# Robust Is Salient: An Informed Adversary Moves the Optimal Signal onto the Salience Pole

arXiv: https://arxiv.org/abs/2610.00233 · HTML: https://mlsanity.com/paper/2610.00233/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 22 references that are in the map.
- First posted on arXiv 23 Sep 2026.

## Builds on (most cited first, 8 of 8)

- [Multi-Sender Persuasion: A Computational Perspective](https://mlsanity.com/paper/2402.04971/) (2024)
- [Codenames as a Benchmark for Large Language Models](https://mlsanity.com/paper/2412.11373/) (2024)
- [MINDGAMES: A Live Arena for Evaluating Social and Strategic Reasoning in Multi-Agent LLMs](https://mlsanity.com/paper/2605.29512/) (2026)
- [Improving Cooperation in Language Games with Bayesian Inference and the Cognitive Hierarchy](https://mlsanity.com/paper/2412.12409/) (2024)
- [The Stackelberg Speaker: Optimizing Persuasive Communication in Social Deduction Games](https://mlsanity.com/paper/2510.09087/) (2025)
- [QUACK: Questioning, Understanding, and Auditing Communicated Knowledge in Multimodal Social Deduction Agents](https://mlsanity.com/paper/2605.27068/) (2026)
- [Towards automating Codenames spymasters with deep reinforcement learning](https://mlsanity.com/paper/2212.14104/) (2022)
- [Consistency Without Alignment: Item-Sensitive Language Models Indistinguishable From Random](https://mlsanity.com/paper/2609.00576/) (2026)

## Abstract (arXiv)

When an informed adversary shares the audience of a constrained signalling channel, the signal that best protects the truth is the signal that best describes it. On 108 confirmatory items, the adversary-robust optimum aligns exactly with the salience pole from prior work. Across a 200,000-item pool, the two differ on only 2,748 items --- lying exactly where the prior salience-to-Bayes coordinate is undefined. Where defined, robustness is achieved by moving from Bayesian discrimination entirely to salience. We show this by introducing an adversary to a forced-choice task (abstracted from Deception: Murder in Hong Kong). The adversary knows the target, observes the signal, and argues for the strongest wrong answer using a persuasion budget, β. As β grows, the optimal signal shifts from the posterior-maximizing option to the margin-maximizing one; at β = 0, the game reproduces the original oracle model with a listener temperature of τ = 1. This effect is real: 18.2 percent of the pool has an optimum that shifts under a finite budget, and each item's critical budget is exact. This coincidence structurally limits empirical evaluation. Two adversary framings change the chosen option of seven language models on 30 to 77 of 108 items against an exact no-effect rate. Yet, no measurement can determine whether this movement is toward the adversary-aware optimum or toward salience, because the two options are identical. This is a structural limit, not a null result. The diagnostic check is cheap: before evaluating adversary-awareness, verify whether the robust target coincides with a heuristic target on the evaluation items.