We study a network interdiction problem arising out of illicit human trafficking in the U.S. Southwest. Motivated by the significant amount of trafficking data shared with us by a large metropolitan police department, we modeled the interdiction problem as a Repeated One-Sum Game where, day after day, the Human Traffickers (HT) attempt to transport victims from one city to another and Law Enforcement Agencies (LEA) attempt to thwart the HT effort. Since the data indicated that most of the trafficking is taking place through road transportation, we built a network from the U.S. Interstate Highway System and called it U.S. Interstate Highway Network. If LEAs are successful, they win otherwise HTs win. If a HT wishes to transport victims from a city C_i to another city C_j , the strategy set for the HT is the set of paths going from C_i to C_j . Since a LEA can set up a check point on any segment of any path, the strategy set for the LEA is the union of all the path segments of all the paths connecting C_i to C_j . The path segments are the edges of the graph. If a HT selects a path P_k for transportation, a LEA can thwart that attempt only if a checkpoint is set up on at least one of the edges of P_k . If the total number of edges is E = {e_1, … , e_r} , the LEA is interested in finding the probability vector P = [p_1, p_2, … , p_r] that maximizes the expected payoff of the LEA, if the edge e_i is interdicted with probability p_i for all i, 1 ≤ i ≤ r . We show how to compute this probability vector P. Our extensive experimentation support our analytical results.
In this work, we propose a probabilistic and predictive framework to strategize against zero-day attacks in Autonomous Ground Robots (AGRs) operating safety-critical missions using ROS2-based autonomy stacks. Zero-day attacks represent a severe threat in Advanced Persistent Threat (APT) scenarios, as they exploit previously unknown vulnerabilities that remain hidden from defenders, enabling undetected intrusions that can compromise the robots mission and safety. The physical security of the AGR is based on an endpoint anomaly detection system that can prevent catastrophic outcomes. Our approach models this security scenario using a two-phase game-theoretic framework. In Phase I, we model the defender's incomplete knowledge of the attack tree using a Bayesian extensive form game-theoretic formulation of a network penetration attack, in which the defender maintains a prior belief over possible zero-day nodes and samples augmented attack tree realizations incorporating these hypothesized vulnerabilities. This enables computation of a robust spot-check policy by distributing defensive actions across known nodes informed by sampled structural uncertainties, thus increasing the likelihood of intercepting attackers traversing concealed or zero-day paths. The resulting mixed-strategy equilibrium defense policy efficiently allocates detection and response resources towards high-risk areas, improving system resilience against unforeseen attack vectors. In Phase II, we analyze the attack and defense strategies for an adversarial takeover of the low-level Model Predictive Controller node achieved through a successful Phase I attack. We model this scenario as a two-player Stackelberg game in the context of an end-point Active Inference (AIF) based Anomaly Detection System (ADS) that relies on dead-reckoning to monitor the robot trajectories and enforces an emergency shutdown if a significant deviation from nominal behavior is detected. The attacker seeks to cause a crash of the AGR by injecting malicious command velocities into the nominal command velocities, while the ADS seeks to detect the anomaly before the crash occurs.
In this article, we study cooperative deception in swarms, in the context of a two-player zero-sum game played over a directed acyclic graph. A swarm of agents must navigate to goal destinations while misleading an intelligent adversary that observes only partial, aggregated signals and updates its belief over time to optimize disruptive actions. This interaction is formalized as a dynamic game with one-sided partial observability, capturing both coordinated swarm behavior and adaptive adversarial inference over a finite horizon. To compute the equilibrium strategies, we propose an algorithm based on fictitious play, where best responses are computed via linear programming. To address the exponential complexity of multi-stage planning, we introduce a compression technique that maps observation histories into compact information states, ensuring that our algorithm remains effective with such compressed states. This reduction enables efficient equilibrium computation even in long-horizon settings. Simulations demonstrate how swarm-level deception can strategically reduce adversarial effectiveness and support theoretical results on the algorithms convergence and complexity.
