Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage

Quanyan Zhu; Ya-Ting Yang

REVIEW 4 major objections 5 minor 34 references

Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A bi-level game plans when to switch cyber deception, turning losing defenses into winning ones.

desk verdict A coherent bi-level framework for timing cyber deception, but the headline quantitative claims are under-specified and the biased-attacker execution results don't actually use the paper's own bias operator. read the letter →

arxiv 2509.05498 v1 pith:MNMQHXND submitted 2025-09-05 cs.GT cs.CR

Ya-Ting Yang , Quanyan Zhu This is my paper

classification cs.GTcs.CR MSC 91A1591A2591A80

keywords cyberdeceptioncognitivearbitragegametheoryoptimalswitchingbeliefupdateconfirmationbiasbaserateneglectParrondoparadox

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that the timing and choice of cyber deception techniques can be planned, not just improvised, and that this planning can convert a defense that is losing on expectation into a winning one. It builds a two-layer model: an operational Markov game describes how an attacker interacts with a fixed deception mode while holding a belief about which mode is active, and a strategic layer solves an optimal switching problem that says when to swap in a fresh, unused deception technique under a budget. The central numerical claim is that with an attacker lifetime of twenty stages, every fixed deception mode yields a negative expected value for the defender, while one or two optimally timed switches make that value positive; in execution over two hundred simulated engagements, the proposed schedule beats no-switch, fixed-timing, and uniform-interval baselines by at least 40 percent in total reward. The authors interpret this as a Parrondo-like effect: individually losing deception games become winning when combined at the right times. A sympathetic reader should care because the paper turns "deception works" into a resource-allocation question—how many switches, when, and which technique—that a defender can decide before an attack.

What carries the argument

The load-bearing object is the strategic playbook, a table computed by backward induction over extended states (current system state, attacker's belief b_k, current deception mode θ_k, remaining switch budget m_k, set of already-used techniques). At each stage it compares the value of staying in the current mode V_stay with the value of switching to each unused mode V_switch, and its decisions define the Cyber Warfare Equilibrium. Timing matters because the attacker's belief update—Bayesian (1) during planning, or the biased operators B for confirmation bias (19) and base-rate neglect (20) during execution—determines how long the defender stays inside a window of superiority, a period over w

What would settle it

Recompute the execution experiments (K=10, M=2) with confirmation-bias parameter λ drawn uniformly over [0,1] while the playbook is fixed to λ=0.5; if total reward under optimal switching drops to or below the no-switch baseline for any substantial band of λ, the claimed superiority of the planned switches is refuted.

Watch

Extended reading notes

Core claim

The core claim is that strategic timing of deception is what sustains a defender's cognitive advantage: an attacker gradually learns any single deception mode, but switching modes before the attacker's belief crosses a superiority threshold reopens uncertainty and resets the learning clock. The paper formalizes this as a cyber warfare game whose operational layer is a family of one-sided information Markov games (the defender knows the active deception mode; the attacker only observes states and keeps a belief over modes), and whose strategic layer maximizes a value function over extended states (state, belief, current mode, remaining switch budget, used modes). The solution concept—cyber wa

Load-bearing premise

The entire planned advantage depends on the defender knowing the attacker's belief-update operator exactly—the bias type, its parameter (e.g., λ for confirmation bias), and the attacker's prior b_0; if the defender's model of B is wrong, the optimal-switching playbook is not guaranteed to improve outcomes.

