Paper deep dive
An LLM-powered Agent Framework for Heterogeneous Evacuation Behavior Modeling under a Moving Threat in a Public Plaza
Jian Ma, Runxin Yu, Tianyu Tang, Xiaolian Li
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 9/30/2026, 6:26:59 AM
Summary
This paper proposes an LLM-powered agent-based framework for modeling heterogeneous evacuation behavior under moving threats in public plazas. The framework utilizes private symbolic ASCII views, memory-based knowledge graphs, and persona-conditioned prompts based on the Five-Factor Model (FFM) to simulate individual decision-making. Key findings indicate that knowledge of usable exits strongly correlates with evacuation success (89.5% vs 1.05%), while personality traits influence threat assessment and urgency, though direct threat sightings cause behavioral convergence.
Entities (17)
Relation Signals (9)
Jian Ma → affiliatedwith → Southwest Jiaotong University
confidence 99% · Jian Ma a ... a School of Transportation and Logistics, Southwest Jiaotong University
Xiaolian Li → affiliatedwith → Fujian Police College
confidence 99% · Xiaolian Li b ... b Fujian Police College
Tianyu Tang → affiliatedwith → Southwest Jiaotong University
confidence 99% · Tianyu Tang a ... a School of Transportation and Logistics, Southwest Jiaotong University
Runxin Yu → affiliatedwith → Southwest Jiaotong University
confidence 99% · Runxin Yu a ... a School of Transportation and Logistics, Southwest Jiaotong University
LLM-powered Agent Framework → models → Heterogeneous Evacuation Behavior
confidence 96% · Modeling heterogeneous evacuation behavior under a moving threat is difficult... We propose a novel LLM-powered agent-based framework...
LLM-powered Agent Framework → uses → Five-Factor Model
confidence 95% · The framework represents stable behavioral tendencies using the Five-Factor Model (FFM)...
Usable-exit knowledge → correlateswith → Evacuation Success
confidence 94% · Usable-exit knowledge was strongly associated with evacuation success: 89.5% of agents possessing such knowledge evacuated...
Direct threat sightings → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Modeling heterogeneous evacuation behavior under a moving threat is difficult because human perception, memory, and evidence evaluation are not well captured by fixed rules. We propose a novel LLM-powered agent-based framework to represent these internal decision processes. Each pedestrian agent perceives a private symbolic ASCII view, maintains a Memory-based Knowledge Graph derived solely from individual observations, and makes decisions through persona-conditioned prompts under a common sampling configuration. A compressed decision context with stateless memory preserves trial-and-error experience across turns while excluding reasoning traces, and a validation engine separates behavioral choice from physical feasibility by executing routes only over observed terrain. We evaluated eight personality compositions in eight paired randomized blocks within a simulated public plaza. Usable-exit knowledge was strongly associated with evacuation success: 89.5% of agents possessing such knowledge evacuated, compared with 1.05% of those without it. Personality compositions also differed in their evaluation of remembered threat evidence: the proportion of danger assessments varied by 0.265, while high-urgency, low-directness decisions ranged from 11.41% to 34.33%. After direct threat sightings, responses converged, with 99.6% of assessments classifying the situation as dangerous. Movement was selected in 99.8% of decisions. Overall, evacuation outcomes were strongly associated with information access, while evacuation time was jointly associated with spatial geometry, information, and affect. The framework provides an auditable approach to generating endogenous behavioral heterogeneity through persona-conditioned LLM agents in crowd-evacuation simulations.
Tags
Links
- Source: https://arxiv.org/abs/2609.37009v1
- Canonical: https://arxiv.org/abs/2609.37009v1
Trouble viewing inline? Open PDF directly →
Full Text
102,179 characters extracted from source content.
Expand or collapse full text
An LLM-powered Agent Framework for Heterogeneous Evacuation Behavior Modeling under a Moving Threat in a Public Plaza Jian Ma a , Runxin Yu a , Tianyu Tang a and Xiaolian Li b a School of Transportation and Logistics, Southwest Jiaotong University, Chengdu, 610031, China b Fujian Police College, Fuzhou, 350007, China A R T I C L E I N F O Keywords: Crowd Evacuation Simulation Large Language Models (LLMs) Symbolic Spatial Representation Agent Memory Personality Traits Public Space Security A B S T R A C T Modeling heterogeneous evacuation behavior under a moving threat is challenging because human perception, memory, and evidence evaluation resist representation through fixed rules. To overcome this limitation and capture these internal decision processes, we propose a novel agent-based framework powered by large language models (LLMs). It has three main components: (i) each pedestrian agent perceives a private symbolic ASCII view, mantains a Memory-based Knowledge Graph updated solely via individual observations, and makes decisions using prompts that incorporate a personality profile under a common sampling configuration; (i) a decision-context compression coupled with a stateless memory model preserves trial-and-error experience across decision turns while omitting reasoning traces to keep the context compact, with the resulting memory record reconstructed post hoc as a knowledge graph; and (i) a validation engine executes routes exclusively over observed terrain, effectively decoupling behavioral choice from physical feasibility. In a simulated public plaza scenario, we evaluated eight personality compositions in eight paired randomized blocks. The results reveal a strong association between usable-exit knowledge and evacuation outcomes: agents with such knowledge evacuated in 89.5% of cases, compared to only 1.05% of those lacking it. Furthermore, personality compositions differed in their evaluation of threat evidence. Under remembered evidence, the proportion of danger assessments varied by 0.265 across personality compositions, while the mean share of high-urgency, low-directness decisions varied approximately three-fold, from 11.41% to 34.33%. By contrast, responses converged after direct threat sightings: 99.6% of the assessments classified the situation as dangerous, as instructed. Movement was selected in 99.8% of decisions. Overall, the results indicate that access to information was strongly associated with evacuation outcomes, while spatial geometry, information, and affect were jointly associated with evacuation time. The proposed framework provides an auditable approach to generating endogenous behavioral heterogeneity through persona-conditioned LLM agents in crowd-evacuation simulations. 1. Introduction Public plazas, temple forecourts, transport interchanges, and other open civic spaces bring large numbers of people into layouts designed for circulation. When a threat emerges within such a space, people must rapidly determine what is happening, whether they are at risk, where the exits are, and how those nearby are likely to respond. Pedestrian safety in these settings has therefore attracted sustained attention across disciplines. Computer-science research detects conges- tion from motion signatures in trajectory data (Khan, 2019), while emergency-management research develops actionable evacuation plans for dense facilities (Guo et al., 2023). A moving threat intensifies the evacuation problem: the hazard follows a dynamic path, information reaches different individuals incompletely and at different times, and route choice depends on spatial cognition, risk perception, and geometry of the scene. Consequently, mathematical and computational models have sought to capture how population heterogeneity shapes evacuation behavior. Existing evacuation models operate at three scales: macro- scopic, mesoscopic, and microscopic. Macroscopic models represent a crowd as a homogeneous flow described by density, velocity, and flow rate; common formulations include queuing, regression, and path-selection models (Kaur and Kaur, 2022). Li et al., for example, developed a numerical scheme based on the Hughes continuum model that relates simulated density to physical compression forces (Li et al., 2018). Individual heterogeneity is difficult to represent at this scale (Kouskoulis et al., 2018). Mesoscopic models occupy the intermediate scale: rather than tracking each evacuee, they describe the crowd through a statistical distribution over individual states such as position, velocity, and walking direction, typically in gas-kinetic or kinetic-theory form (Hoogendoorn and Bovy, 2000; Bellomo and Dogbe, 2011). Agnelli et al., for example, applied kinetic theory to crowd evacuation from bounded domains (Agnelli et al., 2015) and later extended the approach to disease contagion during evacuation (Agnelli et al., 2023). Heterogeneity at this scale is typically represented through a small number of activity variables or state classes, so individual perception and decision processes remain outside the model. Microscopic models instead represent evacuees individually and can therefore capture individual attributes and local interactions. Social-force models (Helbing et al., 2000), cellular automata (Kirchner et al., 2003), and hybrids of the two are standard examples. Chen et al. developed social-force formulations considering the spatial features of tread depth and riser height in staircases to explore vertical evacuation of buildings (Chen et al., 2018a). These formulations resolve mechanical interactions within physical space, but cognitive processes, perceived information, and behavioral preferences generally remain external to the model. Subjective trade-offs among Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 1 of 22 arXiv:2609.37009v1 [physics.soc-ph] 29 Sep 2026 LLM-powered Modeling of Evacuation under a Moving Threat threat exposure, congestion, and travel distance must there- fore be encoded as rules. Pedestrian microsimulation generates behavior from predefined physical or behavioral rules affected by environ- mental features and personal behavioral preferences. Recent work has extended this rule-based foundation in several directions. Simulation-based optimization has been coupled with real-time evacuation guidance under changing access conditions and crowd distributions (Zhang et al., 2024); visibility-dependent interaction models reproduce detours, wall following, and herding under reduced visibility (Tan et al., 2025); and machine-learning models infer microscopic pedestrian motion from local interaction data (Jiang et al., 2025). Multi-agent studies have also compared situational- awareness and routing strategies under dynamic hazards (Serrano et al., 2026), as well as heterogeneous exit-choice strategies that balance efficiency, safety, and fairness (Tong et al., 2026). Collectively, these studies make information, per- ception, and behavioral heterogeneity increasingly explicit, but decisions remain encoded in optimization objectives, learned functions, or prescribed strategy sets. Agent-based modeling has consequently attracted interest as a means of representing human-like behavior and the cognitive pro- cesses underlying individual decisions (Gao et al., 2024). Psychological structure has been introduced into agent-based evacuation models through Gibson’s theory of affordances for pedestrian–environment interaction (Hassanpour and Rassafi, 2021), trained leaders who redistribute crowd route choices (Pelechano and Badler, 2006), and heterogeneous self-driven forces (Wu et al., 2022). Nevertheless, these formulations rely on weighted functions and manually specified rules that define the population’s behavioral repertoire in advance. Large language models (LLMs) offer a way to condition agent decisions on descriptions of the environment, individual attributes, and remembered experience. Research on language processing has identified shared computational principles between human neural responses and language models, including context-dependent prediction and representations of word meaning (Goldstein et al., 2022). More recently, a language model fine-tuned on human behavioral data predicted choices across a range of cognitive tasks (Binz et al., 2025), supporting interest in language models as tools for studying human decision-making. Interactive agents extend this potential to decisions made through repeated encounters with an environment. In Minecraft, JARVIS-1 combines planning, action execution, and memory of previous experi- ences to complete tasks requiring multiple stages of action (Wang et al., 2025). For evacuation modeling, this division of functions offers a way to connect immediate responses to danger with continuing goals and revisions to an escape plan. Recent studies have applied LLM-powered agents to evacuation and wayfinding. Dang et al. combined LLMs with a cellular-automaton environment to examine how agent backgrounds and communication relate to fire-evacuation outcomes (Dang et al., 2025b). In a