The evasion arms race

Understand how the autonomous adversary learns a detector by black-box observation, how a small "personality vector" produces archetypes that each stress a different detection circuit, and why the paper proves that an adaptive detector and an adaptive adversary with memory have no stationary Nash equilibrium — then read the accompanying simulation with the right level of skepticism.

Track

Research

Module

5 · Research case studies

Prerequisites

Autonomous adversaries without intent · Deterministic vs probabilistic agents

Case lesson 1 argued that intent-based detection has zero utility against the autonomous adversary, but that statistical detection survives. So imagine a defender who leans into statistics: a detector that watches transactions, flags the suspicious ones, and updates its thresholds over time. This lesson is about the dynamics that follow — an adversary that learns the detector, and a detector that learns the adversary.

The key insight is that the adversary needs almost no information to adapt. It never sees the detector's internal rules, weights, or circuits. It sees only one bit after each action: was this transaction flagged, yes or no? That single feedback signal is enough to drive a standard online-learning loop.

The adversary maintains an internal model that maps a candidate action to an estimated probability of being detected. After each action it observes the detection flag and takes a gradient step to make its model agree better with reality — a plain binary-cross-entropy update. Its safety layer then refuses any plan whose estimated detection probability exceeds a threshold.

the detector-learning loop (transformed, schematic)
for each action a_t:
    x_t   = features(a_t)          # amount, timing, counterpart, velocity
    p_hat = O(x_t)                 # current estimate of P(detected)
    observe d_t in {0,1}           # the only feedback: flagged or not
    O <- O - step * grad(crossEntropy(d_t, p_hat))
    store (a_t, d_t) in episodic memory
    if d_t == 1: raise anti-pattern -> all agents avoid it next cycle

There is a convergence result attached: if the DEFENDER is stationary (never changes) and the adversary's model class is well-behaved, the adversary's estimate converges to the true detection probability. This is PROVEN, but it rests on a standard online-convex-optimization result and — critically — on the assumption that the defender sits still. That assumption is exactly what the rest of the lesson removes.

The adversary's behavior is tuned by a four-number vector — risk tolerance, aggressiveness, stealth, and patience — that reweights how plans are scored WITHOUT changing the plan library or the architecture. Different settings pull qualitatively different plans out of the same library, producing distinct behavioral signatures.

Risk tolerance

How close to the detection threshold the adversary is willing to operate.

Aggressiveness

Transaction volume and degree of parallelism across agents.

Stealth

How hard the adversary works to mimic ordinary behavior.

Patience

The time horizon — how long it will wait to complete an operation.

The paper names five archetypes, each designed to be maximally evasive against one detection mechanism: a high-stealth, long-horizon "Ghost" aimed at long-window structuring detection; a fast, high-volume "Runner" aimed at velocity checks; a "Patient" profile aimed at longitudinal graph analysis; a high-risk "Opportunist" aimed at adaptive-threshold evasion; and a "Harmonious" profile that blends into normal behavioral statistics. The claim the paper makes for this set is coverage: together they stress every component of a detection stack, so they form a minimum test suite for validating a defense. A defense that catches the Ghost but not the Runner is, by this criterion, not robust.

Now let the defender adapt too. The paper models the interaction as a two-player, zero-sum game in continuous time where BOTH sides have episodic memory, and proves there is no stationary Nash equilibrium — no fixed pair of strategies at which neither side wants to move. The proof is a short two-direction argument:

1. 1Suppose a stable equilibrium existed. Direction 1 (adversary breaks it): because the adversary observes detection outcomes, its model converges toward the defender's current policy, after which it finds plans with lower detection probability — contradicting the claim that the defender's policy was a best response.
2. 2Direction 2 (defender breaks it): any change the defender makes to counter the adversary is itself observable through the detection signal, so the adversary adapts again. Under mutual memory, there is no fixed point.

The practical reading: detection and evasion rates oscillate rather than settling, with the rhythm set by the two sides' relative learning rates. The paper frames the defender's engineering goal not as "reach a stable detector" but as "learn faster than the adversary" — a moving-target discipline rather than a solved-problem one. A corollary states plainly that no static rule set can permanently defeat the adversary; any viable defense must itself carry memory and keep adapting.

To illustrate the theorem, the paper runs a small simulation of the arms race and reports per-archetype detection rates across epochs. The authors are unusually explicit about what it is and is not, and we preserve that framing.

The reported pattern has three parts, consistent with the no-equilibrium theorem: (1) as the adversary learns, detection rates fall for every archetype, with the velocity-targeting Runner falling the most and fastest because its evasion maps most directly onto the velocity circuit's feature space; (2) when the defender then updates its thresholds, detection partially recovers; (3) the system keeps oscillating rather than converging, across every epoch tested. The paper reports the Runner, for example, dropping from roughly 0.41 to 0.14 as the adversary learns and then rebounding toward 0.21 once the defender responds.

So the honest summary is layered: the oscillation is PROVEN as a property of the model; the specific numbers are MEASURED in a simplified, controlled testbed and attributed to the paper as illustrative only; and full empirical validation against a deployed, adaptive compliance system is named by the authors as ongoing, future work.

Expected direction: The convergence result is conditional: IF the defender never changes, the adversary's model converges to the true detection probability. The no-equilibrium theorem covers the opposite, realistic case where the defender also adapts and has memory — then there is no fixed point and the two statements describe different regimes, not a contradiction. The implication is that a defender must not be static: since any stationary policy is learnable and then evadable, the defender has to carry episodic memory and keep adapting, aiming to learn faster than the adversary rather than to reach a final detector.

What information does the adversary need to learn the detector?

Only a single binary flag per action — whether the transaction was detected. It never accesses the detector's internal rules, weights, or circuits.

What does the personality vector change, and what does it NOT change?

It reweights how plans are scored (risk tolerance, aggressiveness, stealth, patience), producing different behavioral signatures. It does not change the plan library or the architecture.

What is the "coverage" claim for the five archetypes?

Each archetype maximally stresses a distinct detection circuit, so together they form a minimum test suite: a defense that handles some but not all archetypes is not robust.

Why is there no stationary Nash equilibrium when both sides have memory?

Any stable policy by one side is observable and learnable by the other, which then adapts to break it — so no fixed point exists and detection/evasion rates oscillate.

How should the simulation's detection-rate table be interpreted?

As illustrative of the oscillatory dynamics predicted by the theorem, not as predictive benchmarks — the paper explicitly disclaims real-world accuracy and omits costs like crypto overhead, gas, oracle staleness, and latency.