Editorial extensions

If this is right

A defender with a fixed set of deception techniques can improve outcomes without new technology, simply by scheduling one or two well-timed switches.
Longer attacker lifetimes erode the initial advantage, so strategic-level levers include increasing the switching budget, adding more sophisticated deception modes, and shortening attacker dwell time through detection.
Biased attackers are more exploitable than rational Bayesian attackers; confirmation bias extends each deception's useful life, while base-rate neglect makes attackers highly reactive to crafted misleading signals.
Relying on the same deception mode indefinitely is dominated by switching: the attacker eventually learns any fixed mode, whereas switching prevents belief convergence.
The planning-phase playbook supports policy decisions before engagement, and the execution algorithm recomputes only a bounded look-ahead, avoiding real-time full recomputation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 40 percent improvement is tied to the specific reward tables and transition parameters (κ, δ, β) of the case study; a sensitivity analysis across those parameters would show how much of the gain survives in less favorable settings.
Because the strategic value functions assume the defender knows B exactly, an extension is to design robust playbooks that hedge over a set of possible bias models—this is explicitly left to future work in the paper.
The Parrondo analogy suggests the mechanism could generalize beyond deception: rotating monitoring strategies, access controls, or bait configurations may also win by resetting attacker beliefs rather than by averaging per-period gains.
The biased belief operators are stylized convex-combination and likelihood-only rules; using experimental data from human-subject cyber ranges to estimate the actual B for each attacker type would turn the qualitative ordering (BRN > CB > Bayesian) into a quantitative prediction.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the paper gives you a clean two-level decomposition—an operational one-sided information Markov game per deception mode, and a strategic optimal-switching problem over modes with a budget. That is a useful way to think about timing deception, and the WoBS/WoUS metrics plus the playbook/equilibrium definitions are a real contribution. The formal machinery is standard dynamic programming and PBNE, but it is applied carefully, and the case study at least illustrates the intended logic.

What I like: the cognitive-arbitrage framing is more than a buzzword; it shows up as belief thresholds and uncertainty windows that feed the strategic value function. The biased-update models (confirmation bias, base-rate neglect) are simple but reasonable, and the Parrondo-like discussion is honest about what the example does and doesn't show.

Where it goes soft. The execution algorithm does not match the bias model. Algorithm 2 line 12 updates the attacker's belief with Bayes' rule (17), not with the operator B from Definition 9, even though Section VI.D claims defender rewards are higher against CB/BRN attackers. Either the biased results came from a separate unstated procedure, or the strategy was computed with a different belief process than the one it was evaluated under. Either way, the abstract's 40% number isn't tied to a single well-defined model. The paper's own conclusion concedes the defender may not know the attacker's bias type; without a robustness bound or an adaptive estimator, the strategic value functions (13)-(15) are only valid for an exactly known B.

The numerical support is thinner than the claims. Tables I and II are ambiguous, thresholds eta/zeta and initial beliefs are never pinned down, the 40% improvement is not derived in the results, and "always wins" comes from 200 runs. Also, the optimal-switching policy is constructed to maximize the very value being reported, so it beating fixed baselines is partly by construction. These are fixable, not fatal. The framework is coherent; the evaluation is not yet credible as stated.

My take: send it to review. A good referee can force the authors to specify parameters, release the code and transition/reward tables, align Algorithm 2 with the biased belief updates, and temper the claims. As it stands I wouldn't cite the quantitative results, but I'd keep the paper on my radar for the architecture.

Referee Report

4 major / 5 minor

Summary. The paper proposes a bi-level game-theoretic framework for planning defensive cyber deception. At the operational level, attacker-defender interaction under a fixed deception mode is modeled as a one-sided-information Markov game, with the attacker maintaining a belief over the active deception mode. At the strategic level, the defender chooses when and which deception technique to activate, subject to a switching budget, by solving a dynamic programming problem over the operational value functions. The authors introduce cognitive superiority windows, a cyber-warfare equilibrium concept, and offline/online algorithms. The numerical case study claims that strategic switching converts a negative expected defender value into a positive one, achieves at least a 40% improvement in execution rewards, and produces an 'always win' outcome with two switches. The paper also claims that biased attackers (confirmation bias, base-rate neglect) are more vulnerable than Bayesian attackers.

Significance. If the framework and its numerical claims are made fully precise and reproducible, the paper would make a useful contribution to game-theoretic cyber deception: it connects belief manipulation, Markov games, and optimal switching in a single hierarchical model, and the introduction of superiority windows is a natural quantification of deception effectiveness. The use of a human-subject cyber-range dataset as motivation is a strength. However, the current manuscript does not support its headline numerical claims: key thresholds and algorithmic details are missing, the execution algorithm is inconsistent with the biased-belief model, and the reported improvement is partly a consequence of the optimization procedure itself. With the identification and fixing of these issues, the central idea remains promising.

major comments (4)

