Source-linked AI summary
Bounded Reasoning: Cognitive Hierarchy in Human-versus-AI Cyber Defense
Zahra Aref, Sheng Wei, Narayan B. Mandayam
TL;DR
This paper asks what aggregate scores miss about human and automated adaptation in sequential cyber defense. It compares human and automated DQN and CHT–DQN defenders on an attack graph, finding behavioral and stage-wise patterns alongside no statistically reliable overall protection gain from the reward-plus-transition human game.
Problem
Human-agent evaluations often use aggregate task scores, although those scores can hide how human and automated policies adapt over time in sequential cyber defense.
Source: §1 · pp. 1–2Method
The study compares two human-playable DQN and CHT–DQN information structures and their automated defender counterparts against a DQN attacker on an attack graph.
Source: §3.1 · p. 3, §3.3 · p. 4Results
A 0.006 overall data-protection difference between Hforecast and Hreward was not statistically reliable (95% CI [−0.006, 0.019], Welch p=0.33), while human reselection and stage-wise rankings showed additional patterns.
Source: §4.2 · p. 6, §5 · p. 9, §6 · p. 9Takeaways & Limitations
Overall protection alone does not capture the study’s human reselection asymmetry or the descriptive final-stage ordering of defender settings.
Source: §5 · p. 9, §6 · p. 9The study is bounded to one synthetic six-node graph, 40-round sessions, Mechanical Turk participants, and non-randomized task selection.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Human-agent evaluations often compress interaction into a single performance score, even when human and automated policies adapt differently over time. We study this in a sequential cyber-defense game on an attack graph, where a human or reinforcement-learning defender protects cloud assets against a Deep Q-Network (DQN) attacker. We compare four defender settings: a human reward-only game operationalizing the DQN information structure, a human reward-plus-transition game operationalizing the Cognitive Hierarchy Theory-driven DQN (CHT-DQN) information structure, an automated DQN defender, and an automated CHT-DQN defender. In the reward-only game, participants receive payoff and reward feedback. In the reward-plus-transition game, they also see attacker-aware transition probabilities from the CHT-DQN model. Across 80 Mechanical Turk participants and matched automated simulations, human defenders adapted to outcomes in a way the automated defenders did not: they were more likely to reselect a node after a successful defense than after a failure, in both games, an asymmetry we interpret as consistent with Prospect Theory and Cumulative Prospect Theory. The 40-round average also mixes early rounds, where the DQN attacker acts mostly at random, with late rounds, where it mostly exploits; in the final stage, mean protection ranks the reward-plus-transition human game above the reward-only human game, then the automated CHT-DQN defender, then the automated DQN defender, an ordering the overall mean hides. By contrast, the reward-plus-transition game does not produce a statistically reliable overall gain in weighted data protection over the reward-only game. These results suggest that evaluating human-agent cyber-defense systems only by an averaged task score can miss behaviorally meaningful differences in adaptation, action allocation, and bounded human reasoning.
1 Introduction
The paper asks what a 40-round average misses when humans and automated agents adapt differently in sequential cyber defense. It compares human-playable and automated DQN and CHT–DQN defender settings to examine protection and behavioral patterns.
1 Introduction
- The study asks whether a single 40-round average hides meaningful differences in human and automated adaptation during sequential cyber defense.In this task, defenders repeatedly allocate protection under adversarial uncertainty.Source: §1 · pp. 1–2
- Four defender settings face the same DQN attacker on a six-node graph: two human games and automated DQN and CHT–DQN defenders.The human games expose either reward feedback alone or reward feedback plus attacker-aware transition probabilities.Source: §1 · p. 2
- The study compares protection, stage-wise performance, action allocation, response time, and reselection after success or failure, without claiming humans compute a level-1 best response or represent deployed SOC analysts.Its questions concern qualitative agreement with simulation, differences between human games, and behavioral regularities absent from automated policies.Source: §1 · p. 2
2 Related work
Related work motivates evaluating human-agent systems beyond technical scores, while distinguishing this study from work on explanations, reliance, and cognitive hierarchy. The paper focuses on how aggregate protection relates to stage-wise behavior, action allocation, and reselection.