separate wayfinding study, they compared spatial-memory conditions and included human participants as a reference (Dang et al., 2025a). Yang et al. incorporated personality traits, environmental observations, and action histories into an LLM-powered evacuation framework (Yang et al., 2026). Explicit spatial and knowledge representations provide additional support for such decisions: neuro-symbolic evacuation models combine learned reasoning with spatial structure (Bahamid et al., 2024), while Tao et al. coupled a fire-incident knowledge graph constructed through entity and relation extraction with vision-language-model reasoning for emergency decision support (Tao et al., 2026). Building on this work, the present study asks how changing information is interpreted, retained, and translated into successive evacuation decisions under a moving threat. A central issue is how a pedestrian’s understanding of danger and available exits develops as new evidence arrives. Connecting these changes to route choice and movement provides a basis for investigating the processes through which evacuation behavior develops. Such a framework should meet at least the following four requirements. First, the environment must be presented in a form the model can interpret without devoting exces- sive capacity to decoding geometry. Second, population heterogeneity must arise within the agents, because demo- graphic, physical, and psychological differences produce distinct evacuation behaviors (Hu et al., 2023; Li et al., 2023; Mandar and Boulmakoul, 2016). Knowledge-guided hierarchical multi-agent reinforcement learning represents this heterogeneity through mobility attributes, sensitivity parameters, and decision mechanisms (Sun et al., 2026), while other work encodes personality traits as agent attributes (Wang et al., 2021; Raetano et al., 2026). Third, each agent requires persistent, inspectable memory so that a decision can be traced to what the agent knew when it was made. Fourth, information must pass from person to person to reflect the uneven diffusion of knowledge through a crowd. This study develops an LLM-powered agent framework for investigating how individual experience enters evacu- ation decisions in a public plaza under a moving threat. Its contributions are to represent decisions using private observations, personality profiles, and retained experience; to reconstruct changes in memory alongside successive choices; and to connect these records to physically executed movement. Together, these elements support the analysis of how pedestrians interpret danger, maintain an escape goal, and reconsider a route as their understanding of the situation changes. Section 2 describes the framework, Section 3 presents the experimental design, Section 4 reports the results, Section 5 discusses their implications and limitations, and Section 6 concludes the paper. 2. Methodology The framework separates local perception, decision- making, memory updating, and physical execution. Each pedestrian maintains a private known map퐵 푡 푖 containing observed terrain. The decision model receives the current Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 2 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Figure 1: Perception, decision, memory, and physical execution in the LLM-powered framework. (a) Local observations update each pedestrian’s private known map퐵 푡 푖 . (b) The decision model combines the current view푃 푡 푖 , personality, affect, short-term context퐶 푡 푖 , and long-term memory푀 푡 푖 . (c) The model selects an action and target푔 푡 푖 ; the engine constructs and checks routes through observed, passable cells. Memory revisions are reconstructed as knowledge graphs after the run. symbolic view푃 푡 푖 , the persona description, the engine- computed affective state, short-term context퐶 푡 푖 , and long- term textual memory푀 푡 푖 . It selects an action and either an offered route or a perceived target. The engine generates and validates routes using the pedestrian’s known map, then applies the physical movement rules. After each run, memory revisions and decision records are reconstructed as graphs for analysis. Figure 1 distinguishes the information used during simulation from the records constructed afterward. 2.1. Personality Modeling and Prompt Specialization The framework represents stable behavioral tendencies using the Five-Factor Model (FFM): openness to experience (O), conscientiousness (C), extraversion (E), agreeableness (A), and neuroticism (N). The FFM provides a compact description of individual differences (Raetano et al., 2026). Evacuation models have used OCEAN traits to relate person- ality to psychological stress and desired speed (Wang et al., 2021), while separate work has examined aggressiveness and competition in pedestrian movement (Hu et al., 2023). In the present framework, the five trait scores form part of each agent’s persistent persona description. 2.1.1. Personality Configuration With the five-domain FFM profile, each evacuee’s per- sonality can be represented as an agent attribute expressed as T-scores. The score is embedded for each agent in the system prompt received by the decision model on every call. Each profile assigns a T-score (mean 50, standard deviation 10) to openness, conscientiousness, extraversion, agreeableness, and neuroticism. Scores are mapped to five interpretive bands: very low (below 35), low (35–44), average (45–55), high (56– 65), and very high (above 65). For each domain, the prompt includes the numeric score, its band, and a behavioral anchor framed in the context of an ordinary outing. For example, the high-conscientiousness anchor describes a person who adheres to a plan and follows a chosen route, whereas the high-neuroticism anchor describes someone who hesitates and revisits choices when a situation is unclear. Domains outside the average band also include salient facets that link non-average scores to specific tendencies. Table 1 presents the five profile templates used Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 3 of 22 LLM-powered Modeling of Evacuation under a Moving Threat to instantiate this representation. Population size and the number of pedestrians assigned to each profile are specified separately for each experimental scenario. Table 1 FFM T-scores of the five personality archetypes. ArchetypeO C E A N Average50 50 50 50 50 Calm-independent50 55 40 45 30 Rule-following40 70 45 60 50 Anxious-conformist 40 45 62 60 72 Bold-solitary68 35 35 40 32 The five personality profiles use the fixed T-scores listed in Table 1. These scores determine the interpretive bands, salient facets, and behavioral anchors inserted into each agent’s identity section. The neuroticism score also deter- mines the sensitivity and recovery coefficients in Eq.(5). The composition experiment changes the numbers of pedestrians assigned to each profile while keeping the profile scores fixed. 2.1.2. Behavioral Differentiation through Persona-Conditioned Decisions Rule-based evacuation models usually represent indi- vidual differences through parameter values or prescribed behavioral rules. In the present framework, by contrast, behavioral heterogeneity is introduced through a stable persona profile embedded in each agent’s system prompt. The persona conditions the decision but does not prescribe a fixed action; pedestrians presented with the same environmental evidence may therefore still make different choices. The language model interprets this profile together with current perception, affect, and remembered experience, and this interpretation is the core mechanism through which different agents express their heterogeneity. Agents accumulate different observations and memory texts as their trajectories diverge. These changing inputs can accompany differences in later decisions. The graphs reconstructed after a run describe this recorded history. As a result, individual differences in personality become progres- sively more pronounced. This phenomenon emerges from the long-term effects of LLM-powered self-maintenance, through which perceptual, decision-making, and other be- havioral information are progressively integrated over time, ultimately giving rise to an increasingly coherent and realistic perception–decision–action framework for each individual. Fig. 2 summarizes how the five trait scores are translated into agent-specific descriptions while the general decision instructions and sampling settings remain fixed across agents. For each agent, its system prompt is composed of a shared policy section and an agent-specific identity section. The shared policy is identical for all the agents and consists of seven instruction blocks, summarized in Table 2, while the identity section varies depending on the agent’s demographic type and FFM profile. For each decision the agent made, the system prompt load varies because it contains the agent’s updated current perception, engine-computed affect, and retained memory. This separation makes the sources of prompt variation explicit, but it does not isolate the causal effect of persona text because neuroticism also affects the engine-maintained fear state described in Section 2.3.5. Table 2 The seven instruction blocks of the shared policy section. BlockContent IdentityAn ordinary pedestrian acting on local perception, its own known map, memory, affect, and messages received MapThe fixed north-up orientation, the @-relative offset convention, and the glyph table of Table 3 JudgmentTarget choice belongs to the agent, route legality to the engine; the evidence clause; the default target-distance band Intent intent and urgency as a standing goal that persists until the agent changes it Route options Fields of the engine-computed routes (length, familiarity, crowding, clearance from A or D, reach) and the rule that the shortest route need not be chosen Past experience Use of the decision-context capsule and of the engine’s feedback on the previous response OutputValidation and JSON action guideline The identity section of the system prompt describes each agent’s identity and personality and remains fixed throughout the simulation. It includes the agent’s identifier and demographic type, the five personality domain scores and their bands, the salient facets of domains outside the average range, and a brief description of a behavioral tendency for each domain. For example, the high-neuroticism description characterizes a preference for nearby targets and more frequent changes in movement direction under threat. These descriptions provide a personality context that the decision model considers together with local observations, memory, and affect when choosing an action. At푡 = 0, each pedestrian selects an initial route and enters the first recorded frame already moving (Section 2.3.1). The engine accepts a target when it lies on an observed, passable cell and can be reached through observed cells (Section 2.2.3). During the simulation, an agent’s move is affected by its surrounding environmental situation, especially the situation within its field of view. A direct sighting of the threat or an injured person provides unambiguous evidence that the current situation is dangerous. In the symbolic view described in Section 2.2.3, the glyphAmarks an armed person rushing toward the crowd, andDmarks a person lying motionless on the ground (Table 3). For example, an agent may interpretAas “I saw someone holding a knife with blood on it”. The decision instruction states that directly Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 4 of 22 LLM-powered Modeling of Evacuation under a Moving Threat aBig Five profilebAgent-specific prompt layercControlled interface Example · anxious-conformist T = 50 O40 C45 E62 A60 N72 AGENT IDENTITY demographicage / sex / role T-scoresO · C · E · A · N bandslow · average · high facetsanxiety · compliance anchorscrowd · route · wait only agent identity varies Fixed across agents shared policy same instructions tool schema same fields sampling temperature = 0.2 Inserted into every decision prompt Figure 2: Personality-to-prompt encoding in the controlled decision interface. (a) An anxious-conformist profile illustrates the five FFM T-scores and their position relative to푇 = 50. (b) The agent-specific identity section converts demographics and scores into bands, salient facets, and behavioral anchors. (c) The shared policy, tool schema, andtemperature=0.2 remain fixed across agents, and the resulting identity section is inserted into every decision prompt. seeingAorDis strong evidence of danger. The label itself, however, is produced by the language model rather than written by the engine: the model must recognize the glyph in its own ASCII view and returndangerin thesituation field of its JSON output, which records its appraisal as normal,unsure, ordanger(Section 2.3.5). The LLM then selects the agent’s next action by considering its personality description, affective state, remembered experience, and visible surroundings. Within each decision turn, the LLM interprets the symbolic observations, reports its appraisal of the situation, and selects an action. As new evidence becomes available, it can reconsider its standing goal and choose a different route or target in light of remembered experience. This connects cue interpretation, situation appraisal, and action selection within an LLM-powered decision process (Section 2.3.2). Person-to-person communication is represented by shout- ing. Once a pedestrian has chosen to escape, it shouts while moving. The engine calculates the distance between the speaker and nearby pedestrians and adds the signal to the decision context of listeners within hearing range (Sec- tion 2.3.7). The signal conveys the direction and approximate distance of the shout. In everyday terms, the listener hears someone shouting nearby. Anonymous shouting is presented as uncertain evidence, which the listener’s LLM considers alongside its observations, memory, personality, and affect. The model returns an updated appraisal of normal, unsure, or danger, and the engine records this as the pedestrian’s current situation. This communication mechanism separates warning reception, interpretation, and the choice of a response (Lindell and Perry, 2012). All agents share the same sampling settings, so variation across personalities arises from trait scores, verbal anchors, affect, memory, and current evidence. 