[§VI.A, Definition 4, Eq. (4)] The strategic value functions in (13)-(15) are built from Uθ(sk,bk,aD,aA)=r_D^θ(...)·1_{b_k(θ)≤η} (or the uncertainty variant with ζ). The numerical section never states the values of η and ζ, yet Fig. 6 and Fig. 7 are computed from these gated rewards. Consequently the reported 'negative-to-positive' transition at K=20 and the 'at least 40% improvement' claim cannot be recomputed or checked. Please specify all threshold values, complete the reward/transition tables, and make the code or exact summary statistics available.
[§V-B, Algorithm 2, §VI.D] Algorithm 2 line 12 always updates the attacker's belief with the Bayesian formula (17). It never calls the belief operator B of Definition 9, nor the confirmation-bias update (19) or the base-rate-neglect update (20). Section VI.D nevertheless reports different defender rewards for CB and BRN attackers. As written, these results cannot be produced by Algorithm 2; either the execution algorithm must be modified to use the corresponding biased operator, or Fig. 8 was generated by a separate, undocumented procedure. In either case, the abstract's execution-phase claim is not attached to a single well-defined model.
[§VI.B, Eq. (13)] The comparison against 'no switch,' 'fixed timing,' and 'uniform interval' baselines does not by itself validate the claimed 40% improvement as a substantive finding. Because V^k_π in (13) chooses max(V_stay, V_switch) at every stage, the optimal switching strategy is, by construction, never worse than any fixed schedule. The reported edge is therefore an optimality gap over the chosen baselines, not a falsifiable prediction of the cognitive-arbitrage model. To make the claim meaningful, compare against an optimized but constrained family of schedules (e.g., the best single fixed switch time or the best uniform schedule), and report the numerical basis for the 40% figure.
[§VII, §V-B] The future-work paragraph explicitly concedes that the defender may not know which cognitive bias the attacker exhibits. Yet all improved execution results in Section VI.D assume the defender knows the bias type and the parameter λ. No robustness bound, worst-case analysis, or adaptive estimator is provided for the value functions (13)-(15). As a result, the central execution-phase claim is conditional on exact knowledge of the belief-update operator B. This limitation should be stated prominently in the abstract and conclusions, or the paper should provide a concrete robustness test.

minor comments (5)

[Eq. (1) and Eq. (17)] The belief is defined as bk ∈ Δ(Θ), but equations (1) and (17) write bk(θ|sk), mixing conditioning on state with the mode belief. Please use consistent notation, e.g., bk(θ; sk) or define bk(θ|sk) explicitly.
[Abstract] The abstract says deception can 'turn a negative value for the attacker into a positive one,' while Section VI.C discusses the defender's value becoming positive. This appears to be a typo; please correct the subject of the claim.
[Table II] The transition formula 'κ−θ_j/10−(l/β)' is ambiguous because of the term ordering and the undefined symbol l. Please clarify the expression and define all quantities in the table header.
[Fig. 7 and Fig. 8] The boxplots summarize 200 experiments but no random seed, exact means, standard deviations, or win/loss counts are given. The statement 'always wins' should be defined (e.g., all 200 runs yield nonnegative total reward) and supported with numerical values.
[Section VI.B] The fixed-timing and uniform-interval baselines are described verbally, but the reader cannot determine how many baseline schedules were tested and how their switch times were selected. Please specify the baseline generation procedure.

Circularity Check

1 steps flagged · score 4.0 of 10

Minor self-definitional component in the budget-monotonicity observation; core numerical derivation is self-contained.

self definitional [Section IV-B, eq. (13); Section VI-A, Fig. 6 discussion]
"V k π (¯xk) = ( V k π,stay (¯xk), if m=0, max(V k π,stay (¯xk), V k π,switch(¯xk)), if m>0 ... Then, we can observe that with a fixed attacker’s lifetime, the defender’s initial value increases as the budgeted number of switches increases."

The strategic value function is defined via a max over staying and switching whenever a switch budget remains. A larger budget M only enlarges the feasible set of switch schedules (the extra switch can be left unused), so V(M+1) ≥ V(M) is a theorem of (13), not an empirical discovery. The paper reports this monotonicity as a numerical observation and uses it to motivate the Parrondo-like sign-flip narrative. The sign flip itself depends on the chosen reward/transition parameters, but the monotone improvement with budget is built into the max operator by construction.

full rationale

The derivation chain is largely self-contained: the operational one-sided ϵ-PBNE is computed from the specified transition/reward tables using standard dynamic-programming backwards induction, and the strategic playbook is a backward-induction optimization over that model. The cited prior work is not load-bearing in a circular way. One genuinely definitional element exists: the budget-monotonicity observation is a direct implication of the max in (13), since added switch opportunities can only expand the feasible policy set. The specific sign flip, the 40% improvement figure, and the biased-attacker comparisons are model computations rather than fit-to-data predictions, so they retain independent content. Two non-circular limitations should be flagged: (i) the thresholds η and ζ from (4) are never specified in the numerical setup, making the reward values irreproducible; (ii) Algorithm 2 line 12 always updates the attacker belief with the Bayesian formula (17), even though Section V-B defines biased operators B and Section VI-D reports results for biased attackers, while Section VII concedes the defender may not know which bias is present. These are correctness/robustness concerns, not circularity. Overall circularity is low-moderate.

