ExploreToM: Adversarial ToM Data Framework

• ExploreToM is a program-guided adversarial data-generation framework for theory-of-mind reasoning that uses a symbolic simulator, a custom DSL, and A* search to create diverse, challenging scenarios.
• It tracks world state, first-order and second-order beliefs through deterministic action sequences, ensuring reliable labeling and a robust evaluation of model blind spots.
• Its adversarial generation approach exposes shortcut vulnerabilities in language models and serves as both a benchmark and fine-tuning source to enhance ToM reasoning.

ExploreToM is a program-guided adversarial data-generation framework for theory-of-mind (ToM) reasoning in LLMs. It was introduced as the first framework to allow large-scale generation of diverse and challenging theory-of-mind data for robust training and evaluation, with the explicit aim of overcoming the narrow coverage, recurring templates, and potential capability overestimation associated with earlier ToM benchmarks. Its core architecture combines a symbolic world-and-belief simulator, a custom domain-specific language (DSL), and $A^*$ search to generate plausible story structures that stress-test a target model, while labels are derived directly from tracked world state, first-order beliefs, and second-order beliefs rather than from model-produced answers (Sclar et al., 2024). Subsequent work has treated ExploreToM not only as a benchmark and training source, but also as a reference point for critiques of heuristic adversarial generation, for analyses of shortcut exploitation in ToM evaluation, and for agentic extensions that invert the original question-answering setup into belief-induction by action (Srishty et al., 19 May 2026, Sarangi et al., 21 Jul 2025, Zhong et al., 8 Jun 2026, Slater et al., 30 Jun 2026).

1. Origins, scope, and conceptual position

The motivating claim behind ExploreToM is that many ToM evaluations for LLMs rely on limited datasets with simple patterns, which can create blind spots in evaluation and encourage overestimation of model competence. In the original formulation, ToM is treated as the ability to reason about what each character knows, believes, or believes about another character’s beliefs. In story-based QA form, this includes tracking who saw which event, inferring outdated beliefs after unseen events, handling false-belief questions, handling second-order belief questions, separating world truth from agent-specific belief, and remembering prior states and perspective-specific access to information (Sclar et al., 2024).

ExploreToM is presented not merely as a benchmark but as a framework for controllable generation. Its intended uses are twofold: robust evaluation of current and future models, and construction of fine-tuning data that better targets the underlying reasoning skill. The original paper characterizes the framework as a “conceptual superset” of prior work. In that sense, ExploreToM is meant to subsume earlier benchmark families such as ToMi and Hi-ToM while extending them with additional action types, freer event ordering, explicit asymmetry modifiers, and adversarial search over story structure rather than reliance on a small set of fixed templates (Sclar et al., 2024).

Later literature has preserved this dual characterization. One study describes ExploreToM as a benchmark of “adversarially generated false-belief scenarios” that includes both structured (template-based) and narrative (LLM-infused) stories, and uses it as one of three principal ToM training domains for reinforcement-learning experiments (Sarangi et al., 21 Jul 2025). Another positions ExploreToM as “an important step” and “a leading example” of adversarial/programmatic ToM evaluation, while arguing that its search regime and task design under-target deeper recursive conflicts (Srishty et al., 19 May 2026). This makes ExploreToM a central reference point in the evolution from static ToM QA toward programmatic, adversarial, and eventually agentic evaluation.

2. Symbolic state, belief tracking, and the DSL

ExploreToM represents stories as sequences of symbolic actions over an explicitly tracked state. Formally, it defines a set of actions $\mathcal{A}$, a story state $s \in \mathcal{S}$, and a story as a sequence $(a_1,\ldots,a_n)$ in which each action is a function

$a_i: \mathcal{S} \rightarrow \mathcal{S}.$

The appendix further specifies that a state is comprised of a world state $ws$, first-order beliefs $b_1$, and second-order beliefs $b_2$. Thus the simulator tracks what is physically true, what each person believes about the world, and what each person believes about another person’s beliefs, with recursion implemented up to two levels (Sclar et al., 2024).