The rise of Agentic AI, driven by advances in Large Language Models (LLMs), has enabled the design of autonomous multi-agent systems capable of strategic coordination in adversarial environments. This paper introduces a Gestalt games-in-games framework for modeling and orchestrating agentic AI workflows in cyber operations, particularly emphasizing cyber deception. The proposed framework captures two interwoven layers of decision-making: a workflow-level coordination game among agents assigned to interdependent tasks, and task-level adversarial games where agents confront strategic attackers. We formalize this structure using a layered stochastic game model and introduce the Gestalt-Nash Equilibrium, a joint solution concept that unifies local adversarial reasoning with global workflow optimization. To enable reasoning and coordination within this framework, we develop LLM-assisted decision algorithms that integrate prompt-based reasoning, rollout planning, and utility-guided adaptation. We demonstrate the practical value of this approach through a detailed case study on Mirai botnet deception in a software-defined networking (SDN) environment. Our results show that the LLM-enabled algorithm significantly improves deception effectiveness, reduces compromise rates, and increases attacker uncertainty and wasted effort over time. This work establishes a principled foundation for the design of modular, adaptive, and strategically aligned agentic AI systems in cybersecurity.
Reasoning about strategic ability in multi-agent systems typically relies on strategic logics such as Coalition Logic and Alternating-time Temporal Logics, which model what groups of agents can achieve through coordinated action. However, these logics treat the system state as a monolithic whole, limiting support for modular verification. By contrast, resource logics such as Separation Logic, originally developed for sequential program verification, support compositional reasoning by partitioning state into disjoint regions, but they lack the means to express strategic interaction among agents. We present Separating Coalition Logic (SCL), a unified framework that combines strategic reasoning with resource-sensitive modularity. Built over minimal interactive systems with local update rules and disjoint agent control, SCL supports both strategic guarantees and system decomposition along clean boundaries. A key feature is the Strategic Frame Rule, which lifts local properties into global guarantees even under adversarial conditions, enabling compositional proofs without reanalysis. We illustrate the framework via a case study in decentralized governance for Decentralized Autonomous Organizations, showing how SCL supports modular reasoning about both strategic interference and resource isolation.
We consider the problem of worst-case assurance for black-box perimeter defense policies, such as those produced by machine learning, in discrete environments. We provide two assurance methodologies from game theory that can extract optimal attacker inputs against a specified defender policy. Our contributions are as follows. First, we model the defense scenario as an extensive-form game that allows us to solve optimally for a security level, but only over small time horizons due to a high computational overhead. We then show how the scenario can be modeled as a single-player stochastic game (a Markov decision process) and solved using a Q-learning algorithm for reinforcement learning. This approach allows for policies to be computed over much longer time horizons, at the cost of an optimality guarantee. We then validate both of our approaches on a simple linear defense environment and provide visualizations of the extracted security levels for two representative test policies.
Cooperative behavior is commonly understood as that which is conducive to the good of the group: it is increasingly seen as a crucial component of advancing the capabilities as well as mitigating the harms of multi-agent AI systems [6, 10, 21]. Yet an Ill-know-it-when-I-see-it approach is often taken when evaluating the cooperativeness of a sequence of actions, and even when cooperation is formalized, the definitions lead to category errors, conceptual confusions, and erroneous conclusions [11, 22, 52, 56]. We propose a formal measure of cooperation in stochastic games that avoids these pitfalls by being counterfactually contrastive, contextual, and customizable: in particular, cooperation is defined in contrast to the outcome that a self-interested actor would have effected in a similar circumstance, in the context of other agents behavior, and within a specified time and space horizon. This measure is simple to compute: it is dependent only on solving a reduction of the multi-agent game to a single-agent Markov decision process. We apply this measure to a diverse pool of behaviors in a number of mixed-motive social dilemmas and sequential predator-prey environments that have been studied in the multi-agent systems literature [4, 15, 26, 34, 36]. Our results demonstrate the importance of defining cooperation clearly, and provide a useful metric for builders of cooperative systems to use when establishing the cooperative nature of the system behavior.
