Agents That Certify Their Own Exploits: Confidence-Scheduled Restricted Responses for Safe Opponent Exploitation

• URL: http://arxiv.org/abs/2607.28520v1
• Date: Thu, 30 Jul 2026 16:57:57 GMT
• Title: Agents That Certify Their Own Exploits: Confidence-Scheduled Restricted Responses for Safe Opponent Exploitation
• Abstract summary: We introduce emphbudget-constrained confidence-scheduled restricted responses (CS-RNR)<n>CS-RNR is the first opponent-exploitation method whose safety guarantee is a certificate the agent computes on the strategy it actually deploys.
• Score: 38.06569764716213
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: An agent playing a Nash-equilibrium strategy in a two-player zero-sum imperfect-information game secures the game value but forfeits the additional value offered by a flawed opponent. Diffuse deviations pose a particular challenge: binary release rules may gather too little evidence to act, while a full best response to an incomplete opponent model can be highly exploitable. We introduce \emph{budget-constrained confidence-scheduled restricted responses} (CS-RNR), the first opponent-exploitation method whose safety guarantee is a certificate the agent computes on the strategy it actually deploys, so that every exploit it commits to is one it has audited itself. The method tracks pooled action frequencies with anytime-valid confidence sequences and treats a frequency as exploitable only once its interval separates from an equilibrium reference. The confirmed deviations define a conservative opponent model, which a restricted-response solve turns into candidate counter-strategies over a grid of pin levels. Before deployment, each complete candidate is evaluated by a full-tree best response. The resulting certificate is compared with a user-specified budget and committed atomically with the strategy. Because this check is performed on the played strategy, model quality determines the exploitation achieved while the certificate controls reference-relative expected loss. In Leduc hold'em, CS-RNR obtains $6.2\times$ the steady-state gain of a money-verified binary gate while keeping every deployed strategy within budget. A trajectory mixture using the same estimator reaches $13.6\times$ the budget. Across Leduc, Liar's Dice, and 5-rank Leduc, all $36{,}000$ audited hands satisfy the reported certificate tolerance.

Related papers

• Compute-Bounded Security Assurance - Coverage, Verification, and Response under Resource Constraints [0.0]
  Additional inference compute can increase the number of correctly resolved security-assurance tasks.<n>We develop a resource-constrained framework that separates success, unique coverage, accepted evidence, and operational protection.<n>A conceptual defensive architecture separates evidence analysis, adjudication, and operational authority.
  arXiv  Detail & Related papers  (2026-09-07T13:07:55Z)
• RecurSE: Bounded Recursive Self-Evaluation for LLM Rubric Judges [48.831446371402414]
  RecurSE pairs a trainable judge with a synchronized policy-copy checker that audits the judge's reasoning against meta-rubrics to supply a scalar process reward.<n>We show that RecurSE achieves consistent generalization gains across held-out medical, pairwise, summarization, and professional benchmarks.
  arXiv  Detail & Related papers  (2026-08-25T08:35:04Z)
• Repeated-Game Security for Restaking-Based Verifiable Inference [2.9661360665913574]
  This paper shows that a one-round slashing condition can overstate security when inference is supplied repeatedly under the same stake.<n>We propose a deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting.
  arXiv  Detail & Related papers  (2026-08-10T03:03:56Z)
• Online Security Learning in Cooperative Multi-Agent Systems under Hidden Byzantine Attacks [9.187804222596665]
  We study online cooperative control of a multi-agent system under Byzantine attacks.<n>An unknown, fixed subset of agents are Byzantine comprised and can stealthily overwrite its own coordinates.<n>Our studies provide comprehensive theoretical and algorithmic foundations of reliable multi-agent systems.
  arXiv  Detail & Related papers  (2026-08-06T19:03:49Z)
• SVR: Self-Verifying Refinement via Joint Verdict-Confidence Reinforcement Learning for Adaptive Test-Time Compute [62.3458279176813]
  Self-Verifying Refinement is an oracle-free multi-turn reinforcement learning framework.<n>It learns to use self-verification as a compute-control policy.<n>It achieves a macro-average accuracy of 0.563 with only 2.99 inference turns on average.
  arXiv  Detail & Related papers  (2026-07-30T16:20:58Z)
• Gaming-Resistant Insurance Contracts for Autonomous AI Agents: Strategy-Proof Toll Mechanism Design [0.0]
  Paper A defines a time-consistent actuarial runtime that prices each side-effect against a contractually fixed safe default and gates execution against a reserve budget.<n>We characterise a five-attack space for autonomous AI-agent insurance contracts and prove when the actuarial runtime is gaming-resistant.<n>We then compose these clauses with Paper A's runtime guarantees to obtain joint incentive compatibility over the five-attack space.
  arXiv  Detail & Related papers  (2026-06-15T07:31:21Z)
• When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms [4.9833735627186435]
  Open platforms increasingly route tasks among heterogeneous agents.<n>Standard reputation approach summarizes each agent by a single global trust score.<n>We study skill-conditional trust R(i | k)<n>We show that an attacker with cheap evidence in one skill and none in a target skill hijacks the conditional router.
  arXiv  Detail & Related papers  (2026-06-12T07:32:19Z)
• Survive or Collapse: The Asymmetric Roles of Data Gating and Reward Grounding in Self-Play RL [76.45061154544568]
  Self-play reinforcement learning trains language models on their own generated tasks, co-evolving a proposer and solver without human labels.<n>Recent systems report strong reasoning gains, but collapse and instability are widely observed and poorly understood.<n>We argue instead that self-play stability is governed by two distinct levers: a data-level gate that decides which proposer-generated tasks enter the training pool, and the reward signal that updates the policy on tasks already admitted.
  arXiv  Detail & Related papers  (2026-05-21T09:19:23Z)
• MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents [0.0]
  We formalize memory poisoning attacks on retrieval-augmented agents as a Stackelberg game with a unified evaluation framework.<n>We show faithful evaluation increases measured attack success by $4times$ (ASR-R: 0.25 to 1.00$)<n>Our primary contribution is MEMSAD, a calibration-based defense grounded in a gradient coupling.
  arXiv  Detail & Related papers  (2026-05-05T08:15:41Z)
• ZIP-RC: Optimizing Test-Time Compute via Zero-Overhead Joint Reward-Cost Prediction [57.799425838564]
  We present ZIP-RC, an adaptive inference method that equips models with zero-overhead inference-time predictions of reward and cost.<n> ZIP-RC improves accuracy by up to 12% over majority voting at equal or lower average cost.
  arXiv  Detail & Related papers  (2025-12-01T09:44:31Z)
• Reinforcement Learning with Verifiable yet Noisy Rewards under Imperfect Verifiers [90.50039419576807]
  Reinforcement Learning with Verifiable Rewards (RLVR) trains policies against automated verifiers to avoid costly human labeling.<n>To reduce vulnerability to verifier hacking, many RLVR systems collapse rewards to binary $0,1$ during training.<n>This choice carries a cost: it introduces textitfalse negatives (rejecting correct answers, FNs) and textitfalse positives (accepting incorrect ones, FPs)
  arXiv  Detail & Related papers  (2025-10-01T13:56:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.