The DSL contains three families of primitives. Physical or world actions include $a_{\text{enter}}$, $a_{\text{leave}}$, $\mathcal{A}$0, $\mathcal{A}$1, and $\mathcal{A}$2. Communication actions include $\mathcal{A}$3, $\mathcal{A}$4, $\mathcal{A}$5, and $\mathcal{A}$6. ExploreToM also adds asymmetry modifiers, notably $\mathcal{A}$7 and $\mathcal{A}$8, to relax the symmetric-witness assumptions common in earlier datasets (Sclar et al., 2024).

A notable modeling choice is that the DSL groups many surface actions by belief-update semantics rather than by lexical form. Actions such as “peeling an apple” and “covering an apple in chocolate” can be treated identically if they amount to the same visible object-state change for belief tracking. This abstraction makes the symbolic substrate compositional while allowing later natural-language realization to vary independently (Sclar et al., 2024).

The worked example for the leave action illustrates the update discipline. For

$\mathcal{A}$9

the world state changes only in Beth’s room assignment, while belief updates depend on the witness set

$s \in \mathcal{S}$0

Witnesses update Beth’s location to “not kitchen”; non-witnesses retain the outdated value; and second-order beliefs are updated according to whether the observing agent believes the other agent witnessed the departure. This explicit update semantics is central to ExploreToM’s claim of reliable labeling, because every action alters both reality and the nested epistemic state in a deterministic way (Sclar et al., 2024).

3. Adversarial generation and question construction

ExploreToM’s pipeline has three stages. First, it samples a plausible story context with an LLM, jointly specifying names, roles, locations, objects, containers, and topics so that the environment remains coherent. Second, it performs adversarial story-structure generation using the DSL and $s \in \mathcal{S}$1 search. Third, it can optionally infill the symbolic action sequence into natural-language story text, though raw symbolic structures remain the preferred evaluation format because they are more reliable (Sclar et al., 2024).

The search space consists of valid action sequences up to $s \in \mathcal{S}$2 actions. Nodes are prefixes $s \in \mathcal{S}$3, and edges append $s \in \mathcal{S}$4 additional valid actions; in the reported experiments, $s \in \mathcal{S}$5. Controllable generation is handled by a Boolean condition

$s \in \mathcal{S}$6

which can encode constraints such as the number of people, number of rooms, and the number of actions drawn from an important subset of primitives. Search uses the standard decomposition

$s \in \mathcal{S}$7

where $s \in \mathcal{S}$8 is defined as the target model’s accuracy among all questions for $s \in \mathcal{S}$9, so lower values correspond to harder stories. The heuristic is

$(a_1,\ldots,a_n)$0

with sampled continuations $(a_1,\ldots,a_n)$1, continuation count $(a_1,\ldots,a_n)$2, and scale $(a_1,\ldots,a_n)$3. In the evaluation setting the paper uses $(a_1,\ldots,a_n)$4, $(a_1,\ldots,a_n)$5, $(a_1,\ldots,a_n)$6, and allows each story generation to evaluate 50 nodes (Sclar et al., 2024).

Adversarial targeting is operational rather than purely formal. The framework generates questions from the current symbolic state, asks the target LLM those questions, computes the resulting accuracy, and prioritizes continuations that further reduce that accuracy. Because evaluating all neighbors is expensive, the implementation restricts itself to a pre-defined constant number of neighbors, prioritized by closeness to satisfying the desired conditions. The paper does not claim heuristic admissibility or optimality under these approximations; $(a_1,\ldots,a_n)$7 is used pragmatically as a guided search procedure (Sclar et al., 2024).

Question generation is also programmatic. ExploreToM derives state-tracking questions, first-order belief questions, second-order belief questions, and memory questions from the tracked trajectory. Examples include current and prior object locations, where a character will search for an object, whether a character knows about a topic, and second-order questions such as where one person thinks another will search. The framework distinguishes “interesting” questions, for which the answer changes depending on which person is queried, from “uninteresting” ones, for which all persons would answer the same. This distinction is used analytically to separate divergent-belief reasoning from simpler state bookkeeping (Sclar et al., 2024).

4. Data regimes, benchmark behavior, and fine-tuning results

The evaluation setup in the original paper generates 10 story structures for each of 9 action sets, each with and without asymmetry, and for each set of user conditions. The user conditions require exactly $(a_1,\ldots,a_n)$8 people, $(a_1,\ldots,a_n)$9 actions from an important subset $a_i: \mathcal{S} \rightarrow \mathcal{S}.$0, $a_i: \mathcal{S} \rightarrow \mathcal{S}.$1 or $a_i: \mathcal{S} \rightarrow \mathcal{S}.$2 rooms, and total actions $a_i: \mathcal{S} \rightarrow \mathcal{S}.$3, yielding 162 settings in total. Story ingredients include 2–4 people, 1 or 2 rooms, one movable object, opaque containers, topics for discussion, and possible object-state changes (Sclar et al., 2024).

