# Agents That Certify Their Own Exploits: Confidence-Scheduled Restricted Responses for Safe Opponent Exploitation

arXiv: https://arxiv.org/abs/2607.28520 · HTML: https://mlsanity.com/paper/2607.28520/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 53 references that are in the map.
- First posted on arXiv 30 Jul 2026.

## Builds on (most cited first, 23 of 23)

- [DeepStack: Expert-Level Artificial Intelligence in No-Limit Poker](https://mlsanity.com/paper/1701.01724/) (2017)
- [Time-uniform, nonparametric, nonasymptotic confidence sequences](https://mlsanity.com/paper/1810.08240/) (2018)
- [Combining Deep Reinforcement Learning and Search for Imperfect-Information Games](https://mlsanity.com/paper/2007.13544/) (2020)
- [Deep Counterfactual Regret Minimization](https://mlsanity.com/paper/1811.00164/) (2018)
- [Solving Large Imperfect Information Games Using CFR+](https://mlsanity.com/paper/1407.5042/) (2014)
- [Solving Imperfect-Information Games via Discounted Regret Minimization](https://mlsanity.com/paper/1809.04040/) (2018)
- [Faster Game Solving via Predictive Blackwell Approachability: Connecting Regret Matching and Mirror Descent](https://mlsanity.com/paper/2007.14358/) (2020)
- [Safe and Nested Subgame Solving for Imperfect-Information Games](https://mlsanity.com/paper/1705.02955/) (2017)
- [Depth-Limited Solving for Imperfect-Information Games](https://mlsanity.com/paper/1805.08195/) (2018)
- [Regret Matching+: (In)Stability and Fast Convergence in Games](https://mlsanity.com/paper/2305.14709/) (2023)
- [RL-CFR: Improving Action Abstraction for Imperfect Information Extensive-Form Games with Reinforcement Learning](https://mlsanity.com/paper/2403.04344/) (2024)
- [Effective, Efficient, and General Information Abstraction for Imperfect-Information Extensive-Form Games](https://mlsanity.com/paper/2605.10900/) (2026)
- [Real-Time Parallel Counterfactual Regret Minimization](https://mlsanity.com/paper/2605.19928/) (2026)
- [Correlated Chance Sampling for Monte Carlo Counterfactual Regret Minimization](https://mlsanity.com/paper/2607.27035/) (2026)
- [PokerSkill: LLMs Can Play Expert-Level Poker without Training or Solvers](https://mlsanity.com/paper/2605.30094/) (2026)
- [Learning not to Regret](https://mlsanity.com/paper/2303.01074/) (2023)
- [Adapting Beyond the Depth Limit: Counter Strategies in Large Imperfect Information Games](https://mlsanity.com/paper/2501.10464/) (2025)
- [Test-then-Punish: A Statistical Approach to Repeated Games](https://mlsanity.com/paper/2603.05619/) (2026)
- [StratFormer: Adaptive Opponent Modeling and Exploitation in Imperfect-Information Games](https://mlsanity.com/paper/2604.25796/) (2026)
- [Nonparametric Strategy Test](https://mlsanity.com/paper/2312.10695/) (2023)
- [Faster Game Solving via Asymmetry of Step Sizes](https://mlsanity.com/paper/2503.12770/) (2025)
- [Deep (Predictive) Discounted Counterfactual Regret Minimization](https://mlsanity.com/paper/2511.08174/) (2025)
- [AlphaExploitem: Going Beyond the Nash Equilibrium in Poker by Learning to Exploit Suboptimal Play](https://mlsanity.com/paper/2605.09150/) (2026)

## Built on by (most cited first, 4 of 4)

- [ICM Out! Better Tournament Strategy from Computed Continuations, vs. Solvers and LLMs](https://mlsanity.com/paper/2608.09586/) (2026)
- [AV-AIVAT: 74x Cheaper Agent Evaluation with Certified Anytime-Valid Stopping in Imperfect-Information Games](https://mlsanity.com/paper/2608.06362/) (2026)
- [Abstraction Agent](https://mlsanity.com/paper/2609.04303/) (2026)
- [GPU-CFR: 80x Faster Counterfactual Regret Minimization by Compiling the Game to Static Dataflow and CUDA Graph Replay](https://mlsanity.com/paper/2609.11923/) (2026)

## Abstract (arXiv)

An agent playing a Nash-equilibrium strategy in a two-player zero-sum imperfect-information game secures the game value but forfeits the additional value offered by a flawed opponent. Diffuse deviations pose a particular challenge: binary release rules may gather too little evidence to act, while a full best response to an incomplete opponent model can be highly exploitable. We introduce budget-constrained confidence-scheduled restricted responses (CS-RNR), the first opponent-exploitation method whose safety guarantee is a certificate the agent computes on the strategy it actually deploys, so that every exploit it commits to is one it has audited itself. The method tracks pooled action frequencies with anytime-valid confidence sequences and treats a frequency as exploitable only once its interval separates from an equilibrium reference. The confirmed deviations define a conservative opponent model, which a restricted-response solve turns into candidate counter-strategies over a grid of pin levels. Before deployment, each complete candidate is evaluated by a full-tree best response. The resulting certificate is compared with a user-specified budget and committed atomically with the strategy. Because this check is performed on the played strategy, model quality determines the exploitation achieved while the certificate controls reference-relative expected loss. In Leduc hold'em, CS-RNR obtains 6.2× the steady-state gain of a money-verified binary gate while keeping every deployed strategy within budget. A trajectory mixture using the same estimator reaches 13.6× the budget. Across Leduc, Liar's Dice, and 5-rank Leduc, all 36,000 audited hands satisfy the reported certificate tolerance.