PaperlayerView exact revision on arXiv

Source-linked AI summary

Robust Is Salient: An Informed Adversary Moves the Optimal Signal onto the Salience Pole

Cris Huynh

arXiv:2610.00233v1cs.AIcs.CLcs.GTcs.LG

TL;DR

A constrained signalling task may have a different optimal signal when an informed adversary can exploit the ambiguity left by the speaker. This paper formalizes that adversary and computes the resulting optimum. The robust target coincides with salience on all 108 confirmatory items, leaving the evaluation unable to distinguish adversary-aware choices from choices that simply follow salience.

  • Problem

    The paper asks how an informed adversary who shares the audience changes the optimal signal in a constrained signalling channel.

    Source: §VIII · p. 7

  • Method

    The paper adds an adversary who observes the signal and promotes a wrong answer, then computes the speaker’s worst-case objective and item-specific critical budgets.

    Source: §III · p. 3, §IV · p. 3

  • Results

    On all 108 confirmatory items, the adversary-robust optimum is the salience pole, and the two targets differ only where Paper 1’s coordinate is undefined.

    Source: §VIII · p. 7

  • Takeaways & Limitations

    Before evaluating adversary-awareness, check whether the robust target coincides with a heuristic target on the evaluation items.

    Source: §VIII · p. 7

    On the content-neutral contrast, the coordinate’s blind spot—the tie rate minus the same-option rate—ranges from 0 to 0.051.

    Source: §VII · p. 7

Abstract

from arXiv · show

When an informed adversary shares the audience of a constrained signalling channel, the signal that best protects the truth is the signal that best describes it. On 108 confirmatory items, the adversary-robust optimum aligns exactly with the salience pole from prior work. Across a 200,000-item pool, the two differ on only 2,748 items --- lying exactly where the prior salience-to-Bayes coordinate is undefined. Where defined, robustness is achieved by moving from Bayesian discrimination entirely to salience. We show this by introducing an adversary to a forced-choice task (abstracted from Deception: Murder in Hong Kong). The adversary knows the target, observes the signal, and argues for the strongest wrong answer using a persuasion budget, $\beta$. As $\beta$ grows, the optimal signal shifts from the posterior-maximizing option to the margin-maximizing one; at $\beta = 0$, the game reproduces the original oracle model with a listener temperature of $\tau = 1$. This effect is real: 18.2 percent of the pool has an optimum that shifts under a finite budget, and each item's critical budget is exact. This coincidence structurally limits empirical evaluation. Two adversary framings change the chosen option of seven language models on 30 to 77 of 108 items against an exact no-effect rate. Yet, no measurement can determine whether this movement is toward the adversary-aware optimum or toward salience, because the two options are identical. This is a structural limit, not a null result. The diagnostic check is cheap: before evaluating adversary-awareness, verify whether the robust target coincides with a heuristic target on the evaluation items.

I. INTRODUCTION

This paper adds an informed, responsive adversary to a constrained signalling task, where the speaker must choose one option from a fixed menu. It asks how that adversary changes the optimal signal and what can be measured when the robust target coincides with salience.

I. INTRODUCTION

  • 18.2 percent of the 200,000 candidate items have an optimum that moves at some finite adversary budget, with an exact critical budget for each item.On items that move, the speaker gives up some posterior mass on the truth to buy margin.Source: §I · p. 1
  • On all 108 confirmatory items, the adversary-robust optimum is the salience pole; across the pool, the targets differ only where the salience-to-Bayes coordinate is undefined.Where the coordinate is defined, robustness means giving up the full interval from Bayesian discrimination to salience.Source: §I · p. 1
  • Seven language models changed choices under both adversary framings, but the confirmatory items cannot reveal whether those changes move toward adversary-awareness or merely toward salience.The evaluation is structurally unable to measure that direction because the two targets are identical on every confirmatory item.Source: §I · p. 1
  • Before evaluating adversary-awareness, check whether the robust target coincides with a heuristic target; here, that check requires only oracle computations already needed by the evaluation.The check needs no model output.Source: §I · p. 1

II. RELATED WORK

  • The related-work contrast is measurability: the small enumerable signal space and frozen literal Bayesian listener make an exact optimum computable, unlike free-form persuasive utterances evaluated by relative outcomes.The paper frames its contribution as measurability, not simply showing that adversaries change what speakers should say.Source: §II · p. 2
  • Unlike Codenames’ fixed assassin hazard [3], [4], [5], this adversary observes the signal before choosing which rival to promote, making the task a responsive game.The cited Codenames treatments model a static hazard that can be routed around.Source: §II · p. 2
  • The constrained menu prevents full revelation in this information-design setting, where computing equilibria or a sender’s best response in general formulations can be hard,,, [9], [10].The paper positions its exactly solvable semantic instance as a place to check what general-problem approximations are approximating.Source: §II · p. 2
  • Prior social-deduction evaluations lack a reference optimum [11], [12], while this paper has no human arm and makes no claim about human speaker behavior,,,,,,,.The cited human-behaviour work studies other questions, including honesty under misaligned incentives and semantic indirectness.Source: §II · p. 2