Assumptions & free parameters 8 free parameters · 6 assumptions · 3 invented entities

The central results are computed from a hand-specified Markov game. The model's parameters (transition probabilities, rewards, terminal values, bias strength, and the unstated superiority thresholds) are chosen by the authors, and the equilibrium solution relies on standard, cited results for one-sided information games. The numerical 'predictions' are therefore properties of the constructed model, not measurements of external reality.

free parameters (8)

attacker ability kappa = 0.8
Chosen by hand in Table II caption; controls transition probabilities and thus the entire dynamics.
defender ability delta = 0.5
Chosen by hand in Table II; determines the defender's effect on transitions.
state impact beta = infinity
Set to infinity, nullifying the state-dependent term l/beta; an ad hoc simplification.
immediate rewards r^theta_D (Table I) = 10.0, 5.0, 0.0, 1.0, 0.0
Hand-specified payoff values; the entire value function depends on them.
terminal rewards U_T = 100, 50, 10, 0, -100
Hand-specified values for s_1..s_5, determining long-horizon outcomes.
confirmation bias parameter lambda = 0.5
Chosen for the CB experiment (Section VI-D); not varied or justified.
superiority threshold eta (and zeta) = not specified
Appears in payoff (4) and Definitions 2/3 but never given a numerical value in the case study.
initial belief b_0 = not specified
The attacker's prior over game modes is not stated; belief sequences and windows depend on it.

assumptions (6)

standard math Existence and convergence of the one-sided epsilon-PBNE computation via the LP formulations (9)/(11) and backward induction, per [32], [33].
The paper relies on prior results for zero-sum one-sided information stochastic games; no proof or convergence analysis is provided here.
domain assumption The attacker is unaware of the true game mode and updates beliefs via Bayes' rule (1) using common knowledge of the defender's Markov policy.
Section III-B; this is the core information-asymmetry assumption that makes 'windows of superiority' meaningful.
ad hoc to paper During execution, cognitive biases are exactly represented by the operators in (19) and (20), with known bias type and parameter lambda.
Section V-B; these are convenient parametric models with no independent empirical calibration in this paper.
domain assumption The stage game is zero-sum: r_A^theta = -r_D^theta.
Stated before Table I; this restricts the model and simplifies the equilibrium LP.
domain assumption The system state s is fully observable to both players; the attacker observes states but not the defender's actions.
Definition 1; real networks often give asymmetric and noisy observability.
domain assumption A Markov (mixed) policy suffices for both players; history-dependent behavioral policies are not needed.
Section III-B; restricts the policy space, which can matter when beliefs are part of the state.

invented entities (3)

Window of Belief Superiority (WoBS)
purpose: Defines a period where the attacker's belief in the true deception mode stays at or below threshold eta.
Model-internal metric (Def. 2); no external handle.
Window of Uncertainty Superiority (WoUS)
purpose: Defines a period where the attacker's posterior entropy over modes stays at or above zeta.
Model-internal metric (Def. 3); no external handle.
Cognitive arbitrage
purpose: Conceptual framing of exploiting attacker cognitive gaps for strategic advantage.
Borrowed from finance [2]; motivates the model but is not operationalized or measured independently.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage." pith.science (2026). https://pith.science/paper/MNMQHXND

