# Guarding Against Malicious Biased Threats (GAMBiT) Experiments: Revealing Cognitive Bias in Human-Subjects Red-Team Cyber Range Operations

arXiv: https://arxiv.org/abs/2508.20963 · HTML: https://mlsanity.com/paper/2508.20963/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 10 of its 25 references that are in the map.
- First posted on arXiv 28 Aug 2025.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 10 of 10)

- [Game Theory Meets LLM and Agentic AI: Reimagining Cybersecurity for the Age of Intelligent Threats](https://mlsanity.com/paper/2507.10621/) (2025)
- [Symbiotic Game and Foundation Models for Cyber Deception Operations in Strategic Cyber Warfare](https://mlsanity.com/paper/2403.10570/) (2024)
- [PsyScam: A Benchmark for Psychological Techniques in Real-World Scams](https://mlsanity.com/paper/2505.15017/) (2025)
- [From Texts to Shields: Convergence of Large Language Models and Cybersecurity](https://mlsanity.com/paper/2505.00841/) (2025)
- [When to Deceive: A Cross-Layer Stackelberg Game Framework for Strategic Timing of Cyber Deception](https://mlsanity.com/paper/2505.21244/) (2025)
- [A Multi-Resolution Dynamic Game Framework for Cross-Echelon Decision-Making in Cyber Warfare](https://mlsanity.com/paper/2507.03021/) (2025)
- [Cry Wolf: Toward an Experimentation Platform and Dataset for Human Factors in Cyber Security Analysis](https://mlsanity.com/paper/2002.10530/) (2020)
- [Game of Travesty: Decoy-based Psychological Cyber Deception for Proactive Human Agents](https://mlsanity.com/paper/2309.13403/) (2023)
- [PsybORG+: Modeling and Simulation for Detecting Cognitive Biases in Advanced Persistent Threats](https://mlsanity.com/paper/2408.01310/) (2024)
- [Bilateral Cognitive Security Games in Networked Control Systems under Stealthy Injection Attacks](https://mlsanity.com/paper/2505.01232/) (2025)

## Abstract (arXiv)

We present three large-scale human-subjects red-team cyber range datasets from the Guarding Against Malicious Biased Threats (GAMBiT) project. Across Experiments 1-3 (July 2024-March 2025), 19-20 skilled attackers per experiment conducted two 8-hour days of self-paced operations in a simulated enterprise network (SimSpace Cyber Force Platform) while we captured multi-modal data: self-reports (background, demographics, psychometrics), operational notes, terminal histories, keylogs, network packet captures (PCAP), and NIDS alerts (Suricata). Each participant began from a standardized Kali Linux VM and pursued realistic objectives (e.g., target discovery and data exfiltration) under controlled constraints. Derivative curated logs and labels are included. The combined release supports research on attacker behavior modeling, bias-aware analytics, and method benchmarking. Data are available via IEEE Dataport entries for Experiments 1-3.