2 Related work
- Prior work argues that technical metrics alone do not characterize deployed human-agent systems, and reviews report limited use of human-centered metrics and uncertainty reporting.The cited review reports that 83% of 84 papers used technical metrics more often than human-centered ones, while only 15% used both; 14 of 24 benchmarks omitted significance or uncertainty.Source: §2 · p. 2
- Explanations and extra quantities do not automatically yield complementary accuracy or appropriate reliance, and this study instead evaluates humans against a DQN attacker.Prior work includes interactive cyber-defense games with scripted attackers and humans with cognitive agents, whereas this study compares human-playable DQN and CHT–DQN operationalizations alongside automated defenders.Source: §2 · p. 2
- Cognitive hierarchy models bounded reasoning rather than payoff improvement, and the paper does not claim CHT–DQN is generally superior or that a short Mechanical Turk game represents a deployed SOC.The paper connects reselection after success versus failure to Prospect Theory and Cumulative Prospect Theory, and limits its contribution to comparing aggregate protection with stage-wise protection, action allocation, and human reselection.Source: §2 · p. 2
3 Human-versus-AI study design
The study uses a sequential attack-graph game to compare human and automated defender roles under DQN and CHT–DQN information structures. Its design measures protection alongside behavior, while limiting inferential comparisons to the two human games.
3 Human-versus-AI study design
- The task places a human or automated defender against a DQN attacker in a sequential game, with the defender choosing one graph node per round to protect.The study records data protection, action allocation, and reselection over 40 rounds.Source: §3 · pp. 2–3
3.1 Task: sequential defense on an attack graph
- The six-node graph represents cloud vulnerabilities and exploits, and a targeted node is compromised only when the defender does not protect it.The graph and its node values, exploit likelihoods, and costs are generated in the simulator rather than drawn from an external vulnerability or APT dataset; protection ratios remain in a narrow band near the top of the scale.Source: §3.1 · p. 3
3.2 Cognitive hierarchy: level-1 human, level-0 bot
- Cognitive hierarchy treats the human defender as level 1 and the bot attacker as level 0, but the paper does not claim participants compute the model’s best response.The DQN attacker is adaptive but not hierarchically strategic; the human occupies the modeled defender role without being asserted to play level-1 optimally.Source: §3.2 · pp. 3–4
3.3 Two human games as operationalizations of DQN and CHT–DQN
- The reward-only game shows payoff and realized-reward feedback, while the reward-plus-transition game also displays CHT-derived attacker-aware transition probabilities without recommending an action.The two games operationalize the DQN and CHT–DQN information structures, respectively.Source: §3.3 · p. 4
3.4 Four defender settings
- The four settings are Hforecast, Hreward, Auto-CHT, and Auto-DQN, but only the two human games form the primary human-subject comparison.There were 40 participants per human condition; automated settings were matched simulation baselines, so human-versus-automation comparisons are descriptive.Source: §3.4 · p. 5
3.5 Quantities and analysis
- The analysis tracks overall and stage-wise protection, human-game contrasts, reselection after success versus failure, node frequencies, and elapsed time.Stage-wise protection, action frequencies, and elapsed time are exploratory; with 40 participants per arm, the primary test had 80% power only for standardized effects of about d=0.63 or larger.Source: §3.5 · p. 5
3.6 Participants and procedure
- Eighty Mechanical Turk participants completed the 40-round task, with 40 participants in each human game, and task assignment was not individually randomized.Participants chose one node per round against a live DQN attacker and received a data-protection score; this protocol is not a substitute for longitudinal evaluation of a deployed SOC.Source: §3.6 · p. 6
4 Results
Protection rankings changed across attacker stages, while the two human games showed no reliable overall protection difference. Human reselection varied with success versus failure, and action frequencies showed allocation patterns not captured by protection scores alone.
4 Results
- This comparison is not a test of cognitive hierarchy: the theory does not predict that showing CHT transitions raises human payoff.The reported outcome concerns the two human games, not whether participants computed a level-1 best response.Source: §4 · p. 6, §4.2 · p. 7
4.2 The two human games: Hforecast versus Hreward
- The 40-round Hforecast–Hreward protection contrast was not statistically reliable; with 80% power only at d≥0.63, small differences remain possible.No stage-wise Welch test rejected no difference after correction.Source: §4.2 · pp. 6–7
4.1 Protection across stages
- In rounds 31–40, mean protection ranked Hforecast > Hreward > Auto-CHT > Auto-DQN, while automated defenders led in rounds 11–20.The attacker’s exploration rate fell across stages; human-versus-automation comparisons are descriptive, and the last-stage gaps were small with overlapping standard deviations.Source: §4.1 · p. 6, Figure 2 · p. 7
4.2 The two human games: Hforecast versus Hreward
- Sessions displaying transition forecasts were descriptively shorter, but the study cannot distinguish more efficient judgment from following the displayed probabilities.Per-round decision times were not recorded, and protection did not differ reliably.Source: §4.2 · p. 7
4.3 Reselection after success versus failure
- ≈0.21 pooled reselection contrast: humans reselected the same node more after successful defense than after failure in both games, unlike automated defenders.Reselection means choosing the same attack-graph node again as the next action; the pattern is reported as consistent with PT/CPT, not evidence for it over alternatives.Source: §4.3 · pp. 7–8
4.4 Action frequencies
- Humans spread defended-node choices more evenly than automated defenders; Hforecast visually tracked attacker node frequencies more closely than Hreward, without a tested protection gain.Figure 4 compares mean defended-node frequencies (top) and attacked-node frequencies (bottom) by stage; the allocation patterns are visual comparisons, not tests.Source: §4.4 · pp. 8–9, Figure 4 · p. 8
5 Discussion
The aggregate score obscures human defenders’ outcome-linked reselection and stage-dependent performance. The findings are bounded by a controlled game with a synthetic graph and Mechanical Turk participants.