III. SETUP AND THE ADVERSARY GAME

The setup freezes Paper 1’s literal listener and adds an informed adversary who observes the chosen signal and promotes a wrong answer. The speaker maximizes the worst-case probability of a correct accusation, yielding an objective that nests Paper 1’s oracle at β = 0 when τ = 1.

III. SETUP AND THE ADVERSARY GAME

  • The adversary knows the target, observes the signal, and promotes a decoy; the speaker maximizes the worst-case probability that investigators choose the true hypothesis.Investigators use log-posterior scores with a β bonus for the promoted decoy, and the listener remains frozen from Paper 1.Source: §III · p. 3
  • As β grows without bound, the optimal signal approaches the one maximizing the truth’s log-posterior margin over its strongest rival.The margin is log L(h*|o) − log M(o).Source: §III · p. 3
  • At β = 0 and τ = 1, the speaker’s objective equals the posterior on the truth, so its optimum is Paper 1’s Bayes pole.This nesting holds only at τ = 1, inherited from Paper 1’s frozen listener; the paper claims no robustness to other temperatures.Source: §III · p. 3
  • Each item has a critical budget: the first budget at which a rival overtakes the no-adversary optimum, with divergence sets nested as β increases.The closed-form critical budget is cross-checked against bisection on every item of Paper 1’s frozen 1,000.Source: §III · p. 3
  • The price of robustness is the posterior mass on the truth given up when moving from the no-adversary optimum to the robust optimum.It is reported primarily as the difference between those options’ post norm values.Source: §III · p. 3
  • The divergence-rate figure uses the 200,000-item pool as its population base and shows Paper 1’s frozen 1,000 separately, with D(0) empty by construction.Its ∞ point is a separate anchor, not a limit of the curve.Source: Figure 1 · p. 3

IV. ARM A: THE ADVERSARY EFFECT

Adversarial pressure moves some items’ optimal signals at exact critical budgets, and the size of the effect varies across the pool. Robustness has a measurable cost in posterior mass and can be associated with a preregistered design gate.

The effect exists and divergence grows with budget

  • 18.2% of the 200,000-item pool has a finite critical budget, while divergence rises from 0.16% at β = 0.25 to 18.0% at β = 8.The 18.2% is the population figure; the 18.0% is the reporting-grid endpoint rate.Source: §IV · p. 3

The critical budget is an exact per-item scalar

  • On 460 frozen items with finite βc, the median critical budget is 3.33 and the mean is 3.36 (SD 1.61), spanning 0.19 to 10.66.The other 540 frozen items are adversary-robust, so no budget moves their optimum.Source: §IV · p. 3, Figure 2 · p. 4

Robustness has a price

  • Across 36,464 divergent pool items, the robust signal gives up an average 0.276 of each item’s posterior range on the truth.On the raw probability scale, the average price is 0.0034 (SD 0.0033); Fig. 3 shows both scales.Source: §IV · pp. 3–4

The preregistered fit cost gate fired

  • The preregistered fit-cost gate fired because βc correlated with Paper 1’s fit cost at Spearman −0.9036, exceeding the 0.8 magnitude threshold.The planned redraw did not occur, so Arm B used Paper 1’s frozen items, yielding n = 108.Source: §IV · p. 4

V. THE COINCIDENCE

The adversary-robust signal coincides with the salience pole on every confirmatory item, and across the pool their differences occur only where Paper 1’s salience-to-Bayes coordinate is undefined. Where that coordinate is defined, robustness means giving up the full interval from Bayesian discrimination to salience.