@misc{pith2026250905498,
  author       = {Pith},
  title        = {Pith review of: Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MNMQHXND}},
  note         = {Machine review of arXiv:2509.05498}
}

read the original abstract

Cognitive vulnerabilities shape human decision-making and arise primarily from two sources: (1) cognitive capabilities, which include disparities in knowledge, education, expertise, or access to information, and (2) cognitive biases, such as rational inattention, confirmation bias, and base rate neglect, which influence how individuals perceive and process information. Exploiting these vulnerabilities allows an entity with superior cognitive awareness to gain a strategic advantage, a concept referred to as cognitive arbitrage. This paper investigates how to exploit the cognitive vulnerabilities of Advanced Persistent Threat (APT) attackers and proposes cognition-aware defenses that leverage windows of superiority to counteract attacks. Specifically, the proposed bi-level cyber warfare game focuses on "strategic-level" design for defensive deception mechanisms, which then facilitates "operational-level" actions and tactical-level execution of Tactics, Techniques, and Procedures (TTPs). Game-theoretic reasoning and analysis play a significant role in the cross-echelon quantitative modeling and design of cognitive arbitrage strategies. Our numerical results demonstrate that although the defender's initial advantage diminishes over time, strategically timed and deployed deception techniques can turn a negative value for the attacker into a positive one during the planning phase, and achieve at least a 40% improvement in total rewards during execution. This demonstrates that the defender can amplify even small initial advantages, sustain a strategic edge over the attacker, and secure long-term objectives, such as protecting critical assets throughout the attacker's lifecycle.

Figures

Figures reproduced from arXiv: 2509.05498 by the authors.

**Figure 2.** The strategic, operational, and tactical levels for defensive [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Conceptual architecture of the offline planning phase in the proposed bi-level cyber warfare game for deception-driven cognitive [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Bi-level interaction between the strategic and operational [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

**Figure 5.** Figure 5: An example enterprise network and attack path for the case [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

**Figure 6.** Figure 6: The results show the value at the initial stage of the defender [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

**Figure 7.** Figure 7: The results for the total rewards (sum of the terminal reward and the immediate reward at each stage) of the defender under different [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

**Figure 8.** Figure 8: The results for the total rewards (sum of the terminal reward [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

34 extracted references · 31 canonical work pages

[1]

Theory of rational option pricing,

R. C. Merton, “Theory of rational option pricing,”The Bell Journal of economics and management science, pp. 141–183, 1973

work page 1973
[2]

Cognitive arbitrage: Complexity, variety and human cognitive states are related,

J. Bicknell and M. Jetton, “Cognitive arbitrage: Complexity, variety and human cognitive states are related,”Information Pro- fessionals Association, 2023. [Online]. Available: https://information- professionals.org/cognitive-arbitrage/

work page 2023
[3]

Race-related disparities in 5-year cognitive level and change in untrained active participants,

M. Marsiske, J. M. Dzierzewski, K. R. Thomas, L. Kasten, R. N. Jones, K. E. Johnson, S. L. Willis, K. E. Whitfield, K. K. Ball, and G. W. Rebok, “Race-related disparities in 5-year cognitive level and change in untrained active participants,”Journal of Aging and Health, vol. 25, no. 8 suppl, pp. 103S–127S, 2013

work page 2013
[4]

Implications of rational inattention,

C. A. Sims, “Implications of rational inattention,”Journal of monetary Economics, vol. 50, no. 3, pp. 665–690, 2003

work page 2003
[5]

Confirmation bias: A ubiquitous phenomenon in many guises,

R. S. Nickerson, “Confirmation bias: A ubiquitous phenomenon in many guises,”Review of general psychology, vol. 2, no. 2, pp. 175–220, 1998

work page 1998
[6]

Base-rate neglect: Foundations and implications,

D. Benjamin, A. Bodoh-Creed, and M. Rabin, “Base-rate neglect: Foundations and implications,”Base-Rate Neglect: Foundations and Implications, vol. 1, p. 62, 2019

work page 2019
[7]

Herd accountability of privacy- preserving algorithms: A stackelberg game approach,

Y .-T. Yang, T. Zhang, and Q. Zhu, “Herd accountability of privacy- preserving algorithms: A stackelberg game approach,”IEEE Transac- tions on Information Forensics and Security, 2025

work page 2025
[8]

C. A. Kamhoua, C. D. Kiekintveld, F. Fang, and Q. Zhu,Game theory and machine learning for cyber security. John Wiley & Sons, 2021

work page 2021

Show all 34 references

[9]

Basic concepts in cyber warfare,

L. Tabansky, “Basic concepts in cyber warfare,”Military and Strategic Affairs, vol. 3, no. 1, pp. 75–92, 2011

2011
[10]

Pawlick, Q

J. Pawlick, Q. Zhuet al.,Game theory for cyber deception. Springer, 2021

2021
[11]

