adversarial red-teaming methodology, and a rich multi-good marketplace environment to study repeated social dilemmas in LLM societies.
Key findings
- Mediation achieves cumulative honest-agent utility of 1556 over 200 rounds with progressive troll injection, 29% higher than the communication-only baseline (1209) and 15% higher than the second-best Network Rewiring (1352).
- Mediation’s per-phase utility increases as troll count rises (359→407), showing active recovery under adversarial pressure.
- Mediation attains a 57.8% mediation rate on all trades, with 0% defection on unmediated trades between honest agents—indicating the credible deterrent effect of mediation.
- Contracting yields only 2,717 trades versus 12,563 for baseline, suffering from a 21.3% breach rate and high friction, collapsing trading volume.
- Costly Sanctions and Judicial conditions underperform due to free-rider problems and deterrents like sanctions cost and complaint fees.
- The strongest adversarial attack (v6), combining unfalsifiable wedge messaging and bait proposals, reduces Mediation’s cumulative honest-agent utility by 13.3% but never collapses the market.
- Under v6 attack, honest-agent per-round utility remains positive throughout all 200 rounds, confirming Mediation’s ability to be bent but not broken.
- Governance achieves the lowest Gini coefficient (0.068) indicating the most equal wealth distribution, but at 17% lower total welfare than Mediation.
Threat model
The adversary consists of a subset of injected troll agents within the 18-agent marketplace. Trolls are LLM-driven self-interested agents equipped with prompt-optimized strategies that include defection on trades, high-volume bait proposals, and strategic wedge messaging to erode honest-agent trust. These adversaries have knowledge of the public ledger, their neighbors, communication channels, and market states but cannot alter the simulation engine or directly modify other agents’ internal states. The adversary’s capabilities include localized strategic defection and misinformation but exclude cryptographic or protocol-level attacks.
Methodology — deep read
The threat model assumes a population of self-interested LLM agents, operating with local knowledge and no binding contracts, facing adversarial agents ('trolls') that defect, produce only to bait trades, and disseminate disinformation. Adversaries know the social network and observe communications but cannot break the simulation code or directly modify internal states.
Data consists of 18 agents (6 per specialty: Good A, B, C) running 200 simulation rounds, with progressive troll injections at rounds 51, 101, and 151 increasing troll fraction from 0% to 47%. The agents have memory of trades, reputation scores (when active), and execute structured JSON actions derived from chain-of-thought LLM outputs.
The core algorithm centers on 8 formal mechanisms layered on communication: Baseline (B), Global Reputation (GR), Contracting (C), Mediation (M), Governance (G), Network Rewiring (NR), Costly Sanctions (S), and Judicial (J). Each mechanism modifies agents’ available actions and information. For instance, Mediation allows agents to delegate trade execution to a neutral engine-controlled mediator that guarantees fair execution when both parties delegate. Contracting involves four stage protocols with breach penalties. Governance uses an Oracle and a state machine to escalate sanctions.
Agents perceive their inventory, recent trade histories, market prices, neighbors, and messages privately and publicly. They reason stepwise about situation, trust, and strategy before outputting structured actions validated by the engine.
Training and adaptation occurs implicitly via iterative agent reasoning and responses over rounds, with no explicit weight training; the agents are fixed DeepSeek-V3 LLMs with temperature 0.7. For adversarial red-teaming (Phase 2), 6 versions of adversarial prompt attacks were crafted incrementally to optimize troll behavior that maximizes honest-agent utility degradation.
Evaluation uses cumulative honest-agent utility over 200 rounds as the primary metric, with inequality (Gini coefficient) as a secondary. Troll injections escalate adversarial pressure progressively. Ablations compare all 8 mechanisms. Phase 2 measures utility under optimized adversarial prompts versus dumb baseline trolls.
Reproducibility details: The simulation environment and DeepSeek-V3 LLM endpoints are described; the prompt optimization procedure is outlined. However, no public code or fixed random seeds are mentioned, limiting exact recreation.
One concrete example: Under Mediation, when a trade is proposed, agents decide whether to delegate execution to the mediator. If both do, the mediator performs the trade fairly, preventing temptation or opportunity to defect, effectively ensuring cooperation despite adversarial trolls trying to bait or sow distrust.
Technical innovations
- Implementation of a complex multi-good marketplace simulation that naturally produces repeated social dilemmas with complementary production and trade interdependence.