This paper addresses a multi-agent target defense differential game in which multiple static targets are protected by visibility-constrained autonomous defenders against a rational attacker. The attacker privately selects a fixed intended target from the set of static targets, while defenders experience intermittent access to the attackers state due to periodic sensing limitations or environmental occlusions. We model the interaction using a bank of zero-sum differential games, each corresponding to a distinct attacker-target hypothesis. To address informational asymmetry and partial observability, defenders adopt a belief-driven strategy selection mechanism inspired by the concept of Consistent Conjectural Nash Equilibrium (CCNE). In this framework, defenders form and iteratively refine a consistent hypothesis of the attackers intent by verifying trajectory consistency and propagating state estimates using precomputed feedback controllers during invisibility phases. This process ensures that strategy updates align with observed behavior, leading to accurate inference over time. We present formal problem formulations for both full and intermittent visibility regimes, and validate the framework through simulations demonstrating robust interception and coordinated multi-agent defense under uncertainty.
Integer programming games (IPGs) are n-person games with integer strategy spaces. These games are used to model non-cooperative combinatorial decision-making and are used in domains such as cybersecurity and transportation. The prevalent solution concept for IPGs, Nash equilibrium, is difficult to compute and even showing whether such an equilibrium exists is known to be ^p_2 -complete. In this work, we introduce a class of relaxed solution concepts for IPGs called locally optimal integer solutions (LOIS) that are simpler to obtain than pure Nash equilibria. We demonstrate that LOIS are not only faster and more readily scalable in large-scale games but also support desirable features such as equilibrium enumeration and selection. We also show that these solutions can model a broader class of problems including Stackelberg, Stackelberg-Nash, and generalized IPGs. Finally, we provide initial comparative results in a cybersecurity game called the critical node game, showing the performance gains of LOIS in comparison to the existing Nash equilibrium solution concept.
Semi-Grant-Free (SGF) access for Non-Orthogonal Multiple Access (NOMA) has recently emerged as a hybrid scheme that integrates contention-free access for Grant-Based (GB) users with contention-based access for Grant-Free (GF) users. In this context, we consider multiple GB users scheduled via a conventional grant-request procedure to dedicated Resource Blocks (RBs), which are then opportunistically, though transparently, shared by GF users to enhance network capacity while reducing control signaling overhead and service latency. Subsequently, the challenging problem of grant-free multi-RB multi-user scheduling and admission control under strict physical layer security constraints and Quality-of-Service (QoS) requirements is addressed, aiming to maximize the number of admitted GF users and minimize their transmission power. To this end, two scheduling algorithms are designed and proposed. First, a one-shot, low-complexity greedy algorithm prioritizes GF user access to RBs and respective Signal-to-Noise-Ratio (SNR) levels based on their backoff times to the base station. Secondly, an iterative coalition game-based algorithm refines RB and SNR level scheduling decisions, with GF users acting independently as players that aim to further minimize their power consumption. The proposed scheduling framework achieves a superior tradeoff between the number of admitted GF users and power consumption, while satisfying all users' service and secrecy requirements, outperforming conventional scheduling strategies from the literature.
Mixing networks (mixnets) are cryptographic protocols designed to enhance the privacy and anonymity of online communications. Despite their robust privacy features, mixnets remain vulnerable to cyber attacks, such as adversaries compromising mixing nodes (mixes) to track message flows. To mitigate these threats, we propose an empirical mechanism design framework for identifying mixnet configurations that satisfy the designer's goals. We first introduce two models for mixnets: one with heterogeneous mixes and another with layer-wise homogeneous mixes, capturing the diverse scales and complexities of real-world mixnets. The heterogeneous model allows each mix to have different properties, offering greater expressiveness but posing challenges for scalability of analysis. In contrast, the homogeneous model provides a simplified, yet practical, framework for large-scale analysis. Leveraging these models, we conceptualize adversarial attacks and defensive measures as strategic interactions between an attacker and a defender in a game. We demonstrate how our framework generates data that is useful for a mechanism designer trading off cost versus performance in deploying a mixnet.