2.2. ASCII-Based Local Perception and Spatial Representation Agents in the proposed framework receive their surround- ings through a symbolic representation. By making decision- relevant information explicit at the cell level, this interface allows each move to be related to what the agent could observe (Ahissar et al., 2025; Bahamid et al., 2024). This section defines the environment layers that generate the view, the geometry that determines which cells enter it, and the encoding that converts those cells into prompt text, as shown in Fig. 3. 2.2.1. Layered Environment Representation The environment comprises four layers with distinct functions. The 1st layer is the raw layer, a raster of 0.4 m cells that records the fixed geometry of the space. The 2nd layer is the semantic layer, which records openings, gates, fixed obstacles, and spawn cells. The 3rd layer is the effective layer, which combines the raw and semantic layers with the current gate states and serves as the physical authority for collision and availability. The 4th layer is the belief layer, which is private to each agent and contains only terrain that the agent has personally observed. The reason why we separate the belief layer from the effective layer is that it establishes the framework’s informa- tion boundary. Physical resolution uses the effective layer, whereas target selection and local route generation use the pedestrian’s private belief layer. The model receives only the privately observed and explored map, and the memory connects the selected target exclusively through observed cells. 2.2.2. Field of View and the perception map Visibility is computed by enumerating every raster cell whose center lies within the sight radius and testing it against the view cone and a line-of-sight trace. Letdenote the static set of raster cells and let퐺 푡 denote the effective physical-grid state at time푡. For pedestrian푖, with position퐱 푡 푖 , heading 퐡 푡 푖 , sight radius푅 푖 , and cone width휑 푖 , the visible set of the Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 5 of 22 LLM-powered Modeling of Evacuation under a Moving Threat 1. Local environment T E G @ 2. View cone + line of sight T E G @ 3. + Moore ring T E G @ 4. Perceived set P = F union M T E G @ 5. Encoded patch ????????? ??###..E? ??#..p..? ??#.A.G.? ??..@p..? ??T.....? ????????? N 120° · radius 12 m filled cone: every cell centre tested first-order Moore neighbourhood uniform hatch = unknown ASCII + belief grid -> route options / target A* Figure 3: From geometry to action. The filled view cone and first-order Moore neighborhood form the perception map, unknown cells appear as?, and the private Memory-based Knowledge Graph supports engine-generated route options as well as A* validation of a model-selected target. environment is 퐹 푡 푖 = 푞 ∈ | | | ‖퐱 푞 − 퐱 푡 푖 ‖ ≤ 푅 푖 , ∠ ( 퐱 푞 − 퐱 푡 푖 , 퐡 푡 푖 ) ≤ 휑 푖 ∕2, LOS(퐱 푡 푖 , 퐱 푞 ;퐺 푡 ) . (1) The perception map also includes the first-order Moore neighborhood 푡 푖 , representing immediate awareness of the eight cells surrounding pedestrian푖at time푡, including cells behind the pedestrian: 푃 푡 푖 = 퐹 푡 푖 ∪ 푡 푖 .(2) At initialization, each pedestrian also observes the cells within a Chebyshev radius of 3, subject to line of sight. These initial terrain observations are stored in the memory section and serve as one part of system prompts before the first decision and persist after ordinary directional perception begins. A wall cell remains visible while occluding cells behind it, and every cell outside푃 푡 푖 appears as?. Moore- neighborhood cells are integrated into the same equal-width ASCII matrix, as shown in Fig. 3. At each simulation timestep, 푃 푡 푖 is written to the private Memory-based Knowledge Graph together with its observation time. The resulting Memory- based Knowledge Graph supplies route options and supports validation of model-selected targets. 2.2.3. Symbolic Encoding of the Perceived Field The perception region aligns with the orientation of the agent’s facing direction. The terrain from the effective layer is written first, after which entities are overlaid: other pedestrians, people on the ground, the anomalously behaving person, and the focal agent. Table 3 defines the vocabulary. Every cell in the bounding box but outside the perception map is written as?, making the boundary between observed and unknown space explicit. The decision model returns an action, a situation assess- ment, a standing intent, and either an engine-provided route Table 3 Character vocabulary of the local symbolic view. Symbol Meaning ?Outside the perception map or occluded .Walkable ground #Wall or outside the building TTree or fixed obstacle EExit GGate, open gGate, closing XGate, closed @The agent itself pAnother pedestrian DA person lying motionless on the ground AAn abnormal person rushing toward the crowd identifier or a target offset. The engine checks the selected destination against the saved decision-time observation, con- structs an eight-neighbor A* route on the pedestrian’s private Memory-based Knowledge Graph, and rejects unknown, blocked, or disconnected targets. Only validated belief-grid cells are executed. 2.2.4. Properties of the Two-Dimensional Symbolic Field A character grid encodes position and attribute in a single token. A symbol’s location in the matrix specifies where an object is relative to the agent, while the symbol itself specifies the object’s identity. Thus, readingAtwo rows above and one column to the right conveys both properties simultaneously. Throughout a run, textual adjacency preserves neighborhood relationships in the two-dimensional field. The representation is also preserved under reorientation. When a scene is rotated, interpreting a coordinate list requires Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 6 of 22 LLM-powered Modeling of Evacuation under a Moving Threat the spatial relationships to be re-derived arithmetically. By contrast, the character grid rotates with the scene while preserving layout and adjacency, so the reading procedure re- mains unchanged. This property allows the benchmark below to separate spatial competence from arithmetic competence. Spatial-representation validation was retained as a sup- plementary experiment using frozen snapshots to compare four representations: no map, structured cells, lean ASCII, and ASCII with a decoding protocol. In the main evacuation experiment, the implemented equal-width ASCII representa- tion remained fixed while the behavioral mechanisms were tested. 2.3. LLM-powered Agent Modeling Framework Once the surroundings have been perceived, agents with different behavioral characteristics must decide how to act. Their information is partial, uncertain, and dynamic, as is typical in evacuation settings, where environmental cues, risk appraisal, and nearby behavior jointly inform the next move. Linguistic instead of purely numerical representation reflects how such situations are described and interpreted (Xue et al., 2023). Language models, in turn, provide a mechanism for context-dependent decisions that can incor- porate heterogeneous behavioral characteristics (Gao et al., 2024; Yang et al., 2026). This section specifies the decision loop, supporting memory architecture, affective state, and algorithmic adversary. 2.3.1. Perception–Decision–Action Loop Before the simulation starts, the decision model receives each pedestrian’s initial observation and selects either an offered route or a legal target. The engine validates the selection and installs the resulting route, so each pedestrian enters the first recorded frame already moving along a model- selected route. Each subsequent turn follows a fixed sequence. Memory revisions submitted during the preceding turn become due first. If a revision remains unfinished, the simulation waits at the current boundary before constructing any new decision observation. Fields of view are then recomputed and local evidence registered. Every active pedestrian carries a current route and may also have one pending decision request. A decision submitted at simulated time푡stores the pedestrian’s observation and memory snapshot and is scheduled for the first boundary at or after푡 + 1. During this interval, the pedestrian may execute one step along an existing legal route. An early response remains buffered until the due boundary; a late response pauses pedestrians, the adversary, gates, affect, collision recovery, trajectory recording, and the simulation clock until computation finishes. The validated decision is then applied at the same boundary before movement. When a pedestrian first sees an armed person (A) or someone lying motionless (D), it reassesses the situation using the new observation. If a decision based on an earlier view is still being generated, that assessment is replaced by one that includes the newly observed evidence. While the threat remains visible, another assessment can begin once at least one simulated second has passed since the previous decision took effect. Each assessment uses the observation recorded at its start, and its decision takes effect one simulated second later. Subsequent changes in the scene are considered in the next assessment. During pending computation, the pedestrian continues along an existing legal route and waits if that route is ex- hausted. After pedestrian decisions are applied, the adversary plans its movement, and all entities propose at most one move for concurrent resolution. Fatalities, opening capacity, evacuation, decision traces, metrics, and the rendered frame are then evaluated from the committed state. 2.3.2. Dual-Model Architecture and Decision Layers Each agent is served by two models with distinct responsi- bilities. The decision model reads the symbolic view, compact working context, long-term memory, and affect; reports an intention, urgency, action, and situation assessment; and se- lects an offered route or perceived target. The memory model reads the agent’s current notes together with its observations, decisions, and realized movement, then rewrites a first-person account. Separating these functions makes decision behavior and memory revision independently measurable (Dang et al., 2025a). Within a single call, the decision model operates at three levels. At the highest layer, it states a standing goal: intentidentifies what the agent is trying to do, whileurgency indicates how strongly it judges that immediate action is required. Both values persist until the agent revises them. The previous values are returned to the agent on its next turn, so an intention continues by default and any change is explicitly recorded. At the middle layer, the agent selects a route. The engine constructs up to four walkable route segments on the pedestrian’s private Memory-based Knowledge Graph, anchored to known openings or frontier cells at the edge of explored space. It also adds a corridor-distinct alternative to the nearest anchor, providing another path even when only one destination is known. Each segment is annotated with observable attributes: length in cells, the fraction already traversed, the number of visible people along it, the closest approach to any currently visibleAorD, and whether the 20-cell horizon reaches the anchor or only advances toward it. Personality and affect can therefore influence whether the agent prioritizes familiarity, crowding, or clearance from a visible threat; the prompt explicitly gives no priority to the shortest option. If none of the offered routes is suitable, the agent selects atarget_offsetand, optionally, one interme- diate waypoint. At the lowest layer, the engine commits at most 20 cells of the selected route before requesting another decision, preventing a single choice from determining an entire long route. 