Empirically, ExploreToM was introduced as a hard benchmark generator rather than as a near-saturated test set. The abstract reports that Llama-3.1-70B and GPT-4o show accuracies as low as 0% and 9% on ExploreToM-generated data. The benchmark section further states that ExploreToM “consistently identifies story structures that are highly challenging,” with average performances on ExploreToM-generated datasets as low as 0.09 for GPT-4o. Communication-heavy action sets are relatively easier, while combinations involving object movement, container changes, and informational updates are markedly harder (Sclar et al., 2024).

The search-based generation procedure also outperforms a simpler synthetic baseline. On 81 randomly selected settings, $a_i: \mathcal{S} \rightarrow \mathcal{S}.$4 produces a dataset that is 2 accuracy points harder on average than over-generation and filtering, while the stories are shorter by 1.6 actions on average. Difficulty also transfers across models: story structures generated adversarially for one model remain challenging for others, although same-model targeting is usually most effective (Sclar et al., 2024).

Reliability claims are supported by human agreement measurements. Human evaluation reports 99% agreement with symbolic labels on raw story structures and 89% agreement on infilled stories. Infilled stories remain challenging, but the paper treats them as somewhat noisier; only 41% of samples were successfully infilled in a single attempt under the strict judging setup, and Llama-3.1-70B reaches average accuracy 0.61 on infilled stories, a 0.12 increase relative to the underlying symbolic structures (Sclar et al., 2024).

ExploreToM also functions as a training-data source. The original paper constructs a fine-tuning corpus of 79,700 $a_i: \mathcal{S} \rightarrow \mathcal{S}.$5 triples using raw structures and infilled stories, all 9 action sets, and no asymmetry. Full fine-tuning of Llama-3.1 8B Instruct yields ExploreToM-8B, which improves ToMi from 68% to 95%, Hi-ToM from 30% to 59%, BigToM from 75% to 81%, and OpenToM from .39 to .46 in F1, while FANToM changes from 0.3% to 0.2% (Sclar et al., 2024). Out-of-domain checks report no change on Multi3Woz dialogue state tracking, remaining at 96%, and a 2-point drop on MMLU, from 69% to 67% (Sclar et al., 2024).

5. ExploreToM as a training benchmark and the transfer problem

Subsequent reinforcement-learning work has treated ExploreToM as one component of a deliberately heterogeneous ToM training mixture. In one study, ExploreToM is one of three core training benchmarks alongside HiToM and FANToM, where it supplies adversarial false-belief reasoning and narrative diversity. The authors use only the narrative stories rather than the structured subset, and sample the training data to include 70% tasks requiring genuine ToM reasoning and 30% solvable through simpler mental state tracking. For each training dataset, including ExploreToM, they use 900 training samples, 300 validation samples, and 300 test samples (Sarangi et al., 21 Jul 2025).

That study provides a detailed view of ExploreToM’s role in in-distribution optimization versus cross-dataset generalization. Using Qwen2.5-7B-Instruct with RLVR implemented by REINFORCE++, models trained on ExploreToM achieve large gains on the ExploreToM test set: the ExploreToM-only model reaches 85.1%, and mixtures containing ExploreToM score 83.2%, 79.0%, and 81.1%. By contrast, models not trained on ExploreToM remain at 56.9%, 54.4%, and 59.5%, while the untuned baseline is already 60.5% and chain-of-thought prompting gives 57.5%. The paper therefore treats ExploreToM as strongly learnable in-distribution but not readily solved by transfer from other ToM datasets (Sarangi et al., 21 Jul 2025).