Symbiotic game and foundation models for cy- ber deception operations in strategic cyber warfare,

T. Li and Q. Zhu, “Symbiotic game and foundation models for cy- ber deception operations in strategic cyber warfare,”arXiv preprint arXiv:2403.10570, 2024

2024 arXiv
[12]

Bas ¸ar and G

T. Bas ¸ar and G. J. Olsder,Dynamic noncooperative game theory. SIAM, 1998

1998
[13]

Toward a conceptual framework for cyberspace windows of advantage,

S. Raio, “Toward a conceptual framework for cyberspace windows of advantage,” 2023

2023
[14]

When to deceive: A cross-layer stackelberg game framework for strategic timing of cyber deception,

Y .-T. Yang and Q. Zhu, “When to deceive: A cross-layer stackelberg game framework for strategic timing of cyber deception,”arXiv preprint arXiv:2505.21244, 2025

2025 arXiv
[15]

Guarding against malicious biased threats (gambit) experiment 3,

Q. Zhu, “Guarding against malicious biased threats (gambit) experiment 3,” 2025. [Online]. Available: https://dx.doi.org/10.21227/xdw9-3677

2025 doi
[16]

Toward a synthesis of cognitive biases: how noisy in- formation processing can bias human decision making

M. Hilbert, “Toward a synthesis of cognitive biases: how noisy in- formation processing can bias human decision making.”Psychological bulletin, vol. 138, no. 2, p. 211, 2012

2012
[17]

Cognitive biases in cyber decision-making,

A. Lemay and S. Leblanc, “Cognitive biases in cyber decision-making,” inProceedings of the 13th International Conference on Cyber Warfare and Security, 2018, p. 395

2018
[18]

A behavioral model of rational choice,

H. A. Simon, “A behavioral model of rational choice,”The quarterly journal of economics, pp. 99–118, 1955

1955
[19]

Stuck on a phishing lure: differential use of base rates in self and social judgments of susceptibility to cyber risk,

E. B. Cox, Q. Zhu, and E. Balcetis, “Stuck on a phishing lure: differential use of base rates in self and social judgments of susceptibility to cyber risk,”Comprehensive Results in Social Psychology, vol. 4, no. 1, pp. 25–52, 2020

2020
[20]

Modeling cognitive biases in decision-theoretic planning for active cyber deception,

A. Shinde and P. Doshi, “Modeling cognitive biases in decision-theoretic planning for active cyber deception,” inProceedings of the 23rd Inter- national Conference on Autonomous Agents and Multiagent Systems, 2024, pp. 1718–1726

2024
[21]

The impact of cognitive biases on professionals’ decision- making: A review of four occupational areas,

V . Berthet, “The impact of cognitive biases on professionals’ decision- making: A review of four occupational areas,”Frontiers in psychology, vol. 12, p. 802439, 2022

2022
[22]

Leveraging behavioral science to mitigate cyber security risk,

S. L. Pfleeger and D. D. Caputo, “Leveraging behavioral science to mitigate cyber security risk,”Computers & security, vol. 31, no. 4, pp. 597–611, 2012

2012
[23]

Psyborg+: Cognitive modeling for triggering and detection of cognitive biases of advanced persistent threats,

S. Huang and Q. Zhu, “Psyborg+: Cognitive modeling for triggering and detection of cognitive biases of advanced persistent threats,”arXiv preprint arXiv:2408.01310, 2024

2024 arXiv
[24]

Three decades of deception techniques in active cyber defense-retrospect and outlook,

L. Zhang and V . L. Thing, “Three decades of deception techniques in active cyber defense-retrospect and outlook,”Computers & Security, vol. 106, p. 102288, 2021

2021
[25]

A survey of honeypots and honeynets for internet of things, industrial internet of things, and cyber-physical systems,

J. Franco, A. Aris, B. Canberk, and A. S. Uluagac, “A survey of honeypots and honeynets for internet of things, industrial internet of things, and cyber-physical systems,”IEEE Communications Surveys & Tutorials, vol. 23, no. 4, pp. 2351–2383, 2021

2021
[26]

Discovering cognitive biases in cyber attackers’ network exploitation activities: A case study,

P. Aggarwal, S. Venkatesan, J. Youzwak, R. Chadha, and C. Gonzalez, “Discovering cognitive biases in cyber attackers’ network exploitation activities: A case study,” 2024