2.3.3. Context Compression and Experience Retention Each request is constructed from a fresh, self-contained context. Throughout the text and figures,퐶 푡 푖 denotes the decision-context window: per-agent short-term memory that carries compressed operational context between nearby turns. The symbol푀 푡 푖 denotes per-agent long-term first-person Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 7 of 22 LLM-powered Modeling of Evacuation under a Moving Threat memory maintained across revisions. The decision and memory models use these two written channels, respectively, to carry experience between turns. The short-term memory is a rolling operational context. Its inputs are the previous content, the current observation, and the engine’s feedback on the previous response, which states whether it was accepted and, if not, why it was rejected, so that the next decision can correct the error. The compression rule retains the current intention, strategies confirmed against the environment, tool corrections, and un- resolved questions. It removes reasoning traces, restatements, expired map details, and relative coordinates invalidated by movement. Reasoning traces are omitted by design because they would not fit within the compression length limit; the capsule keeps the outcome of each attempt. A valid response replaces the memory prompts; a rejected response preserves the previous version. The second model writes the long-term memory푀 푡 푖 from the pedestrian’s current memory text and a summary of the committed turn. The summary includes the number of visible people; identifiers of visible adversaries and bodies; signage and opening states within the perception map; affect and witnessed events; and the decision, including its target, action, and situation assessment. The model returns a first-person account within a 1,200-character limit, retaining current facts while revising or removing expired ones. Because facts persist only through rewriting, omission constitutes forgetting. When an adversary leaves the perceptual set, the pedestrian retains only the cell in which it last observed that adversary and the simulated time of the observation. Later requests label this record explicitly as stale evidence and report the elapsed time, with bearing and distance recomputed from the pedestrian’s current position to the remembered cell. The record is created only while the adversary lies within that pedestrian’s perceptual set and is replaced only by a subsequent direct sighting. Gaze and body direction are represented by a single heading, so a pedestrian cannot look behind itself without turning, and any committed step overwrites its previous orientation. The two limits reflect different retention horizons. Oper- ational context concerns the current situation and becomes stale within a few turns, so 500 characters are sufficient for in- formation that survives one rewrite. Experience accumulates throughout a run, giving the memory model 1,200 characters within which to determine what the pedestrian retains. 2.3.4. Graph-Structured Memory The memory model is stateless. Each update carries a complete context for one agent: its current memory text and the newly committed turn. Neither conversation history nor content is shared between agents. Revisions are written as prose, allowing the model to retain, modify, or omit remembered facts in the same format as the record. Facts absent from the current revision become forgotten nodes; forgetting is therefore endogenous to the agent and observable through logs that record what disappeared and when. The completed record is assembled into a versioned knowledge graph. Each revision is divided at sentence bound- aries into individual remembered facts, each represented as a node. Facts are matched across versions using character- bigram Jaccard overlap, 퐽(푎,푏) = |퐵(푎) ∩ 퐵(푏)| |퐵(푎) ∪ 퐵(푏)| ,(3) where퐵(⋅)denotes the set of adjacent character pairs. This measure operates directly on the text and clearly separates the observed score ranges: rewritten versions of the same fact score 0.43–0.60, whereas distinct facts score 0.00–0.11. A threshold of 0.40 therefore assigns reworded facts to their existing nodes. A retained fact continues as one lineage across versions, a revised fact starts a new version within its lineage, and a fact omitted from a revision ends its lineage. Edges between lineages record semantic associations among opening knowledge, route intention, communicated evidence, and affect. Fig. 4 illustrates this structure for one recorded agent. The knowledge graph is reconstructed after the simulation from the complete memory record. It connects changes in remembered information with recorded decisions, supporting analysis of how pedestrians revise their understanding and evacuation plans (Tao et al., 2026). 2.3.5. Affective State The validation mechanism manages a fear value푓 푖 (푡) ∈ [0,1]for each pedestrian푖. Four categorical levels are used for reporting: calm below 0.20, alert below 0.45, afraid below 0.75, and high fear at or above 0.75. Stimuli arise from direct sightings, proximity to the threat, observed casualties, and nearby pedestrians fleeing. Let푧 푖푘 (푡)denote the intensity of stimulus type푘experienced by pedestrian푖, and let 푧 ∗ 푖 (푡) = max 푘 푧 푖푘 (푡)denote the strongest active stimulus. Fear is updated as 푓 푖 (푡+Δ푡) = max ( 푓 푖 (푡), min ( 1,휅 푖 푧 ∗ 푖 (푡) )) , 푧 ∗ 푖 (푡) > 0, max ( 0,푓 푖 (푡) − 휌 푖 Δ푡 ) ,푧 ∗ 푖 (푡) = 0, (4) where the sensitivity multiplier 휅 푖 and recovery rate 휌 푖 are 휅 푖 = clip [0.65,1.45] ( 1 + 푇 푖푁 − 50 100 ) , 휌 푖 = max ( 0.01, 0.10 − 푇 푖푁 − 50 1000 ) . (5) A larger푇 푖푁 therefore produces a stronger rise in fear and a slower recovery. The current fear value and active stimuli are supplied to the decision model, creating an explicit second pathway from the personality representation to later decisions. The framework represents emotion using two quantities with distinct origins. The scalar푓is computed by the engine from Eqs.(4)and(5)and supplied to the decision prompt Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 8 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Recorded memory evolution · Agent 5 environment & activity opening knowledge route intention threat & affect v1v2v3v4v5v6v7v8 touring east sign E + NE signs exit1 known exit1 + exit2 exit1 best 10 → 2 steps follow E follow NE toward exit1 continue r1 near exit1 calm afraid alert calm agent 1 shouts retainedrevisedforgottencross-lane relation character-bigram Jaccard · J ≥ 0.40 Agent 5 · 8 versions · 6 active · 18 forgotten Figure 4: Recorded evolution of Agent 5’s long-term first-person memory in the completed GLM-5.3-flash reference run. Facts are arranged by version (푣 1 –푣 8 ) and semantic track. Solid dark lineages were retained, blue nodes mark revisions, and pale dashed lineages terminate facts later omitted from memory. Dashed cross-track edges show recorded semantic associations, such as opening knowledge informing route intention and a heard shout accompanying an affect update. Reworded facts are matched by character-bigram Jaccard overlap at퐽 ≥ 0.40. The final record contains six active and 18 forgotten facts; graph construction occurs after the simulation. together with its categorical level and currently active stimuli. The model returns the appraisal:situationindicates whether the pedestrian interprets its circumstances asnormal,unsure, ordanger, whileurgencyranges from 0 to 1 and indicates how strongly the agent judges that immediate protective action is needed. The appraisal channel draws on representations acquired during model pretraining. For each prompt, including the symbolic patch, persona text, affective context, and retained memory, the model returns the label that best matches the description within its learned representation space. The avail- able categories (danger,unsure, andnormal) and their graded urgency are therefore derived from the model’s learned statistical regularities. A large language model (LLM) maps a textual description of the current emergency scenario into a high-dimensional semantic representation and establishes associations between the current input and previously learned semantic patterns within its parameterized knowledge and representation space. Through the Transformer architecture, attention mechanisms, contextual modeling, and statistical regularities encoded in its parameters, the LLM performs contextual inference over the available situational information and generates the most probable and contextually appropriate interpretation of the current emergency scenario. This capability represents an important distinction be- tween large language models and conventional rule-based models in emergency and evacuation applications. Rule- based models primarily rely on explicitly predefined con- ditions, rules, thresholds, and decision pathways, whereas LLMs can leverage contextual information and learned semantic representations to generalize and reason about scenarios that have not been explicitly specified in the predefined rule set. In the context of occupant evacuation and emergency response, this enables the model to integrate heterogeneous situational descriptions and infer context- dependent interpretations that may not be directly encoded as explicit evacuation rules. Consequently, the appraisal is also model-dependent: another model may interpret the same symbolic patch differently. 2.3.6. Time Step, Movement, and Contention The simulation advances in discrete physical steps. Each active entity moves by at most one cell per step, either orthogonally (0.4 m) or diagonally (0.57 m), so the speed ceiling is 1.2 m s −1 along the grid axes and 1.7 m s −1 diagonally. Each pedestrian advances along its accepted, model-selected route and waits after exhausting its legal steps. Because each decision occupies a fixed interval of simulated time (Section 2.3.1), this time scale supports direct comparison of decision timing, route choice, and responses to neighboring behavior (Chen et al., 2017; van Toll and Pettré, 2021). Each grid cell can hold one entity, providing an explicit spatial constraint and a well-defined procedure for resolving contention. Consistent with grid-based models that resolve simultaneous choices through cell occupancy and local contention (Zhu et al., 2020; Kirchner et al., 2003), when several entities select the same cell, one is chosen at random and the others are assigned feasible cells within their Moore neighborhoods. Opposing swaps, diagonal crossings, and static occupancy are resolved in the same pass, and diagonal movement cannot cut between two blocked orthogonal cells. Because resolution occurs during execution, the agents’ stated preferences remain unchanged (Chen et al., 2018b). Agents Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 9 of 22 LLM-powered Modeling of Evacuation under a Moving Threat still active at the time limit are recorded as unresolved, distinguishing them from those reached by the adversary. 2.3.7. Algorithmic Adversary and Evidence Propagation The adversary uses the adult physical model: one cell per turn, a 12 m sight radius, a 120° cone plus Moore neighborhood, and the common collision and terrain rules. Its distinct physical capability is defined by a 2.0 m attack radius. A fixed algorithmic policy keeps hazard behavior constant across pedestrian conditions. The default policy is a perception-limited patrol–pursuit strategy. When no pedestrian is visible, the adversary patrols evacuation exits 1–3 and entrance gates 1–2 in sequence before returning toexit1. When a pedestrian enters its perception map, the adversary selects the nearest visible pedestrian, locks onto that target for six turns, and updates the last observed cell while visual contact persists. After losing sight, it searches toward the last observed cell for up to eight turns. If it does not reacquire a pedestrian, it resumes the patrol from its current patrol index. Routes are generated by the same physical-map A* procedure used for other algorithmic movement. This perception-limited policy resembles patrol-then-pursuit formulations used in campus- attack simulations (Beattie et al., 2022). Threat information propagates through local observation and person-to-person communication. The prompt requires situation=danger but leaves the action to the model, with move,wait, andturn_and_observeall permitted. The recorded situationtherefore measures prompt compliance, whereas the recorded action is a behavioral outcome. The engine preserves the returned fields and limits movement during the pending interval to the pedestrian’s existing legal route. After the source leaves view, the prior direct observation remains part of the pedestrian’s knowledge. An anonymous shout supports unsure but contains no threat coordinate. Shouting carries the signal beyond the line of sight. A pedestrian who has decided to escape, either after a direct sighting or through the model’s situation assessment, shouts while moving. Listeners within 15 m receive the message even without line of sight, and the message still conveys the bearing and approximate distance of the shouter, which also tell the one relative direction of danger. They evaluate it together with other available evidence when selecting an intention. The shared policy defines the local-map rules and tool contract while leaving situation assessment, intention, and route choice to the pedestrian. An uninformed pedestrian may tour, observe, wait, or explore a legal route or target. Direct evidence and communicated information enter the next model observation, after which the model determines whether to adopt evacuation as its objective. Personality, memory, affect, and evidence can influence preferences among legal choices but cannot change glyph meanings, coordinates, or passability. Fig. 1 summarizes this methodological boundary, and Fig. 3 details the construction of each private spatial observation. 