5 Discussion
- Human defenders persist after successful defenses and avoid reselection after failures, unlike automated defenders; the asymmetry is interpreted as consistent with PT/CPT.The 40-round average also blends mostly random early attacker play with mostly exploiting late play.Source: §5 · p. 9
- In the final stage, mean protection ranks Hforecast > Hreward > Auto-CHT > Auto-DQN, but the ordering varies across stages.The final-stage ordering is descriptive, not an inferential human-versus-automation contrast.Source: §5 · p. 9
- The study uses one synthetic six-node graph, 40-round sessions, Mechanical Turk participants, and non-randomized task selection.Proposed next steps include professional defenders with randomized assignment, longitudinal sessions, and larger graphs based on real cloud configurations.Source: §5 · p. 9
6 Conclusion
This study compares human-playable versions of DQN and CHT–DQN information structures with matched automated defenders in a 40-round cyber-defense game. Human defenders show outcome-linked reselection absent in automated defenders, while the human-game comparison yields no statistically reliable overall protection gain.
6 Conclusion
- In the final stage, mean protection ranks Hforecast > Hreward > Auto-CHT > Auto-DQN, although the overall protection score does not tell the full story.The DQN attacker shifts from mostly random to mostly exploiting play, so the 40-round average hides stage-dependent ordering.Source: §6 · p. 9
- The reward-plus-transition game did not produce a statistically reliable overall protection gain over the reward-only game.The study cannot resolve whether the transition display yields a smaller protection improvement.Source: §6 · p. 9
- Human defenders show avoidance after failure and persistence after success, an asymmetry absent from automated defenders and consistent with PT/CPT.Source: §6 · p. 9
- The study is limited to one synthetic six-node graph, 40-round sessions, Mechanical Turk participants, and matched simulations rather than a deployed SOC.The authors frame the results as evidence from a controlled game, not a field claim about SOC operations.Source: §6 · p. 9
- Human-playable operationalizations of cognitively grounded RL models reveal temporal and behavioral patterns hidden by aggregate performance scores.Source: §6 · p. 9
A Implementation of the automated defenders
The appendix documents implementation choices for the automated defenders and the calculation of Eq. (3) when displayed in Hforecast. It records reproducibility details rather than a methods claim.
A Implementation of the automated defenders
- The appendix records the implementation used for Auto-CHT and Auto-DQN and to compute Eq. (3) when shown in Hforecast.It is provided for reproducibility, not as a methods claim.Source: A Implementation of the automated… · p. 12
- Both agents use DQNs with separate replay buffers; the CHT–DQN defender stores the attacker’s predicted action distribution for recomputation during learning.Attack-graph transition probabilities are re-estimated from observed exploitation frequencies, without an external vulnerability or APT dataset.Source: A Implementation of the automated… · p. 12
- The utilities trade asset value against action cost, crediting covered value and charging for exposed value for both defender and attacker.The implementation sets αD,i = αA,i = 10 and λD,i = λA,i = 1; node values and attacker estimates are sampled in [1, 10] with additive uniform noise.Source: A Implementation of the automated… · p. 12
- Both networks use three hidden layers (64, 128, 256), ReLU activations, discount γ=0.98, learning rate 5×10−2, and inverse temperature β=1.Figure 5 is the six-node graph used in human sessions and matched automated baselines.Source: A Implementation of the automated… · p. 12
- The 40-round sessions and longer offline suite use distinct training regimes; only the 40-round regime produced the quantities shown in Hforecast.The session regime uses batch size 5, while the offline suite uses batch size 64 and a 2000-step horizon.Source: A Implementation of the automated… · p. 12
B Offline simulation context
Appendix B provides a longer, fully automated simulation suite, not a substitute for the human sessions. Under matched attackers, CHT-based defenders outperform non-CHT counterparts once graph size reaches four nodes, while attacker type has the larger effect.