2024
[27]

Attackers have prior beliefs: Comprehending cognitive aspects of confirmation bias on adversarial decisions,

H. Katakwar, C. Gonzalez, and V . Dutt, “Attackers have prior beliefs: Comprehending cognitive aspects of confirmation bias on adversarial decisions,” inInternational Conference on Frontiers in Computing and Systems. Springer, 2023, pp. 261–273

2023
[28]

A cyber-war between bots: human-like attackers are more challenging for defenders than deterministic attackers,

Y . Du, B. Pr ´ebot, X. Xi, and C. Gonzalez, “A cyber-war between bots: human-like attackers are more challenging for defenders than deterministic attackers,” 2023

2023
[29]

Game theory for cyber deception: a tutorial,

Q. Zhu, “Game theory for cyber deception: a tutorial,” inProceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, 2019, pp. 1–3

2019
[30]

A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy,

J. Pawlick, E. Colbert, and Q. Zhu, “A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy,”ACM Computing Surveys (CSUR), vol. 52, no. 4, pp. 1–28, 2019

2019
[31]

Mitre att&ck: Design and philosophy,

B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, “Mitre att&ck: Design and philosophy,” inTechnical report. The MITRE Corporation, 2018

2018
[32]

A dynamic games approach to proactive defense strategies against advanced persistent threats in cyber-physical systems,

L. Huang and Q. Zhu, “A dynamic games approach to proactive defense strategies against advanced persistent threats in cyber-physical systems,” Computers & Security, vol. 89, p. 101660, 2020

2020
[33]

Gazeta: Game-theoretic zero-trust authentication for defense against lateral movement in 5g iot networks,

Y . Ge and Q. Zhu, “Gazeta: Game-theoretic zero-trust authentication for defense against lateral movement in 5g iot networks,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 540–554, 2023

2023
[34]

Guarding against malicious biased threats (gambit) experiment 1,

Q. Zhu, “Guarding against malicious biased threats (gambit) experiment 1,” 2025. [Online]. Available: https://dx.doi.org/10.21227/dwkg-n940

2025 doi

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Theory of rational option pricing,

R. C. Merton, “Theory of rational option pricing,”The Bell Journal of economics and management science, pp. 141–183, 1973

work page 1973

[2] [2]

Cognitive arbitrage: Complexity, variety and human cognitive states are related,

J. Bicknell and M. Jetton, “Cognitive arbitrage: Complexity, variety and human cognitive states are related,”Information Pro- fessionals Association, 2023. [Online]. Available: https://information- professionals.org/cognitive-arbitrage/

work page 2023

[3] [3]

Race-related disparities in 5-year cognitive level and change in untrained active participants,

M. Marsiske, J. M. Dzierzewski, K. R. Thomas, L. Kasten, R. N. Jones, K. E. Johnson, S. L. Willis, K. E. Whitfield, K. K. Ball, and G. W. Rebok, “Race-related disparities in 5-year cognitive level and change in untrained active participants,”Journal of Aging and Health, vol. 25, no. 8 suppl, pp. 103S–127S, 2013

work page 2013

[4] [4]

Implications of rational inattention,

C. A. Sims, “Implications of rational inattention,”Journal of monetary Economics, vol. 50, no. 3, pp. 665–690, 2003

work page 2003

[5] [5]

Confirmation bias: A ubiquitous phenomenon in many guises,

R. S. Nickerson, “Confirmation bias: A ubiquitous phenomenon in many guises,”Review of general psychology, vol. 2, no. 2, pp. 175–220, 1998

work page 1998

[6] [6]

Base-rate neglect: Foundations and implications,

D. Benjamin, A. Bodoh-Creed, and M. Rabin, “Base-rate neglect: Foundations and implications,”Base-Rate Neglect: Foundations and Implications, vol. 1, p. 62, 2019

work page 2019

[7] [7]

Herd accountability of privacy- preserving algorithms: A stackelberg game approach,

Y .-T. Yang, T. Zhang, and Q. Zhu, “Herd accountability of privacy- preserving algorithms: A stackelberg game approach,”IEEE Transac- tions on Information Forensics and Security, 2025

work page 2025

[8] [8]

C. A. Kamhoua, C. D. Kiekintveld, F. Fang, and Q. Zhu,Game theory and machine learning for cyber security. John Wiley & Sons, 2021

work page 2021