3. Experimental Design This section applies the general framework in Section 2 to an evacuation scenario in Plaza. The plaza is represented by a155 × 164raster with a cell length of 0.4 m, giving a raster extent of approximately62.0 × 65.6m and a walkable area of 1,201.12 m 2 . Twenty-five groups of trees form fixed internal obstacles. Eleven adult pedestrians are distributed across the plaza, while one moving threat enters from a fixed location. Five openings connect the plaza to its surroundings: two 4.0-m-wide entrance gates at the northern and southern ends and 3 evacuation exits that never closed along the eastern boundary, with widths of 1.4, 3.5, and 1.1 m. The entrance gates and evacuation exits have different operational functions. During normal use, the northern and southern gates admit people into the plaza. Once the simulated attack activates the emergency phase, both entrance gates begin closing and subsequently become impassable. This rule represents emergency access control: admitting additional people after a violent incident would expose them to the threat and increase the number of potential victims. The three designated evacuation exits are therefore opened and remain available for outward movement. The asymmetric opening rule follows the functional distinction in the actual plaza between stopping further entry and maintaining evacuation capacity. All simulations use the same plaza geometry, opening- control rule, pedestrian number, adult perception parame- ters, movement rules, threat policy, communication radius, memory mechanisms, and language model. The experimental factor is the personality composition of the eleven-person group. Each profile uses the fixed T-scores listed in Table 1. The analysis examines whether personality composition is as- sociated with situation appraisal, urgency and affect, changes in objectives and routes, access to exit information, and the resulting evacuation outcomes under the same physical and informational constraints. The experiment evaluates eight personality compositions in eight matched blocks.The analysis combines run-level out- comes with pedestrian-level records of perception, decisions, memory, movement, information transfer, and final status. The following subsections specify the plaza and common parameters, outcome measures, statistical treatment, model configuration, and experimental conditions. 3.1. Simulation Setup and Common Parameters 3.1.1. Spatial Layout and Emergency Opening Control Fig. 5 shows the spatial relation among the two entrance gates, three evacuation exits, fixed obstacles, pedestrian starting locations, and the initial threat location. The entrance gates occupy the northern and southern ends of the plaza, whereas the three evacuation exits are distributed along the eastern boundary. The 25 groups of trees are distributed within the walkable interior and divide the open plaza into locally constrained movement corridors. The state of each opening forms part of the time- dependent physical grid퐺 푡 . During the emergency phase, an entrance passes through open, closing, and closed states; Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 10 of 22 LLM-powered Modeling of Evacuation under a Moving Threat once closed, it is no longer physically passable. The three evacuation exits remain open in the reference scenario. Pedestrians do not receive these states from the complete physical map. An agent learns that an opening is available or unavailable only by observing it directly or by receiving information from another pedestrian. An entrance observed before closure may therefore remain in the agent’s memory as apparently usable until later evidence updates that belief. The opening-control rule consequently affects both physical route availability and the information on which agents base subsequent decisions. For the Plaza scenario, each simulation contains eleven adult pedestrians placed at spatially distributed starting cells, together with one moving threat-"terrorist" entering from a fixed cell. Within each matched block, all personality- composition conditions use the same pedestrian starting cells, threat starting cell, plaza geometry, obstacle arrangement, and opening-control schedule. Personality profiles are reassigned among the fixed pedestrian starting cells across blocks so that the results are not tied to a particular profile occupying a particular location. Each physical step lastsΔ푡 = 1∕3s and permits movement to one neighbouring cell. With a cell length of 0.4 m, the maximum speed is 1.2 m s −1 along the grid axes and approximately 1.7 m s −1 diagonally. When several agents attempt to enter the same cell, one is selected at random and the others are assigned feasible neighbouring cells. Movement prevents overlap, opposing swaps, diagonal crossings, and passage between blocked corners. A simulation ends when every pedestrian has evacuated or been reached by the threat, or when 240 simulated seconds have elapsed. Pedestrians still active at the time limit are recorded as unresolved. 3.1.2. Outcome Measures The outcome measures describe evacuation outcomes, threat exposure, and pedestrian behavior. 3.1.3. Statistical Treatment Movement directness was calculated as net displacement divided by path length over the 10 s following each applied decision, ending at evacuation, death, or the simulation limit and including the final movement step. The analysis included 10,947 decisions after initialization from 704 pedestrians. Urgency and directness were divided at their pooled medians; each pedestrian’s share of decisions in a quadrant was then used to compare outcomes and calculate AUC. The 5 homogeneous compositions were compared using run-level decision shares within the 8 paired blocks. Two- sided paired sign-flip tests enumerated all2 8 assignments, with Holm adjustment across the 10 pairwise comparisons for each measure. The 95% intervals in Fig. 7 were obtained by resampling the paired blocks. Logistic regression compared the 462 evacuated and 202 killed pedestrians, while linear regression of log evacuation time included the evacuated pedestrians. Geometry was represented by initial distance to the nearest designated Table 4 Outcome measures computed for each pedestrian. MeasureDefinition Evacuation Evacuation timeTurns from run start to reaching an opening Trajectory lengthDistance walked along the executed trajectory Evacuation efficiency Shortest exit distance over walked distance, capped at 1; zero when unresolved Critical safety margin Smallest distance to the adversary over the run Mean threat distance Mean distance to the adversary over the run OutcomeEvacuated, reached by the threat, or unresolved at the time limit Behavioral descriptors Pre-movement delay Turns from first evidence to the first committed move Movement directness Net displacement divided by path length over the 10 s following a decision, ending at evacuation, death, or the simulation limit Reversals per 100 m Number of heading changes beyond 120°, normalized per 100 m of walked distance Herding rateFraction of moves aligned within 45° with neighbors inside 5 m Pocket cells entered Entries into cells with at most two passable orthogonal neighbors Exit used, familiar-exit use Which opening was taken, and whether it was the nearest known one Threat responseSituation appraisal and action after directly seeing A or D evacuation exit; personality by composition; information by exit-information categories, the numbers of distinct warning senders and recipients, and whether and when threat evidence was first recorded; and affect by mean reported urgency, mean engine-computed fear, and the share of high-urgency, low- directness decisions. Each factor group was fitted separately and then included in a combined model. McFadden pseudo- 푅 2 describes the evacuation-outcome models, and ordinary 푅 2 describes the time models. These models summarize associations within the recorded simulations. 3.1.4. Language Model Configuration The decision and memory roles both usedGLM-5.3-flash, with a sampling temperature of 0.2. Ordinary decisions used the model’s lowest reasoning level, and decisions triggered by direct visual evidence used a high level. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 11 of 22 LLM-powered Modeling of Evacuation under a Moving Threat aRecorded plaza and trajectoriesbdifferent route 0 1 2 3 4 5 6 7 8 9 10 N exit1 exit2 exit3 open exit closed gate attack 2 m perception 12 m GLM-5.3-flash decision and memories 5 exit162 s recorded path · 31.7 m 6 exit212 s recorded path · 6.5 m 7 unresolved100 s recorded path · 52.8 m Agent 5's final opening was not its initially nearest geometric opening in this recorded run. illustrative completed run Figure 5: Plaza geometry and three illustrative trajectories. The perception map shows the three evacuation exits, two entrance gates, eleven pedestrian starting cells, fixed obstacles, and the initial threat position. The concentric circles indicate the implemented 2 m attack radius and 12 m perception radius. The trajectories illustrate three recorded outcomes from one completed run. 3.2. Experimental Conditions The executed experiment varied only the personality composition of the eleven-person group. Eight compositions were defined using the five profile templates in Section 2.1.1. Five were homogeneous: A comprised eleven average pedes- trians, B eleven calm-independent pedestrians, C eleven bold- solitary pedestrians, D eleven rule-following pedestrians, and H eleven anxious-conformist pedestrians. Conditions D–H formed a dose ladder in which rule-following pedestrians were progressively replaced by anxious-conformist pedes- trians: E contained eight rule-following and three anxious- conformist pedestrians, F contained six and five, and G contained three and eight, respectively. The run-level anxious- conformist proportions were therefore0,3∕11,5∕11,8∕11, and1across D–H. The five homogeneous conditions A, B, C, D, and H were compared pairwise within blocks. We conducted a post hoc spatial analysis of decisions based on remembered threat information. For each threat-avoidance decision with a recorded last sighting and a nonzero first executed step, we measured changes in distance to the last observed position and to the adversary’s actual position at step onset. Both reference positions were held fixed when calculating these changes. Directional mismatch denoted a step that increased the former distance but decreased the latter. Mismatch rates were calculated among steps moving away from the last observed position, with 95% percentile intervals obtained by resampling the 8 paired blocks. Evidence age was the time since last sighting reported in the decision input. 4. Results 4.1. Decision, Memory, and Evacuation Outcomes This section examines how the recorded behaviors emerged, and to what extend the knowledge graph works.Of the 704 pedestrians, 462 (65.6%) evacuated, 202 (28.7%) were killed. The following analyses examine how pedestrians revised their decisions, how responses differed across personality compositions, and how exit information was associated with evacuation outcomes. 4.1.1. Decision Revisions during Evacuation The knowledge graph illustrates each single decision-turn in the whole simulation. Across 10,947 decisions following each pedestrian’s initial decision, plan-level revisions oc- curred in 64.5% of epochs, compared with 8.8% for goal-level revisions and 9.9% for execution-level adjustments. Changes at different layers could occur within the same epoch, and it also means the pedestrian would switch exit indeed, and all of these are determined by the large language model. Goal revisions were most frequent when urgency changed substantially (Fig. 6). An absolute urgency change of at least 0.15 was accompanied by a goal revision in 58.6% of epochs, compared with 4.3% when the change was smaller. New direct threat evidence was accompanied by a goal revision in 44.1% of epochs. The association between urgency changes and goal revision persisted across thresholds of 0.10, 0.15, and 0.20, with corresponding risk ratios ranging from 12.27 to 14.37. Information from other pedestrians was associated with more goal revisions on first receipt than on subsequent receipt: Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 12 of 22 LLM-powered Modeling of Evacuation under a Moving Threat a Revision layers πH Goal layer8.8% πM Plan layer64.5% πL Execution layer 9.9% Plan retained 29.1% (D = 0) n = 10,947 decision epochs 0.00.20.40.60.81.0 Probability Urgency jump |Δu| ≥ 0.15 Direct threat evidence Social information, first arrival Physical obstruction Social information, repeat No new stimulus b Trigger-specific revision depth 0.586 0.441 0.376 0.076 0.063 0.017 baseline 0.043 Pr(D ≥ 1)Pr(D ≥ 2)Pr(D ≥ 3) Figure 6: Decision revision by layer and stimulus. Left: the frequencies of goal-, plan-, and execution-level revisions across 10,947 decisions, together with the proportion retaining the previous decision. Right: cumulative revision probabilities for six stimulus classes. The dashed line marks the 4.3% goal-revision rate for epochs with an absolute urgency change below 0.15. 