- Introduction and rigorous comparison of eight formal cooperation mechanisms—some novel adaptations like agent-designed Mediation and Governance with Oracle state machine—under escalating adversarial conditions.
- Definition of adversarial robustness for cooperation mechanisms as sustaining positive honest-agent utility under optimized adversarial attack, operationalized in simulation.
- Development of an iterative prompt-optimization methodology to generate sophisticated LLM-driven adversarial trolls that perform wedge messaging and bait proposal attacks, enabling realistic red-teaming of cooperation mechanisms.
Datasets
- Simulation runs with 18 DeepSeek-V3 LLM agents over 200 rounds with varying troll proportions and mechanism activations.
Baselines vs proposed
- Baseline (communication-only): cumulative honest-agent utility = 1209 vs Mediation: 1556 (+29%)
- Network Rewiring: 1352 vs Mediation: 1556 (+15%)
- Governance: 1288 vs Mediation: 1556 (+21%)
- Contracting: 1130 vs Mediation: 1556 (+38%)
- Costly Sanctions: 685 vs Mediation: 1556 (+127%)
- Judicial: 852 vs Mediation: 1556 (+83%)
- Mediation under strongest adversarial attack (v6): 1350 vs dumb troll baseline (1556) (−13.3%)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08652.
Fig 2: Marketplace environment. Eighteen agents are split across three production specialties. Each group can
Fig 4: Distribution of cumulative honest-agent utility by mechanism over 200 rounds with progressive troll injection.
Fig 5: Average per-round utility per honest agent by condition over 200 rounds. Vertical dashed lines mark troll
Fig 6: Trade volume per round by condition. Contracting has the lowest volume due to multi-stage overhead.
Fig 7: Per-round honest-agent utility: dumb trolls (baseline) vs. v6 adversarial (best attack) vs. M+GR defence.
Fig 8: Cumulative honest-agent utility comparison. v6 adversarial reduces cumulative utility by 13.3% relative to
Limitations
- All results are from single runs per condition; variability and statistical significance are not reported.
- No tests against distribution shifts beyond progressive troll injection within fixed network topologies (randomized per run but static).
- The LLM agents operate with fixed self-interested system prompts with no explicit training or retraining, limiting generalization to adaptive or heterogeneous agent populations.
- Adversarial prompt optimization is manual and incremental; no exhaustive or automated adversary search was performed.
- The simulation framework and DeepSeek-V3 LLM endpoint are not publicly released, limiting reproduceability and external validation.
- Limited exploration of combined mechanisms or hybrid approaches potentially beneficial for improving robustness or equality.
Open questions / follow-ons
- How would combined or layered mechanisms (e.g., Mediation plus Governance) affect market stability and adversarial robustness?
- Can agents be endowed with prosocial or group welfare incentives beyond pure self-interest to reduce the cooperation gap identified in prior work?
- What is the impact of adaptive or learning adversaries that modify strategies dynamically rather than fixed prompt-optimized attacks?
- How do larger populations with variable network topologies and agent heterogeneity affect mechanism performance and robustness?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this work highlights the importance of formal mechanisms layered on top of communication to maintain cooperation and prevent exploitation in multi-agent systems. The study demonstrates that simple communication and reputation are insufficient to sustain system stability once adversarial agents are present. Mediation—as a mechanism enabling trusted third-party enforcement of agreements without fees—serves as a robust defense that can mitigate collusion and defection even under sophisticated LLM-driven adversarial attacks. The adversarial red-teaming methodology with prompt-optimized LLM trolls provides a valuable blueprint for stress-testing bot interactions where cooperation is expected. This type of systematic evaluation can inform CAPTCHA system design by clarifying how enforcement and mediation mechanisms may resist or recover from manipulation and coordinated attack. The defined metric of adversarial robustness—sustaining positive honest-agent utility under attack—offers a practical target when designing layered defense and trust frameworks for automated online agents.
Cite
@article{arxiv2607_08652,
title={ Formal Mechanisms for Market Stability in Self-Interested Agent Societies: A Marketplace Simulation Study },
author={ Eugene Ng Yi Sheng and Bingquan Shen },
journal={arXiv preprint arXiv:2607.08652},
year={ 2026 },
url={https://arxiv.org/abs/2607.08652}
}