The adversary-robust signal is the salient signal

  • On all 108 confirmatory items, the adversary-robust optimum is the option that best fits the truth, Paper 1’s salience pole.The two options differ on 2,748 of 36,464 divergent pool items, and every difference lies inside the span guard where the coordinate is undefined.Source: §V · p. 4

The coincidence across bases

  • On the frozen divergence set, the targets coincide on 452 of 460 items; all eight exceptions are on manmade or moves and inside the span guard.On the 439 items where the coordinate is defined, the robust signal is exactly at the salience pole.Source: §V · p. 4

Robustness is bought by walking back to salience

  • On all 32,454 pool items where the coordinate is defined, the robust signal sits at the salience pole; its price on the salience-to-Bayes coordinate is exactly 1.The reported numerical deviations from 1 are at most 7 × 10^-14 on the pool.Source: §V · pp. 4–5

Where the two targets separate, the coordinate is blind

  • All 2,748 pool items where the robust and salience targets differ fall within the 0.02 span guard, where the coordinate is undefined.The separation and the coordinate do not co-occur in this signal space as measured.Source: §V · pp. 4–5

What the coincidence is, and what it is not

  • Because the targets coincide on the confirmatory set, a model’s choice cannot reveal whether it anticipates the adversary or simply moves to salience.The coincidence is not an identity: the exceptions are real items on manmade and moves, and this section does not measure models.Source: §V · pp. 4–5

VI. ARM B: WHAT THE EVALUATION SHOWS, AND WHY IT CANNOT SHOW MORE

Arm B varies how the adversary is described in prompts and measures model choices and their movement on an adversary coordinate. Its design uses seven models, confirmatory and control item sets, and three distinct measurement quantities.

A. Design

  • Three adversary framings vary the description of the adversary, from Paper 1’s unchanged prompt to a prompt specifying that the adversary argues for the wrong pair made most plausible by the signal.The framings do not name an option, concept, tile, or which signal to send.Source: A. Design · p. 5
  • Seven models are scored by argmax over teacher-forced, PMI-normalized option-string log-probabilities, with Paper 1’s harness and no sampling.The set includes four Qwen3 instruction models, two Qwen3 base models, and OLMo-2-7B-Instruct as a cross-family control.Source: A. Design · p. 5
  • The confirmatory set contains 108 divergent items from the size tile, while the control set has 142 adversary-robust items where the oracle and robust optima coincide.Each confirmatory item has two stored option-order permutations.Source: A. Design · p. 5
  • The adversary coordinate A is 0 at Paper 1’s oracle and 1 at the adversary-aware optimum; on confirmatory items, 1 is also the salience pole.The coordinate uses the item’s min-max-normalized margin.Source: A. Design · p. 5
  • The evaluation separately measures option-change share, same-option rate relative to a content-neutral insertion, and an item-level sign test of nonzero A changes.The direction test is two-sided, against p0 = 0.5, with α = 0.05/21.Source: A. Design · p. 5

B. The framings changed the chosen option

Both adversary framings changed model choices, but the evaluation does not establish that choices moved toward the adversary-aware target. Its direction measures are limited by ties, a content-neutral comparison, and the coincidence between the robust and salience targets.

B. The framings changed the chosen option

  • The deterministic scorer’s measured no-effect same-option rate was exactly 1, with zero disagreements across 3,500 confirmatory-tile renderings under F0.That zero is a lower bound on noise under the longer F1 and F2 prompts.Source: B. The framings changed the chosen… · p. 5
  • 30 to 77 of 108 items showed changed choices across all fourteen model-framing cells, and every cell cleared the floor (Table I).The claim concerns chosen options, not why they changed.Source: B. The framings changed the chosen… · p. 5, Table I · p. 6
  • On three cells, framings changed choices more than condition 5 by 0.106, 0.148, and 0.162 in same-option rate; the other eleven differences did not resolve.The instrument’s half-width of 0.14 to 0.17 means gaps below about 0.15 are not resolvable.Source: B. The framings changed the chosen… · p. 5
  • On 142 adversary-robust items, framings also changed choices on 41 to 104 items per cell, but this exploratory control cannot quantify generic movement in the confirmatory set.The item sets are disjoint and differ in whether the adversary can move the optimum.Source: B. The framings changed the chosen… · p. 6

C. Quantity (c), reported as computed

  • Five of fourteen cells had corrected-significant shares of moving items with ∆A > 0 below 0.5, but these verdicts license no claim about direction.The content-neutral insertion’s sign proportion ranged from 0.195 to 0.556 and resolved below 0.5 only on CTRL.Source: C. Quantity (c), reported as computed · p. 6
  • B2’s gap was −0.056, a Type I exposure rather than a smaller Type II cost; changing p0 = 0.5 would recalibrate the preregistered test against a different manipulation.No verdict on the preregistered hypothesis about adversary tracking is issued.Source: C. Quantity (c), reported as computed · p. 6

D. Why the direction question is unanswerable here

The item set makes movement direction unidentifiable where the adversary-aware optimum and salience pole are the same option, and other design constraints independently rule out a direction reading. The discussion also bounds the evaluation by sample size, coordinate blind spots, and its model and task scope.