37.6% versus 6.3%. Physical constraints were accompanied by revisions at the plan level or above in 54.3% of decisions and goal-level revisions in 7.6%. Pedestrians therefore usually retained their goals while adjusting their plans or local movement in response to physical constraints. Once pedestrians left ordinary activity, none returned to it. Threat avoidance and movement toward a known exit were retained at the next decision with probabilities of 0.982 and 0.931, respectively. These patterns indicate that evacuation- related objectives were largely maintained while plans and local movement continued to change. 4.1.2. Personality, Appraisal, and Arousal Danger appraisal differed most across personality pro- files when pedestrians relied on remembered threat in- formation. Without threat information, danger-assessment rates were nearly identical across the 5 homogeneous per- sonality compositions, differing by at most 0.002. When pedestrians relied on remembered threat information, the gap widened to 26.5 percentage points, with the danger- assessment rate in the anxious-conformist composition reach- ing 52.8%, approximately twice the 26.3% observed in the calm-independent composition. With direct sightings, the gap in danger-assessment rates narrowed to 3.3 percentage points across the 5 personality compositions. These results show that personality-related differences in danger appraisal depend on the available threat information, with remembered evidence revealing the clearest separation between profiles. We examined the relationship between reported urgency and subsequent movement directness. Across the evaluated decisions, 32.5% combined high urgency with high move- ment directness, making this the largest of the 4 quadrants. The mean share of high-urgency, low-directness decisions was 31.6% among pedestrians who were killed, approximately 4.5 times the 7.0% among those who evacuated, with an AUC of 0.839 for distinguishing the 2 outcomes. The opposite combination showed a clear contrast: low-urgency, high- directness decisions accounted for an average of 62.9% among evacuated pedestrians and 15.0% among killed pedestrians, with an AUC of 0.802. Evacuated pedestrians also had the lowest mean urgency and highest mean directness, with a centroid at(푢 = 0.358, ̂ 푑 = 0.867), compared with (0.653, 0.630)for killed pedestrians and(0.587, 0.416)for unresolved pedestrians. These results show that reported urgency gains behavioral meaning when considered alongside subsequent movement: pedestrians who were killed more often combined a strong sense of urgency with less direct movement, revealing a gap between the urgency expressed by the agent and the movement that followed. Across the 5 homogeneous personality compositions, the mean share of high-urgency, low-directness decisions ranged from 11.41% for calm-independent agents to 34.33% for rule-following agents, a roughly 3-fold difference. Anxious- conformist agents followed at 33.32%, while average and bold- solitary agents recorded 29.45% and 22.52%, respectively. Calm-independent agents had lower shares than both rule- following and anxious-conformist agents in all 8 paired blocks (Holm-adjusted푝 = 0.078for each comparison). For low- urgency, high-directness decisions, calm-independent agents recorded the highest mean share at 31.08%, approximately 2.4 times the 12.72% recorded by anxious-conformist agents. The calm-independent composition therefore combined the lowest share of high-urgency, low-directness decisions with the highest share of the opposite combination. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 13 of 22 LLM-powered Modeling of Evacuation under a Moving Threat In conclusion, the outcome and personality comparisons identify reported urgency and subsequent movement direct- ness as complementary descriptors of simulated evacuation behavior (Fig. 7). Across 102,045 memory operations involving 34,489 distinct items, writing accounted for the largest share at 33.8%, followed by forgetting at 29.9% and rewriting at 24.7%, while explicit retention made up the remaining 11.6%. Anxious- conformist agents stood out for retaining existing memories: their explicit-retention share reached 15.6%, compared with 10.8–12.1% across the other 4 homogeneous personality compositions. They also recorded the highest share of deci- sions without revision, at 33.5%, showing that more frequent memory retention accompanied greater decision continuity in this composition. Across the knowledge graphs, each decision was linked to an average of 5.51 memory items. Fig. S2 shows these links for one pedestrian. Table 5 traces 2 cases in which remembered observations, their interpretation, and escape plans changed over successive decisions. In Case 1, earlier shouts acquired a new meaning after the pedestrian saw an armed person. The pedestrian initially wanted to observe and clarify the situation; after the sighting, its memory described the earlier shouts as probable warnings and placed escape ahead of exploration. When the known gate subsequently closed, the recorded plan combined continued threat avoidance with a search for an open exit. This sequence is consistent with the distinction between interpreting warning cues and assessing protective actions in the Protective Action Decision Model (Lindell and Perry, 2012). The memory revisions documented both why the pedestrian intended to leave and which escape options it considered usable. In Case 2, recognizing that a gate was closed preceded abandoning the route toward it. The pedestrian recorded the closure but retained a plan to approach the gate and check whether it could be opened, and the next decision continued toward it. A later decision treated the route as impassable and sought an alternative, which the following memory revision recorded. Experiments have shown that exit familiarity influences evacuation choices (Kinateder et al., 2018). In the present case, the stated intention to verify whether a known gate could be used offers a possible explanation for continuing toward it after learning that it was closed. The record iden- tifies an intermediate stage in route revision: the pedestrian acknowledged the obstruction while still considering whether the original escape plan could work. An illustrative comparison involved 2 pedestrians who started from the same position in one paired block. Following warning shouts, the calm-independent pedestrian’s memory emphasized moving south while watching for signs and continuing to search for an exit. In contrast, the anxious- conformist pedestrian’s memory emphasized following the crowd along a familiar southern route. At the next recorded decision, their objectives were exit exploration and following others, respectively, while both continued moving southward. The memory–decision links thus distinguish different behav- ioral intentions accompanying a broadly similar movement direction, showing how the reconstructed graphs support interpretation of individual evacuation trajectories. 4.1.3. Information Access and Survival Across all 704 pedestrians, knowledge of a usable exit was strongly associated with outcome. Pedestrians who acquired knowledge of at least one usable exit reached safety in 89.5% of cases; among those who acquired no such knowledge, 1.05% reached safety and 80.0% were killed. Fisher’s exact test yielded an odds ratio of 800.7 (푝 = 6.1 × 10 −118 ). The relationship was graded: rescue rates were 1.05% for pedestrians who knew no usable exit, 64.3% for those who knew one, and 95.7% for those who knew two. At the run level, the number of pedestrians with usable-exit knowledge correlated with the number rescued (휌 = 0.607,푝 = 1.0 × 10 −7 ). The value of the information also depended on its content. Pedestrians who directly observed a usable exit were rescued in 91.2% of cases, compared with 52.2% of those informed by a peer. None of the 58 pedestrians whose only exit information referred to a closed gate was rescued, and 87.9% were killed. Acquisition timing also differed by outcome: the median time to usable-exit knowledge was 5.17 s for rescued pedestrians and 32.33 s for killed pedestrians. Fig. 9 compares evacuation outcomes by exit knowledge and information group, together with the timing of knowledge acquisition. Panel (a) shows evacuation rates of 1.05% with no usable exit known, 64.3% with 1, and 95.7% with 2. Panel (b) includes the 58 pedestrians whose only reported exit information concerned a closed gate; none evacuated. Panel (c) shows median acquisition times of 5.17 s for evacuated pedestrians and 32.33 s for killed pedestrians. The two propagation channels were associated with different outcomes. The number of distinct pedestrians reached by a shout yielded an AUC of 0.808 for being killed (푝 = 6 × 10 −42 ), while the number of distinct shouters heard yielded an AUC of 0.791 (푝 = 2 × 10 −34 ). By contrast, usable-exit knowledge predicted rescue (푝 = 7 × 10 −98 ). In this framework, shouts primarily carried alarm, whereas exit messages conveyed routes. Among 311 pedestrians whose previous appraisal was normal and whose first evaluated decision containing a shout had no direct or remembered threat evidence, 286 (92.0%) reported higher urgency than in their preceding decision. At that point, 254 (81.7%) assessed the situation as unsure, and only 1 assessed it as dangerous. These results show that heightened urgency and uncertainty about danger can coexist in the simulated response to a warning. Exit information propagated through a narrow channel. Each run had an average of 2.1 senders, and the two most active senders accounted for 90.1% of receiving relations. Propagation extended no more than one hop: 591 pedestrians observed an exit directly, while 64 learned of one from someone who had observed it. Fig. S1 contrasts the two channels within a single run. The same eleven pedestrians Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 14 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Table 5 Changes in remembered information and escape plans in 2 illustrative cases. StageMemory excerpt (translated)InterpretationDecision or plan Case 1: From uncertain signals to escape and exit search 1. Situation unclear “I wanted to stop and observe to clarify the situation, without hastily following the others.” The meaning of others’ behavior is still unclear. The stated plan is to observe before deciding whether to follow others. 2. Threat confirmed “The 2 shouts I heard earlier . . . were probably warnings.” “Escaping comes first; exploration can wait.” Earlier sounds are now interpreted as warnings. The decision changes from continuing activity to moving away from the threat. 3. Another exit needed “Next, I need to find an exit that is still open or a direction with more people, and keep moving away from the northeast.” Escape remains necessary, but the known gate may be unusable. The next decision maintains threat avoidance and includes looking for other exits. Case 2: From choosing a known exit to checking and abandoning it 1. Known exit chosen “I remembered that [the gate] was to the south, so I decided to go south, away from the armed person and toward the known exit.” The known exit provides a destination for escape. The selected goal is to reach the known exit. 2. Closed gate to be checked “The exit door to the south is closed . . . Once I get closer, I may check whether it can be opened or look for another route.” The gate is closed, but the pedestrian still considers whether it can be used. The next decision continues toward the gate to check it. 3. Original route abandoned “The south exit gate is still closed and cannot be used, so I have switched to going east . . . to look for another exit.” The gate is now regarded as unusable. The decision selects an alternative route, and the revised memory records the new plan. Excerpts are translated from model-generated Chinese memories. Ellipses mark omissions; square brackets replace an internal gate identifier with a descriptive name. Stages are ordered within each case, and the final column summarizes the corresponding decision or stated plan. Both cases involve bold-solitary pedestrians in separate runs. occupy identical positions and are encoded by outcome in both panels, so only the edges differ. Shouting forms a dense, multi-source network, whereas exit information travels through a small number of directed, single-hop links. Fig. 8 traces this process for one pedestrian. Five aligned lanes show perception events, the affect transition and ur- gency trajectory, the appraisal category, decisions positioned by revision depth, and memory write, rewrite, and forget operations. The two goal-layer revisions appear as the tallest decision markers; callouts reproduce the memory entries recorded around them, and a broken time axis connects the early sequence to the outcome at 219.7 s. Agent 3 in the rule-following condition of block 5 heard shouting at 3.33 s, changed from calm to afraid at 7.00 s, and observed the armed adversary at 8.00 s. The agent then changed its goal from exit seeking to threat avoidance and raised its self-reported urgency to 0.9 while moving toward the only opening it knew. When the gate closed at 11.67 s, the agent revised its goal again; it was killed at 219.7 s. Its opening knowledge referred only to the entrance gate that closed while it was approaching; meanwhile, entrance gates were closing with merely one person being able to go out of them. Exit information was closely associated with whether pedestrians evacuated. The information-only model had a McFadden pseudo-푅 2 of 0.6650, compared with 0.3541 for affect, 0.0537 for geometry, and 0.0036 for personality composition; the combined model reached 0.7020. Exit knowledge and communication records therefore captured much of the observed separation between evacuation and death. 