The more consequential result is that high ExploreToM accuracy does not translate into broad ToM generalization in this setup. Training on ExploreToM alone yields 14.5% on FANToM, 37.1% on HiToM All, 60.0% on OpenToM All, and 43.2% on FANToM List All, despite the 85.1% ExploreToM score. Even richer mixtures preserve this pattern: for example, Hi-Fan-Exp reaches 81.1% on ExploreToM, 92.0% on FANToM, and 81.2% on HiToM All, yet OpenToM remains 59.4% and FANToM List All 41.8%. The study interprets the resulting in-distribution versus out-of-distribution divergence as evidence of narrow optimization or “statistical hacking” rather than acquisition of a generic ToM capability (Sarangi et al., 21 Jul 2025).

This does not invalidate ExploreToM’s value as a difficult adversarial benchmark. Rather, it suggests that benchmark-specific competence on ExploreToM should not automatically be treated as evidence of reusable belief-modeling skill across conversational, higher-order, or format-shifted ToM settings.

6. Shortcuts, critiques, and descendant frameworks

A later audit of ToM post-training explicitly identifies ExploreToM as shortcut-prone. In that analysis, simple deterministic heuristics already recover a large fraction of benchmark performance: the “Only-room” heuristic achieves 98% accuracy within coverage and covers 58% of the dataset; the “Last-container” heuristic achieves 72% accuracy over 42% of the data; together they reach 87% overall accuracy; and adding “At-beginning” raises this to 91%. On this basis, the paper argues that high scores on ExploreToM alone can substantially overstate robust mental-state reasoning, especially when tasks are reducible to pure state tracking rather than richer mind-state inference (Zhong et al., 8 Jun 2026).

That critique is methodological rather than dismissive. The same paper reports that training on shortcut-free data with Thinking-RFT improves cross-dataset generalization to ExploreToM, reaching 71.0 versus 62.0 zero-shot and 63.5 for SFT when training on OpenToM and testing on ExploreToM. The implication is not that ExploreToM is useless, but that it is risky as a primary training signal unless shortcut-audited and accompanied by transfer, counterfactual, and higher-order evaluation (Zhong et al., 8 Jun 2026).

OSCToM, introduced later, frames itself as a critique-plus-extension of the research direction that ExploreToM helped establish. It presents ExploreToM as the closest prior adversarial/programmatic ToM framework, credits it with using a DSL and heuristic $a_i: \mathcal{S} \rightarrow \mathcal{S}.$6 search to synthesize complex adversarial stories that manipulate informational access, and treats it as “an important step” and “a leading example.” At the same time, OSCToM argues that search-based generation has computational scaling limits and a rigid search space, particularly beyond 3rd-order recursive depth, and that prior adversarial literature, including ExploreToM, focuses mainly on external perspective-taking rather than “Observer-Self Conflict.” In its reported comparison table, the ExploreToM row lists ToMi 95.0, Hi-ToM 59.0, BigToM 81.0, and FANToM 0.2, with the dagger explicitly noting that these are results as reported in the original paper and produced via iterative $a_i: \mathcal{S} \rightarrow \mathcal{S}.$7 heuristic search rather than direct model inference. The same paper also reports ExploreToM latency as 15.0 seconds per query, complexity $a_i: \mathcal{S} \rightarrow \mathcal{S}.$8, and “Not Recommended” for real-time use, though it simultaneously notes that this is not a like-for-like comparison against an offline-trained neural model (Srishty et al., 19 May 2026).

A different descendant, NCP-ExploreToM, preserves ExploreToM’s DSL-style world and belief tracking while reversing the benchmark objective. Standard ExploreToM is described there as a QA-style benchmark in which the model passively observes a generated story and answers belief questions. NCP-ExploreToM “subverts” that structure by giving the model target belief states and requiring it to create a story in the world through action. The acting model can use six action types—enter_room, leave_room, move_object_container, leave_container, move_object_room, and update_object_state—to induce true or false beliefs up to the second order of intentionality. The evaluation set contains all 24 base goals, 64 size-2 goals, and 32 size-3 goals instantiated in 5 contexts, for a total of 600 task instances. In this agentic setting, GPT-5 is reported as successful on approximately 80% of tasks and as the only model to outperform human participants overall, while all models and humans perform better on true-belief than false-belief tasks (Slater et al., 30 Jun 2026).

Taken together, these later works place ExploreToM in a distinctive historical position. It is simultaneously a foundational adversarial ToM generator, a benchmark whose scores require careful interpretation, a training source that produces strong in-domain gains, and a compositional substrate from which more specialized or more agentic ToM evaluations have been developed.