# Duplicity Games for Deception Design with an Application to Insider Threat Mitigation

arXiv: https://arxiv.org/abs/2006.07942 · HTML: https://mlsanity.com/paper/2006.07942/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2020.

## Built on by (most cited first, 8 of 8)

- [Reinforcement Learning for Feedback-Enabled Cyber Resilience](https://mlsanity.com/paper/2107.00783/) (2021)
- [Symbiotic Game and Foundation Models for Cyber Deception Operations in Strategic Cyber Warfare](https://mlsanity.com/paper/2403.10570/) (2024)
- [ADVERT: An Adaptive and Data-Driven Attention Enhancement Mechanism for Phishing Prevention](https://mlsanity.com/paper/2106.06907/) (2021)
- [HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model](https://mlsanity.com/paper/2406.01882/) (2024)
- [RADAMS: Resilient and Adaptive Alert and Attention Management Strategy against Informational Denial-of-Service (IDoS) Attacks](https://mlsanity.com/paper/2111.03463/) (2021)
- [Combating Informational Denial-of-Service (IDoS) Attacks: Modeling and Mitigation of Attentional Human Vulnerability](https://mlsanity.com/paper/2108.08255/) (2021)
- [ZETAR: Modeling and Computational Design of Strategic and Adaptive Compliance Policies](https://mlsanity.com/paper/2204.02294/) (2022)
- [Agentomics: Economic Foundations for the Valuation, Attribution, and Pricing of AI Agents in Human-AI Workflows](https://mlsanity.com/paper/2606.14769/) (2026)

## Abstract (arXiv)

Recent incidents such as the Colonial Pipeline ransomware attack and the SolarWinds hack have shown that traditional defense techniques are becoming insufficient to deter adversaries of growing sophistication. Proactive and deceptive defenses are an emerging class of methods to defend against zero-day and advanced attacks. This work develops a new game-theoretic framework called the duplicity game to design deception mechanisms that consist of a generator, an incentive modulator, and a trust manipulator, referred to as the GMM mechanism. We formulate a mathematical programming problem to compute the optimal GMM mechanism, quantify the upper limit of enforceable security policies, and characterize conditions on user's identifiability and manageability for cyber attribution and user management. We develop a separation principle that decouples the design of the modulator from the GMM mechanism and an equivalence principle that turns the joint design of the generator and the manipulator into the single design of the manipulator. A case study of dynamic honeypot configurations is presented to mitigate insider threats. The numerical experiments corroborate the results that the optimal GMM mechanism can elicit desirable actions from both selfish and adversarial insiders and consequently improve the security posture of the insider network. In particular, a proper modulator can reduce the textcolorblackincentive misalignment between the players and achieve win-win situations for the selfish insider and the defender. Meanwhile, we observe that the defender always benefits from faking the percentage of honeypots when the optimal generator is presented.