4.1.4. Factors Associated with Evacuation Time Evacuation time was associated with geometry, infor- mation, and affect. Their separate models had푅 2 values of 0.6608, 0.6864, and 0.6859, respectively, compared with 0.0031 for personality composition; the combined model reached 0.8738. The higher fit of the combined model indicates that these factors describe evacuation duration more fully when considered together. 5. Discussion 5.1. Contribution to Evacuation Modeling The framework connects the development of individual interpretations to the movement of a crowd. Social-force and cellular-automaton models describe local movement and interaction, while behavioral extensions represent differences in perception, preferences, and route choice. The present approach adds an explicit record of how an agent describes its situation, retains experience, and revises a plan within a shared physical environment. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 15 of 22 LLM-powered Modeling of Evacuation under a Moving Threat 0.00.20.40.60.81.0 Reported urgency 0.0 0.2 0.4 0.6 0.8 1.0 Subsequent movement directness Low urgency High directness 17.5% High urgency High directness 32.5% Low urgency Low directness 19.2% High urgency Low directness 30.8% EvacuatedKilledUnresolved 0 1 2 3 4 5 Decisions (%) 0.00.51.0 Urgency 0.0 0.5 1.0 Movement directness Calm- independent 11.41% [7.89, 15.24] 0.00.51.0 Urgency Bold- solitary 22.52% [16.07, 29.55] 0.00.51.0 Urgency Average 29.45% [20.67, 36.75] 0.00.51.0 Urgency Anxious- conformist 33.32% [25.61, 43.40] 0.00.51.0 Urgency Rule- following 34.33% [30.12, 38.70] (a) Urgency and movement Group means: (b) Personality compositions High urgency + low directness: mean share (95% CI) Figure 7: Reported urgency and subsequent movement directness across 10,947 decisions. (a) Dashed lines mark the pooled medians of urgency (푢 = 0.60) and directness ( ̂ 푑 = 0.606); quadrant labels give the percentages of all evaluated decisions. Symbols mark outcome-group means, with each pedestrian weighted equally. (b) The 5 homogeneous personality compositions. Values above each panel give the mean run-level share of high-urgency, low-directness decisions and its 95% confidence interval from paired-block resampling. In all panels, the linear color scale shows the percentage of decisions within that panel falling in each cell. The individual share of high-urgency, low-directness decisions distinguished death from evacuation with an AUC of 0.839. Learning-based crowd models offer complementary ways to represent adaptive behavior. Deep reinforcement learning develops policies through environmental interaction (Zhang et al., 2023; Pang et al., 2023); hierarchical and knowledge- guided methods organize decisions at different levels (Sun et al., 2026); and attention-based planners coordinate move- ment in pedestrian environments (Dong et al., 2024; Li et al., 2026). The contribution of the present framework is to make the information available at a decision, the model’s stated interpretation, and the resulting movement available for joint analysis. This approach connects movement analysis with ques- tions about how decisions develop. Similar trajectories can accompany different intentions, while a continuing goal can be pursued through changing routes. Recording these distinctions makes it possible to examine how an evacuation unfolds from the perspective of an individual with incomplete information. 5.2. Memory, Interpretation, and Route Revision Memory carries both an account of the situation and the conditions attached to an intended action. The cases in Table 5 distinguish 2 processes: new evidence changes the meaning assigned to earlier cues, and new knowledge about an exit is evaluated against an existing escape plan. These processes connect successive decisions through an evolving understanding of what has happened and what remains possible. The distinction between recognizing a change and acting on its implications is particularly relevant to evacuation. A pedestrian may acknowledge a closed gate while retaining an intention to verify whether it can be used, leaving an interme- diate stage between receiving information and abandoning Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 16 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Agent 3: a complete psychological–cognitive–decision–action chain Perception Affect Appraisal Decision Memory 02468101214 Simulation time (s) shout heard first evidencearmed man sighted urgency calmafraid · fear 0.60 normalunsuredangerdangerunsure marker height = revision depth D explore_for_exit → move_away_from_threat move_away_from_threat → explore_for_exit Outcome killed 219.7 s Only learned of closed gated Gate closed at 11.67 s No threat in sight, but shouting in the distance. Follow the evacuation arrows down the corridor and move carefully. An armed man is charging the crowd to the north. Fall back south, get clear, and keep looking for a way out. The man with the knife is in plain view now — I cannot let myself get anywhere near him. The south gate (ft_back) has shut. That way out is gone. WRITEREWRITEFORGET (ft_back) Figure 8: The recorded chain for Agent 3 in the rule-following run. Five lanes carry perception events, the affect transition and the self-reported urgency trace, the appraisal band, each decision at a height set by its revision depth, and the write, rewrite, and forget operations on memory. Callouts reproduce selected memory entries. The pedestrian learns of only one opening, the south entrance gate, which closes at 11.67 s. a route. This interpretation extends the case analysis into a testable explanation of route persistence and is consistent with the separation of cue interpretation and protective-action assessment in the Protective Action Decision Model (Lindell and Perry, 2012). The reconstructed knowledge graph makes this sequence open to examination by linking retained information to the decisions at which it was available. It supports questions about which interpretations persist, which plans remain conditional, and what evidence accompanies their revision? The resulting analysis treats evacuation as a developing sequence of judgments and actions, with memory preserving the connections between them. 5.3. Scope and Limitations The findings concern a small pedestrian population in one plaza under a specified moving-threat policy. Personality compositions were compared within a common environment, and the personality representation entered both the decision prompts and the affect model. The observed differences therefore concern the combined personality configuration. The recorded interpretations are model-generated ac- counts supplied within the decision process. Their correspon- dence with human judgments, route choices, and responses to communicated information remains to be established. The present contribution is a framework and a set of observable decision sequences through which such correspondence can be investigated. 5.4. Implications for Future Evacuation Research A central opportunity is to evaluate evacuation models against the development of behavior as well as its final out- come. Human experiments could compare when participants recognize danger, how they interpret an uncertain exit, and when they abandon a preferred route. These comparisons would test whether simulated transitions reproduce the sequence and timing of human responses. The same framework could support controlled studies of evacuation communication. Messages that report a closure could be compared with messages that explain its conse- quences and identify a usable alternative, testing whether information content changes verification, route revision, Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 17 of 22 LLM-powered Modeling of Evacuation under a Moving Threat 0255075100 Pedestrians (%) 0 1 2 3 Number of exits nEvacuated 1901.1% 9864.3% 39695.7% 2090.0% 0255075100 Pedestrians (%) Exit seen directly Exit reported by others No initial exit information Only a closed gate reported nEvacuated 49191.2% 2352.2% 1321.5% 580.0% 060120180240 Time to first usable-exit knowledge (s) 0 25 50 75 100 Cumulative pedestrians (%) 5.17 s 32.33 s Evacuated Killed (a) Known usable exits(b) Exit information (c) Time to exit knowledge EvacuatedKilledUnresolved Figure 9: Exit knowledge and evacuation outcomes. (a) Outcome shares by the number of usable exits known. (b) Outcome shares for the 4 exit-information groups. “No initial exit information” refers to the absence of system-provided exit information at initialization; “Only a closed gate reported” refers to information received from others during the simulation. Numbers beside the bars give group sizes (푛) and evacuation rates. (c) Cumulative distributions of time to first usable-exit knowledge among pedestrians who acquired it, grouped by final outcome. Markers indicate median times of 5.17 s for evacuated pedestrians and 32.33 s for killed pedestrians. and exposure to danger. Such studies would connect the interpretation of a warning to the movement that follows it. A further direction is to connect individual decision histories with collective evacuation patterns. Distributions of perceived danger, exit knowledge, and continuing intentions could inform behavioral states in mesoscopic models and help investigate changes in aggregate exit demand. This would extend the use of LLM-powered simulation from examining individual choices to studying how uneven information and different interpretations develop into crowd-level behavior. 6. Conclusions This study develops an LLM-powered framework for examining how evacuation decisions evolve under a moving threat. Private perception, personality, and retained experi- ence provide the context for individual choices, while the physical simulation records how those choices are executed. Linking memory revisions to decisions and movement makes the formation, continuation, and revision of escape plans accessible to analysis. Most decision changes occurred at the plan level. Large changes in urgency and new direct threat evidence were associated with goal revisions, while physical constraints usually prompted adjustments that preserved the current goal. Once pedestrians left ordinary activity, they maintained evacuation-related objectives while adapting their plans and movement. Personality compositions differed in danger appraisal under remembered evidence and in the relationship between reported urgency and movement. The share of high-urgency, low-directness decisions ranged from 11.41% for calm- independent agents to 34.33% for rule-following agents. The calm-independent composition maintained lower shares than the rule-following and anxious-conformist compositions across all paired blocks. Knowledge of a usable exit was strongly associated with evacuation. Pedestrians with knowledge of a usable exit were rescued in 89.5% of cases, compared with 1.05% of those without such knowledge, yielding an odds ratio of 800.7. No pedestrian whose only exit information identified a closed gate was rescued. Exit knowledge traveled at most one hop, through an average of 2.1 senders per run; the two most Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 18 of 22 LLM-powered Modeling of Evacuation under a Moving Threat active senders accounted for 90.1% of transmissions. Rescued pedestrians acquired this knowledge at a median of 5.17 s. Exit information was closely associated with whether evacuation occurred, while evacuation time was associated with geometry, information, and affect together. These find- ings connect the knowledge available to pedestrians with both the completion and duration of evacuation. The memory cases identify changes in the meaning of earlier information and in the conditions for retaining an escape plan. These sequences provide concrete hypotheses about delayed responses and persistence toward a known exit. The framework opens a path toward evacuation research that connects how people understand a developing emergency with how their individual choices contribute to collective movement. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 19 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Supplementary Figures AUC(killed) = 0.808 a Shout network 0 1 2 3 4 56 7 8 9 10 AUC(rescued) = 0.651 b Exit-information network 0 1 2 3 4 56 7 8 9 10 rescuedkilledunresolved Figure S1: Shout and exit-information propagation in one run. The same eleven pedestrians hold identical positions in both panels and are encoded by outcome. Directed edges give deduplicated sender–receiver pairs for (a) heard shouts and (b) transmitted exit information. Across the experiment, shout out-degree carries an AUC of 0.808 for being killed and exit knowledge an AUC of 0.651 for rescue. Acknowledgements This work was supported by the National Key Research and Development Program of China (No. 2025YFB2606402), the National Science Foundation of China (No. 72604081), and the Sichuan Provincial Science and Technology Innova- tion Project (No. 2024YFHZ0345). Agent 1 Observation 54 Memory 163 Place 5 Decision 54 Goal 3 Entity 1 Route 54 Outcome 1 Affect 12 Collision 0 Agent 3 knowledge graph · nodes by type Retrieval density: 5.51 memories per decision. TRIGGERED 66CHOSE 57 ASSOCIATED WITH DECISION 54 CREATED MEMORY 163 RETRIEVED FOR 360 INVOLVED IN 0ENDED IN 1 Figure S2: Reconstructed knowledge graph for Agent 3. Nodes are grouped into eleven type clusters and relations are bundled between types, withRETRIEVED FORemphasized. This agent’s graph holds 54 observations, 54 decisions, 54 routes, 163 memories, and 12 affect records, with an average of 6.67 memory links per decision. Across the experiment, the graphs contain 75,944 nodes and 138,963 edges. References Agnelli, J.P., Buffa, B., Knopoff, D., Torres, G., 2023. A Spatial Ki- netic Model of Crowd Evacuation Dynamics with Infectious Disease Contagion. Bulletin of Mathematical Biology 85, 23. doi:10.1007/ s11538-023-01127-6. Agnelli, J.P., Colasuonno, F., Knopoff, D., 2015. A kinetic theory approach to the dynamics of crowd evacuation from bounded domains. Mathematical Models and Methods in Applied Sciences 25, 109–129. doi:10.1142/ S0218202515500049. Ahissar, E., Assa, E., Mizrachi, N., Nelinger, G., Ben-Joseph, T., Saraf-Sinik, I., Geiger, S., Rivkind, A., 2025. Closed-loop perception: gaps between artificial intelligence and biology. Current Opinion in Behavioral Sciences 65, 101572. doi:10.1016/j.cobeha.2025.101572. Bahamid, A., Mohd Ibrahim, A., Shafie, A.A., 2024. Crowd evacuation with human-level intelligence via neuro-symbolic approach. Advanced Engineering Informatics 60, 102356. doi:10.1016/j.aei.2024.102356. Beattie, S., Xi, J.Y.S., Chan, W.K.V., 2022. On effective campus attack response: Insights from agent-based simulation for improving emergency information sharing system design and response strategy. Interna- tional Journal of Disaster Risk Science 13, 435–447. doi:10.1007/ s13753-022-00418-1. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 20 of 22 LLM-powered Modeling of Evacuation under a Moving Threat Bellomo, N., Dogbe, C., 2011. On the Modeling of Traffic and Crowds: A Survey of Models, Speculations, and Perspectives. SIAM Review 53, 409–463. doi:10.1137/090746677. Binz, M., Akata, E., Bethge, M., Brändle, F., Callaway, F., Coda-Forno, J., Dayan, P., Demircan, C., Eckstein, M.K., Éltető, N., Griffiths, T.L., Haridi, S., Jagadish, A.K., Ji-An, L., Kipnis, A., Kumar, S., Ludwig, T., Mathony, M., Mattar, M., Modirshanechi, A., Nath, S.S., Peterson, J.C., Rmus, M., Russek, E.M., Saanum, T., Schubert, J.A., Schulze Buschoff, L.M., Singhi, N., Sui, X., Thalmann, M., Theis, F.J., Truong, V., Udandarao, V., Voudouris, K., Wilson, R., Witte, K., Wu, S., Wulff, D.U., Xiong, H., Schulz, E., 2025. A foundation model to predict and capture human cognition. Nature 644, 1002–1009. doi:10.1038/s41586-025-09215-4. Chen, J., Ma, J., Lo, S.M., 2018a. Geometric constraint based pedestrian movement model on stairways. Physica A: Statistical Mechanics and its Applications 505, 1212–1230. doi:10.1016/j.physa.2018.03.051. Chen, L., Tang, T.Q., Huang, H.J., Wu, J.J., Song, Z., 2018b. Modeling pedestrian flow accounting for collision avoidance during evacuation. Simulation Modelling Practice and Theory 82, 1–11. Chen, S., Di, Y., Liu, S., Wang, B., 2017. Modelling and Analysis on Emergency Evacuation from Metro Stations. Mathematical Problems in Engineering 2017, 2623684. Dang, P., Zhu, J., Li, W., Lai, J., 2025a. A large language model-based agent for wayfinding: simulation of spatial perception and memory. Cartography and Geographic Information Science 52, 350–369. doi:10.1080/15230406. 2024.2405596. Dang, P., Zhu, J., Li, W., Xie, Y., Zhang, H., 2025b. Large-language- model-driven agents for fire evacuation simulation in a cellular automata environment. Safety Science 191, 106935. doi:10.1016/j.ssci.2025. 106935. Dong, L., He, Z., Song, C., Yuan, X., Zhang, H., 2024. Multi-robot social-aware cooperative planning in pedestrian environments using attention-based actor-critic. Artificial Intelligence Review 57, 108. doi:10.1007/s10462-024-10739-w. Gao, C., Lan, X., Li, N., Yuan, Y., Ding, J., Zhou, Z., Xu, F., Li, Y., 2024. Large language models empowered agent-based modeling and simulation: a survey and perspectives. Humanities and Social Sciences Communications 11, 1259. doi:10.1057/s41599-024-03611-3. Goldstein, A., Zada, Z., Buchnik, E., Schain, M., Price, A., Aubrey, B., Nastase, S.A., Feder, A., Emanuel, D., Cohen, A., Jansen, A., Gazula, H., Choe, G., Rao, A., Kim, C., Casto, C., Fanda, L., Doyle, W., Friedman, D., Dugan, P., Melloni, L., Reichart, R., Devore, S., Flinker, A., Hasenfratz, L., Levy, O., Hassidim, A., Brenner, M., Matias, Y., Norman, K.A., Devinsky, O., Hasson, U., 2022. Shared computational principles for language processing in humans and deep language models. Nature Neuroscience 25, 369–380. doi:10.1038/s41593-022-01026-4. Guo, K., Zhang, L., Wu, M., 2023. Simulation-based multi-objective optimization towards proactive evacuation planning at metro stations. Engineering Applications of Artificial Intelligence 120, 105858. doi:10. 1016/j.engappai.2023.105858. Hassanpour, S., Rassafi, A.A., 2021. Agent-Based Simulation for Pedestrian Evacuation Behaviour Using the Affordance Concept. KSCE Journal of Civil Engineering 25, 1433–1445. doi:10.1007/s12205-021-0206-7. Helbing, D., Farkas, I., Vicsek, T., 2000. Simulating dynamical features of escape panic. Nature 407, 487–490. doi:10.1038/35035023. Hoogendoorn, S., Bovy, P.H.L., 2000. Gas-Kinetic Modeling and Simulation of Pedestrian Flows. Transportation Research Record: Journal of the Transportation Research Board 1710, 28–36. doi:10.3141/1710-04. Hu, X., Chen, T., Deng, K., Wang, G., 2023. Effects of aggressiveness on pedestrian room evacuation using extended cellular automata model. Physica A: Statistical Mechanics and its Applications 619, 128731. Jiang, N., Yu, H., Lee, E.W.M., Yang, H., Yang, L., Yuen, R.K.K., 2025. Machine learning methods in microscopic pedestrian and evacuation dynamics simulation: a comparative study. Simulation Modelling Practice and Theory 144, 103180. doi:10.1016/j.simpat.2025.103180. Kaur, N., Kaur, H., 2022. A Multi-agent Based Evacuation Planning for Dis- aster Management: A Narrative Review. Archives of Computational Meth- ods in Engineering 29, 4085–4113. doi:10.1007/s11831-022-09729-4. Khan, S.D., 2019. Congestion detection in pedestrian crowds using oscillation in motion trajectories. Engineering Applications of Artificial Intelligence 85, 429–443. doi:10.1016/j.engappai.2019.07.009. Kinateder, M., Comunale, B., Warren, W.H., 2018. Exit choice in an emergency evacuation scenario is influenced by exit familiarity and neighbor behavior. Safety Science 106, 170–175. doi:10.1016/j.ssci. 2018.03.015. Kirchner, A., Nishinari, K., Schadschneider, A., 2003. Friction effects and clogging in a cellular automaton model for pedestrian dynamics. Physical Review E 67, 056122. Kouskoulis, G., Spyropoulou, I., Antoniou, C., 2018. Pedestrian simulation: Theoretical models vs. data driven techniques. International Journal of Transportation Science and Technology 7, 241–253. doi:10.1016/j.ijtst. 2018.09.001. Li, J., Wan, B., Song, Z., 2026. Multi-agent deep reinforcement learning for group intelligence in emergency evacuation: A decentralized simulation- to-reality platform with perception-aware policies. Engineering Appli- cations of Artificial Intelligence 165, 113489. doi:10.1016/j.engappai. 2025.113489. Li, S., Li, Q., Zhong, G., Zhang, Y., 2023. Simulation of bi-directional pedestrian flow in corridor based on direction fuzzy visual field. Scientific Reports 13, 19261. Li, X., Zhou, J., Chen, F., Zhang, Z., 2018. Cluster Risk of Walking Scenarios Based on Macroscopic Flow Model and Crowding Force Analysis. Sustainability 10, 385. doi:10.3390/su10020385. Lindell, M.K., Perry, R.W., 2012. The Protective Action Decision Model: Theoretical Modifications and Additional Evidence. Risk Analysis 32, 616–632. doi:10.1111/j.1539-6924.2011.01647.x. Mandar, M., Boulmakoul, A., 2016. Fuzzy Pheromone Potential Fields for Virtual Pedestrian Simulation. Advances in Fuzzy Systems 2016, 4027687. Pang, C., Lyu, L., Zhou, Q., Zhou, L., 2023. Environment-sensitive crowd behavior modeling method based on reinforcement learning. Applied Intelligence 53, 19356–19371. Pelechano, N., Badler, N.I., 2006. Modeling Crowd and Trained Leader Behavior during Building Evacuation. IEEE Computer Graphics and Applications 26, 80–86. doi:10.1109/MCG.2006.133. Raetano, J., Gregor, J., Tamang, S., 2026. A Survey and Computational Atlas of Personality Models. ACM Trans. Intell. Syst. Technol. 17, Article 118. doi:10.1145/3828667. Serrano, Á., Lujak, M., Vizzari, G., 2026. When shortest is not safest: Multi-agent evacuation with awareness and agile routing in dynamic hazards. Simulation Modelling Practice and Theory 150, 103294. doi:10.1016/j.simpat.2026.103294. Sun, L., Liu, H., Fan, B., Li, X., Li, W., 2026. A knowledge-guided hierarchical multi-agent deep reinforcement learning approach for crowd evacuation. Engineering Applications of Artificial Intelligence 181, 115413. doi:10.1016/j.engappai.2026.115413. Tan, J., Zhang, W., Nong, T., Zhang, Z., Wang, T., Ma, Y., Lee, E.W.M., Shi, M., 2025. An improved social force model based on nucleus force theory to simulate building evacuation in different visibility conditions. Simulation Modelling Practice and Theory 142, 103117. doi:10.1016/j. simpat.2025.103117. Tao, J., Wang, P., Jiang, H., Han, Y., 2026. A knowledge-formalization and vision-language-model system for fire emergency decision support. Advanced Engineering Informatics 71, 104409. doi:10.1016/j.aei.2026. 104409. van Toll, W., Pettré, J., 2021. Algorithms for Microscopic Crowd Simulation: Advancements in the 2010s. Computer Graphics Forum 40, 731–754. Tong, Y., Jiang, H., Ning, J., Fu, R., 2026. Strategy-driven evacuation dynamics in heterogeneous crowds under efficiency, safety and fairness objectives. Simulation Modelling Practice and Theory 151, 103320. doi:10.1016/j.simpat.2026.103320. Wang, H., Xu, T., Li, F., 2021. A Novel Emergency Evacuation Model of Subway Station Passengers Considering Personality Traits. Sustainability 13, 10463. doi:10.3390/su131810463. Wang, Z., Cai, S., Liu, A., Jin, Y., Hou, J., Zhang, B., Lin, H., He, Z., Zheng, Z., Yang, Y., Ma, X., Liang, Y., 2025. JARVIS-1: Open-world Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 21 of 22 LLM-powered Modeling of Evacuation under a Moving Threat multi-task agents with memory-augmented multimodal language models. IEEE Transactions on Pattern Analysis and Machine Intelligence 47, 1894–1907. doi:10.1109/TPAMI.2024.3511593. Wu, W., Chen, M., Li, J., Liu, B., Zheng, X., 2022. An Extended Social Force Model via Pedestrian Heterogeneity Affecting the Self-Driven Force. IEEE Transactions on Intelligent Transportation Systems 23, 7974–7986. doi:10.1109/TITS.2021.3074914. Xue, S., Yang, Y., Deng, X., 2023. A novel probabilistic linguistic decision- making model based on discrete evidence fusion and attribute weight optimization. Engineering Applications of Artificial Intelligence 125, 106706. doi:10.1016/j.engappai.2023.106706. Yang, S., Ceferino, L., Zhang, Y., Gu, C., Guo, T., Kondo, G., 2026. When agents learn to think: Large language model-enhanced agent- based modeling for crowd evacuation in disaster scenarios. Reliability Engineering & System Safety 269, 112056. doi:10.1016/j.ress.2025. 112056. Zhang, B., Lo, J.T.Y., Fang, H., Xie, C., Tang, T., Lo, S., 2024. Coupled simulation–optimization model for pedestrian evacuation guidance planning. Simulation Modelling Practice and Theory 134, 102922. doi:10.1016/j.simpat.2024.102922. Zhang, D., Li, W., Gong, J., Zhang, G., Liu, J., Huang, L., Liu, H., Ma, H., 2023. Deep reinforcement learning and 3D physical environments applied to crowd evacuation in congested scenarios. International Journal of Digital Earth 16, 691–714. Zhu, K., Wang, J., Guo, N., Ding, Z., Mei, P., 2020. Simulation of pedestrian counter flow with conflicting preference using a lattice-based simulation model. International Journal of Modern Physics C 31, 2050120. doi:10.1142/S012918312050120X. Ma, Yu, Tang and Li: Preprint submitted to ElsevierPage 22 of 22