D. Why the direction question is unanswerable here

  • On every confirmatory item, A = 1 labels both the adversary-aware optimum and salience pole, so no function of choices can distinguish movement toward either.The fixed tile has eight separating items, but those fall on two tiles Paper 1 found carry approximately nothing.Source: D. Why the direction question is… · p. 6
  • Three preregistered grounds also block direction readings: the quantities are not excess over the marginal null, CTRL’s neutral-insertion departure is below 0.5, and sign tests discard tied-A switches.On three of five resolving cells, discarded switches occurred at 1.81 to 4.09 times the per-pair-bound rate; their direction is not established.Source: D. Why the direction question is… · pp. 6–7
  • The attribution cap and marginal null are descriptive, inherit the mixture defect, and have no mapping to the sign test, leaving Arm B without a generic-shift defense.The cap reweights the confirmatory set using option shifts measured on the control set and requires the observed mean change in A to exceed that cap.Source: D. Why the direction question is… · p. 7
  • The movement claim survives: framings changed choices on 30 to 77 of 108 items, but the evaluation cannot say what the movement was toward.The item set was fixed before any model was run.Source: D. Why the direction question is… · p. 7

VII. DISCUSSION AND LIMITATIONS

  • The confirmatory set has 108 items against a preregistered benchmark of 400, with sign-test power from 0.25 to 0.91 across cells at an alternative of 0.75.A modest directional effect would not be detected; this bounds per-cell figures in Table I.Source: §VII · p. 7
  • The coordinate misses switches between options tied on A: 84 of 1,620 confirmatory option pairs were tied, while item-level tie prevalence is inflated by option count.The tie rate was 5.2 percent on the confirmatory set versus 3.3 percent over the divergence set; tied switches do not establish the direction of retained switches.Source: §VII · p. 7
  • The mean of A is descriptive because 70.0 percent of admissible option pairs change A by more than the target move of 1, allowing large off-pole moves to dominate.This coordinate behavior motivates reporting a change rate plus sign test rather than treating a negative mean A as a finding.Source: §VII · p. 7
  • No human response is measured, and a learned policy would need items with distinct, defined targets; the frozen set has no such items, while the cheap check is established only for this task.The frozen set supplies eight items with distinct options and none with a defined coordinate; the paper does not characterize or propose a separating item set.Source: §VII · p. 7

VIII. CONCLUSION

The paper concludes that the adversary-robust signal is the salience pole on all 108 confirmatory items, and that the targets separate across the pool only where the prior coordinate is undefined. Framings changed seven models’ choices, but the evaluation cannot identify the direction of that movement.

VIII. CONCLUSION

  • On all 108 confirmatory items, the adversary-robust signal is the salience pole, and across the pool the targets separate only where Paper 1’s coordinate is undefined.The paper reports that 18.2 percent of the candidate pool has an optimum that moves under some finite budget.Source: §VIII · p. 7
  • Adversary framings changed seven models’ choices on 30 to 77 of 108 items, but no measure on these items can tell whether movement was toward the robust target or salience.Those targets are the same option on the confirmatory items.Source: §VIII · p. 8

ETHICS STATEMENT

APPENDIX A DERIVATIONS AND THE βc CROSS-CHECK

The appendix derives the adversary’s strongest wrong answer and the signal objective, then characterizes when the optimum changes as persuasion budget grows. It cross-checks critical-budget classification and clarifies which tie-break-only divergences affect reported counts.

APPENDIX A DERIVATIONS AND THE βc CROSS-CHECK

  • For any τ > 0 and β ≥ 0, the adversary’s best wrong answer is the alternative with the largest likelihood given the signal.This follows by minimizing the speaker’s objective over wrong answers.Source: Appendix A · p. 8
  • At β = 0 and τ = 1, V0(o) = L(h*|o); as β → ∞, the maximizing signal tends to the margin argmax at every τ.For τ ≠ 1, V0 reorders options with equal L(h*|o) when their rival distributions are differently peaked.Source: Appendix A · p. 8
  • Each rival can overtake the β = 0 optimum at most once, making the divergence set nested and allowing bisection on the optimum-change indicator to find βc.The finite-budget divergence identity is that βc is finite exactly when the tie-broken β = 0 and infinite-budget optima differ.Source: Appendix A · p. 8
  • On the frozen 1,000 items, closed form and bisection classified every item identically, with a maximum β gap of 2.2 × 10^-6.On the pool, a zero-coefficient test disagreed with bisection on 161 items; direct evaluation resolves the differences as rounding residue or tie-break flips.Source: Appendix A · p. 8

APPENDIX B TOLERANCE-DETERMINED DIVERGENT ITEMS

  • 136 pool items are divergent only by Paper 1’s tie-break band, with βc between 17.35 and 23.45; they affect |D(∞)| but not grid-rate or confirmatory figures.None of the 2,748 separating items is among these cases.Source: Appendix B · p. 8

EXPLORATORY ANALYSIS

The exploratory analysis reports alternate price-of-robustness denominators, conflict enrichment, and exploratory predictors of critical budget. The appendices document per-cell measures and deviations from the preregistered plan, including unrun analyses and limits on directional claims.