B Offline simulation context
- The suite is longer and fully automated, intended to show Auto-CHT as a learned opponent model rather than an untrained policy.It is explicitly not a substitute for the human sessions.Source: B Offline simulation context · pp. 12–13
- The offline suite varies graph size from N ∈[2, 10], runs 2,000 steps, and averages 10 random seeds across eight pairings.Exploitation probabilities are re-estimated every 100 steps; training covers steps 0–1000 and evaluation covers 1000–2000.Source: B Offline simulation context · p. 12
- For N ≥4, CHT-based defenders sit above non-CHT counterparts under matched attackers, while attacker type remains the larger separation between bands.The authors describe the CHT–DQN advantage as slight and say the simulation does not confirm the human-game results.Source: B Offline simulation context · pp. 12–13, Figure 6 · p. 13
C Human-subjects protocol, instructions, and compensation
The study compared two 40-round human games with distinct information displays, recruiting Mechanical Turk participants in two phases. Eighty completed sessions were analyzed, and assignment depended on the accepted task listing rather than individual randomization.
C Human-subjects protocol, instructions, and compensation
- Eighty of 83 recruited participants completed all 40 rounds; 40 participants were included in each human-game condition.Three incomplete sessions were excluded before analysis.Source: C Human-subjects protocol,… · pp. 13–14
- Recruitment used a 10-participant pilot and a 30-participant main wave per game, with assignment determined by the Mechanical Turk listing accepted.The two game listings ran concurrently, rather than using individual randomization.Source: C Human-subjects protocol,… · p. 14
- Participants defended one of six cloud-vulnerability nodes each round, then saw the attacker’s target and resulting reward or score.A node was protected if defended or not attacked, and compromised if attacked but undefended.Source: C Human-subjects protocol,… · p. 14
- The reward-plus-transition condition added CHT–DQN transition probabilities on graph edges; neither condition recommended a defensive action.Both conditions let participants make the final defensive choice each round.Source: C Human-subjects protocol,… · p. 14
- Participants received $3–$5 based on score; mean completion times were 377.9 seconds for reward-plus-transition and 459.9 seconds for reward-only.The paper estimates approximate hourly compensation of $23–$48, excluding Mechanical Turk overhead.Source: C Human-subjects protocol,… · p. 14
- Per-round logs recorded actions, rewards, estimated attacker policies, protection and cost quantities, and wall-clock time.The automated baselines used the same six-node graph and 40-round horizon.Source: C Human-subjects protocol,… · p. 14
NeurIPS Paper Checklist
The checklist presents the paper’s empirical claims as aligned with its scope and reports procedures for reproducibility, statistical analysis, human-subjects review, and limitations. It also identifies gaps, including the absence of itemized compute requirements and restricted access to raw human logs.
NeurIPS Paper Checklist
- The paper states that its abstract and introduction reflect its contribution and scope, with claims limited to the reported human-game and simulation findings.It disclaims a new algorithm, field SOC evidence, and a claim that AI assistance improves humans.Source: NeurIPS Paper Checklist · p. 15
- The paper identifies scope limits including MTurk participants, a six-node synthetic graph, non-randomized assignment, and 40 participants per human game.It distinguishes a game session from deployment or coevolution.Source: NeurIPS Paper Checklist · p. 15
- The paper reports sufficient experimental detail for reproducibility and releases code, simulation outputs, analysis scripts, and de-identified participant-level summary statistics.Raw human session logs are withheld under the IRB protocol; released assets are documented and use the MIT License.Source: NeurIPS Paper Checklist · pp. 16, 17, 20
- The paper reports SD over 40 participants or seeds, Welch tests, bootstrap confidence intervals, Hedges’ g, FDR correction, mixed-effects p-values, and paired Wilcoxon tests.It also states sample sizes and a d≥0.63 resolution bound.Source: NeurIPS Paper Checklist · p. 18
- The checklist marks compute-resource disclosure as incomplete because GPU-hours and total cluster compute are not itemized.The human sessions ran on an AWS t3.medium EC2 instance, and the DQNs are described as small CPU-scale models.Source: NeurIPS Paper Checklist · p. 18
- The human study received minimal-risk IRB approval and informed consent from participants.The checklist identifies Rutgers University IRB approval and an expedited review protocol.Source: NeurIPS Paper Checklist · pp. 18, 21
- The checklist reports no new external benchmark assets and says the attack graph is simulated.The cited DQN, CHT, and PT methods are credited in the bibliography.Source: NeurIPS Paper Checklist · p. 20
- The paper marks LLM declaration as not applicable because no LLM is part of the protocol or analysis.Source: NeurIPS Paper Checklist · p. 21