We study a security game in which an attacker seeks to disable sensors in a cyber-physical system by simultaneously compromising both their cyber access points and physical components. The defender can respond by deploying honeypots in the cyber domain and protecting a subset of sensors in the physical domain. We model this interaction as a non-zero sum, simultaneous-move game and propose a solution approach based on the double oracle framework. To address the combinatorial action space of the defender, we develop a greedy oracle and prove that it provides a constant-factor approximation using submodularity. Although the game is not zero-sum, we show it can be transformed into a strategically equivalent zero-sum game, enabling efficient equilibrium computation for restricted games. We also analyze a special case where the cyber network reduces to a star topology and derive the structure of the Nash equilibrium under certain conditions. Finally, simulation results show that our greedy oracle achieves near-optimal performance, on average within 5.21% of the optimal, while scaling effectively to large problem sizes.
The pull-based model in Open-Source Software (OSS) has enabled decentralized collaboration and major advancements, but it also opens the door to supply-chain attacks, where an attacker submits a malicious pull request with the intention of injecting malicious code into the codebase. Once a malicious pull request is merged, all downstream systems depending on the package may be compromised. This paper investigates the problem of assigning pull requests to maintainers in OSS packages from a game-theoretic standpoint. We model the problem as a two-player (defender and attacker) general-sum game with partial observability in which the attacker submits malicious pull requests while the defender assigns pull requests to available maintainers. The model captures critical features such as the availability of the maintainers, their expertise, and the quantity and severity of the pull requests. Many of those features can be publicly inferred. Accordingly, we develop deep reinforcement learning-based algorithms within the Policy-Space Response Oracle (PSRO) framework to derive potent strategies for both players, addressing the complexity of the formulation and the explosion of state and action spaces. We assess the behavior of the derived policies on two real-world Python packages with different sizes. We show that the policies obtained outperform other assignment strategies.
This paper develops a formal framework to study deception in agentic AI systems, particularly those powered by large language models (LLMs). We conceptualize deception not as a local defect of individual agents, but as an emergent property of strategic interaction in multi-agent environments. To model this, we introduce the Generative-Conjectural LLM Equilibrium (GCLE), which captures the mutual reasoning dynamics between sender and receiver agents. Each agent operates with incomplete information and builds internal models of the other's behavior through iterative, LLM-driven inference. This recursive reasoning structure leads to self-consistent yet potentially manipulable equilibria, revealing how misinformation can propagate through message-reasoning feedback loops. We further characterize conditions under which strategic deception becomes successful through a finite-horizon control formulation that guides receiver beliefs toward a desired behavior profile. Our analysis culminates in a spearphishing case study that illustrates how prompt design and cognitive modeling can be used to construct convincing deceptive messages. The results highlight the security risks posed by generative AI and the importance of principled reasoning models in understanding and mitigating deception in intelligent systems.
As distributed systems become increasingly interconnected, efficiently allocating cybersecurity resources to defend against sophisticated cyber threats is paramount. In this paper we address this challenge by formulating a Stackelberg game-theoretic model for optimal resource allocation in distributed environments. Our approach strategically models interactions between attackers and defenders, capturing the dynamic nature of cyber threats and the defenders limited resources. We propose a new algorithm called Cyber Quadratic Programming (CyQuaAPro) to solve the optimization problem, considering factors such as target correlation, asset value, and budget constraints. Our model demonstrate robustness and scalability across multiple scenarios, providing practical insights into resource prioritization and defensive strategy optimization in complex interconnected systems.
