A Bayesian Correlated Equilibrium for Early Insider-Threat Detection

• URL: http://arxiv.org/abs/2609.03096v1
• Date: Wed, 02 Sep 2026 19:12:56 GMT
• Title: A Bayesian Correlated Equilibrium for Early Insider-Threat Detection
• Abstract summary: We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users.<n>On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation achieve near-zero pre-exfiltration detection.
• Score: 11.643788980306235
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users and detect malicious deviations before exfiltration. Certifiers and users operate under a Bayesian Temporal Correlated Equilibrium (BTCE), where a sealed-envelope correlating device issues private recommendations over time and obedience is verified at every on-path information state. Unlike Stackelberg formulations, BTCE coordinates heterogeneous certifiers without requiring commitment power. We incorporate present bias and loss aversion to capture impulsive escalation dynamics, enabling 1.7--4.5 days earlier detection than rational baselines. We prove three guarantees: (1) calibrated intervention losses make recommended behavior a current-self best response despite behavioral biases, (2) controlled evidence accumulation guarantees intervention in bounded expected time before exfiltration, and (3) median aggregation confines implemented actions to the honest recommendation range when fewer than half of certifiers are Byzantine. On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation (HOLMESLite) achieve near-zero pre-exfiltration detection under comparable constraints.

Related papers

• Prior-matched evaluation of operational Earth-observation classifiers: a three-number reporting method demonstrated on Sentinel-1 internal-wave detection [1.2599533416395765]
  A model that scores 0.794 balanced-test precision scores 0.192 in real operation.<n>We show the mismatch to be an evaluation problem in the costume of a training one at a fixed recall.<n>We show a prior-matched reporting method based on three figures: balanced-test, operational-prior, and real post-deployment.
  arXiv  Detail & Related papers  (2026-07-08T08:38:40Z)
• PerceptionRubrics: Calibrating Multimodal Evaluation to Human Perception [75.70273182182397]
  PerceptionRubrics is a rubric-based evaluation framework.<n>It addresses the gap between saturated benchmark scores and real-world brittleness.<n>It pairs 1,038 information-dense images with over 10,000 instance-specific rubrics.
  arXiv  Detail & Related papers  (2026-06-26T17:59:15Z)
• False Sense of Safety in Selective Signal Classification: Auditing Bound Tightness and Exchangeability for Risk Control [6.3999417080764225]
  Selective prediction with distribution-free risk control promises that, with confidence 1-delta over the calibration draw, the error rate of accepted inputs stays below a user budget alpha.<n>We audit this promise on signal-domain detectors -- machine anomalous-sound detection (ASD) and AI-generated-image forensics.
  arXiv  Detail & Related papers  (2026-06-13T06:48:50Z)
• Validation-Gated Multi-Agent Governance for Online Adaptation of Thermal-Hydraulic Surrogate Models under Operating-Regime Shift [3.732931548972571]
  This study develops a guarded continual-adaptation framework for experimental thermal-hydraulic loop data.<n>The MA-Full mode, in which the role-separated multi-agent council reviews every evaluated stream step, achieved the lowest mean error, 5.72, and 35.8% exceedance.
  arXiv  Detail & Related papers  (2026-06-02T08:31:48Z)
• Unveiling the Entropy Dynamics of Chain-of-Thought Reasoning [81.57028614960576]
  We show that the Confidence Region possesses two critical properties: 1) High Reliability -- answers in the confidence region become highly accurate and stable, and 2) High Redundancy -- models generate unnecessary tokens long after reaching the correct answer.<n>These properties unlock more efficient and reliable inference strategies.
  arXiv  Detail & Related papers  (2026-06-01T10:11:14Z)
• CALIBURN: A Regime-Sensitivity Study of Operationally Calibrated Streaming Intrusion Detection [0.0]
  Streaming network intrusion detection systems must process flows continuously while keeping memory bounded.<n>Most current methods leave alerting threshold selection as a post-hoc tuning problem poorly suited to production.<n>This paper presents CALIBURN, a five-component streaming alerting pipeline composed of a truncated Bayesian online change-point detector.
  arXiv  Detail & Related papers  (2026-05-23T18:18:38Z)
• Online Conformal Prediction with Corrupted Feedback [42.94410959330529]
  Online conformal prediction (OCP) addresses this challenge through adaptively updated prediction sets.<n>These guarantees hinge on the assumption of perfect feedback about the coverage of past prediction sets.<n>In practice, the observed miscoverage indicator may be corrupted by noise, communication failures, or adversarial manipulation.
  arXiv  Detail & Related papers  (2026-05-19T21:34:37Z)
• Architecture-agnostic Lipschitz-constant Bayesian header and its application to resolve semantically proximal classification errors with vision transformers [0.0]
  This work presents an architecture-agnostic Lipschitz-constant Bayesian header that can be integrated into feature extractors such as vision transformers.<n>We also propose a novel metric to capture uncertainty and confidence across misclassification rates, as well as an adaptive arithmetic-mean fusion scheme.<n>Although computational costs increase due to Monte Carlo sampling, the method offers plug-and-play compatibility with pre-trained backbones.
  arXiv  Detail & Related papers  (2026-05-07T09:18:06Z)
• Towards Trustworthy Depression Estimation via Disentangled Evidential Learning [50.22167852149165]
  We propose EviDep, an evidential learning framework that jointly quantifies depression severity.<n>EviDep enforces strict information integrity to guarantee robust evidence synthesis.<n>It achieves state-of-the-art predictive accuracy and superior uncertainty calibration, delivering a robust fail-safe mechanism for trustworthy clinical screening.
  arXiv  Detail & Related papers  (2026-04-17T13:27:11Z)
• Malicious Agent Detection for Robust Multi-Agent Collaborative Perception [52.261231738242266]
  Multi-agent collaborative (MAC) perception is more vulnerable to adversarial attacks than single-agent perception. We propose Malicious Agent Detection (MADE), a reactive defense specific to MAC perception. We conduct comprehensive evaluations on a benchmark 3D dataset V2X-sim and a real-road dataset DAIR-V2X.
  arXiv  Detail & Related papers  (2023-10-18T11:36:42Z)
• Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation [122.83280749890078]
  We propose an improved certified defense against general poisoning attacks, namely Finite Aggregation. In contrast to DPA, which directly splits the training set into disjoint subsets, our method first splits the training set into smaller disjoint subsets. We offer an alternative view of our method, bridging the designs of deterministic and aggregation-based certified defenses.
  arXiv  Detail & Related papers  (2022-02-05T20:08:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.