EXPLORATORY ANALYSIS

  • 0.578 is the mean per-item ratio using posterior mass above the uniform prior; 42 items exceed 1, where the robust signal leaves truth below the prior.This is an alternate denominator, not the headline; Paper 1’s posterior-range normalization remains primary.Source: EXPLORATORY ANALYSIS · p. 8
  • 50% of Paper 1’s frozen set but 18.7% of the pool are conflict items, which make up 98.3% and 92.4% of the two divergence sets.The authors describe this as a robustness check, not a second estimate.Source: EXPLORATORY ANALYSIS · p. 8
  • On 460 finite items, βc correlates −0.779 with margin headroom, +0.602 with posterior gap, −0.574 with fit cost, and −0.557 with decision margin.The correlations are exploratory, with no preregistered prediction or threshold; the four-tile rank check separates nothing because its statistic has only five possible values.Source: EXPLORATORY ANALYSIS · pp. 8–9

APPENDIX D FULL PER-CELL TABLES

  • Table II gives intervals behind Table I, while the total-variation measure never exceeds the control change rate on 13 cells with identical renderings.The B2-under-F1 premise does not hold; marginals are not pooled across tiles of different arity, and the reported quantities are descriptive.Source: Appendix D · p. 9

APPENDIX E PREREGISTRATION AND DEVIATIONS

  • The fit-cost gate led Arm B to use Paper 1’s frozen size tile, restricted to finite βc, leaving n = 108 against a benchmark of 400.The authors declined to enlarge the size tile because doing so required an unmeasured quantity.Source: Appendix E · p. 9
  • The confirmatory instrument changed from a paired test on mean ΔA to a same-option rate and exact sign test; the sign-test unit was restored to the item.The change followed the three-way mixture on A, and p0 = 0.5 was retained on structural grounds after an earlier content-neutral-baseline justification was withdrawn.Source: Appendix E · p. 9
  • The reference gate was removed after the no-effect rate proved exactly 1; the control change rate was authorized as exploratory and reported side by side only.The tie-broken divergence definition was retained, with 136 admitted items disclosed; its closed-form cross-check used a zero test inside an empty gap at the inherited tolerance.Source: Appendix E · p. 9
  • The learned-speaker arm, τ robustness check, decay-family sensitivity analysis, and three-scoring-rule recomputation were not run; no verdict is issued on the preregistered tracking hypothesis.The authors state that the confirmatory set cannot answer the direction question because of the structural coincidence described in Section V.Source: Appendix E · p. 9

APPENDIX F ITEM CONSTRUCTION

Arm B uses Paper 1’s unchanged items and Format V prompts, with its confirmatory set drawn from the size tile.

APPENDIX F ITEM CONSTRUCTION

  • Paper 1 generated 200,000 candidate items from 1,118 concepts and froze 1,000 items, split evenly between conflict and control and across four tiles.Arm B’s confirmatory set is the 108 divergent size-tile items; its control set contains the remaining 142 size items.Source: Appendix F · p. 9

APPENDIX G THE THREE FRAMINGS, VERBATIM

The task asks a speaker who knows a hidden pair to send exactly one description to help a listener identify it. The appendix presents adversary framings and specifies the measures and intervals reported in Table II.

APPENDIX G THE THREE FRAMINGS, VERBATIM

  • Table II reports item-mean change rates and bootstrap intervals, control rates, total variation, intervals on differences from Rm, and sign-proportion intervals with realized power.The caption marks the control rate as exploratory and not comparable to the confirmatory rate as an attribution.Source: Table II · p. 10
  • The original task presents two object lists, a secretly chosen pair known to the speaker, and a listener who must identify that pair from one permitted description.The prompt asks, “Which do you send?”Source: Appendix G · pp. 9–10
  • The framing blocks share their first two sentences; F1 restates facts in its third sentence, while the F1–F2 contrast is the adversary’s rule, not length.The adversary knows the pair and seeks a wrong answer; one framing says they will argue for the wrong pair made most likely by the description.Source: Appendix G · p. 10
Loading 2610.00233v1…