We model the interaction between a defender of a system and a possible attacker. The defender faces a tradeoff between the cost of missed attacker classifications versus the cost of false alarms, while the attacker faces a tension between attacking more vigorously to exploit their entry into the system versus the increased risk of being correctly classified as an attacker. In this model, both players pure strategies are chosen from a continuum (a finite real interval), and moreover both players engage in mixed strategy play. We derive mathematical formula for the mixed Nash equilibria of the game, and also show that the identified equilibria are exhaustive up to variations of measure 0. We further investigate the case that the defender observes beta distributed noise when an attacker is not present and prove that for a wide range of the parameter space describing the game, the Nash equilibrium expected cost to the defender increases as the variance of this distribution increases.
We introduce a cooperative FlipIt-style framework for human–AI working agreements in cyber defense, replacing adversarial competition with a shared-objective model where control depends on both the defender’s noisy monitoring and the AI’s internal cues. For periodic AI strategies, we derive closed-form policies; for non-periodic cases, we show how reinforcement learning discovers near-optimal behaviors. This work lays a foundation for trust-aware shared-control systems.
Advanced Persistent Threats (APTs), exemplified by the SolarWinds attack, demand adaptive defenses in partially observable network environments. We model the defender-attacker interaction as a Partially Observable Markov Decision Process (POMDP)-based stochastic game, executed in the test environment AttackBed, and solved using reinforcement learning (RL) with Proximal Policy Optimization (PPO) and Recurrent PPO (RPPO). Our contributions include: (1) theorems proving equilibrium existence, threshold-structured best responses, and convergence properties, (2) a high-fidelity GNS3-based simulation aligned with MITRE ATT CK/D3FEND frameworks, and (3) empirical comparisons showing PPO outperforms RPPO in mitigating attacks. PPO reduces attack success rates by 65
Behavioral anomaly detection is a useful tool for finding malware attacks. Detection is possible using binary classification, where the behavior of benign software and malware is considered during the detector learning process. However, such classifiers are less likely to detect zero-day attacks, as the set of possible malware is enormous and changing. An alternative to binary classification is anomaly detection, which considers only the behavior of benign software to train a malware detector. Recent advances in Large Language Models (LLMs) in combination with Contrastive Learning have created a unique opportunity to develop anomaly detectors to expose malware threats. Our detector, contrastBERT, defines its language vocabulary as the set of calls to the operating system and the sequences of such calls as sentences. These sequences of system calls are logged during the execution of both benign software on the system to be monitored as well as separately during malware execution. contrastBERT is evaluated using a similarity distribution between benign sample sentences fed to an isolation forest (IF), which provides an effective separation between benign and malicious behavior when trained on embeddings from contrastBERT. Our results show that using this approach, several types of common malware behavior patterns can be detected with a high detection rate and a low false positive rate.
The growing complexity of Cyber-Physical Systems (CPS) has heightened the need for robust, real-time anomaly detection to ensure safety and reliability in time-critical applications such as autonomous vehicles, industrial automation, etc. While deep learning methods have demonstrated exceptional performance in detecting anomalies within multivariate time-series data, their inherent lack of interpretability limits their adoption in such critical environments. This paper presents a novel framework for deep learning-based anomaly detection in CPS, specifically designed to operate on unlabeled multivariate time-series data. The framework utilizes autoencoders to generate latent data representations, whose reconstruction error is used in a threshold-augmented discriminator network model to detect anomalies. Our approach then integrates Signal Temporal Logic (STL) inference to provide meaningful, human-understandable explanations for the decisions made by the deep learning models. This interpretability is crucial for diagnosing anomalies and implementing corrective actions in real time. We validate our method on real-world data collected from a Clearpath Husky mobile robot, to demonstrate its ability to detect anomalies with high accuracy while offering actionable insights into the decision-making process. We deploy the detector on the robot to show the real-time detection capabilities, as shown in the supplemental video.
