The Oracle's Gambit: A Game-Theoretic Framework for Responsible AI Release

Abstract: Responsible vulnerability disclosure can secure the defender's head start by controlling when a vulnerability becomes public. However, this status quo is now challenged by increases in capability of AI models, which benefits both defenders and adversaries. When both sides draw their capability from the same AI model, the defender's head start depends on the lab's decision to release the model, and the question becomes not whether to release but how. Existing safety frameworks govern only the deploy-or-withhold threshold and leave the timing of release unmodeled. We cast this decision as a bilevel Stackelberg game in which a lab commits to a window that sets each side's capability over time in a downstream contest between defender and adversary. Defender welfare turns on the capability gap, not the shared level. Handing one model to both sides can trap the defender in a Red Queen's race, whereas a pre-release to the defender alone creates a protective gap, and the lab's optimal window balances this welfare gain against the opportunity cost of delaying release. For dual-use models, the lever is the sequencing of access, not the deployment threshold.

• The paper formalizes responsible AI release as a three-player, bilevel Stackelberg game where pre-release windows create a strategic capability gap.
• It employs Monte Carlo simulations and global sensitivity analysis to show that asymmetric access optimally enhances defender welfare in 80–95% of scenarios.
• Empirical findings indicate that sequential access, rather than simultaneous release, significantly reduces attack success by leveraging temporary defensive advantages.

A Game-Theoretic Framework for Responsible AI Release: The Oracle’s Gambit

Introduction and Motivation

Rapid advances in foundational AI models have disrupted established norms for responsible vulnerability disclosure in software security. Historically, responsible disclosure enabled defenders to patch vulnerabilities before adversaries could exploit them, leveraging pipeline asymmetry and an information gap to create a window of protection. The advent of highly capable, dual-use AI models—capable of both offensive and defensive cybersecurity tasks—renders this paradigm obsolete: the same model, if released to both sides, can erode the defender's advantage, accelerating adversarial discovery and weaponization (2607.05442).

The “Oracle’s Gambit” formalizes this new regime as a three-player, bilevel Stackelberg security game, in which a frontier AI lab—distinct from defender and adversary—acts as a strategic leader by committing to a release policy. This policy sequences access to new model capabilities, which parameterize a downstream zero-sum stochastic game between defender and adversary. The lab trades off defender welfare, now contingent on the induced capability gap, against the opportunity costs of delaying public release. The central theoretical and empirical assertion is that defender welfare is driven not by the absolute level of shared AI capability, but by the relative gap—created only by temporally sequencing access to new models.

Game-Theoretic Model

In contrast to previous two-player settings, the framework explicitly distinguishes three roles: the AI lab (leader), defender, and adversary. The lab chooses a release policy, parameterized as a window $W$, which introduces a controlled temporary capability gap:

• Public release ($W=0$): both parties receive the new model synchronously—minimizing gap.
• Pre-release ($W>0$): defender receives new capabilities $W$ rounds before adversary, maximizing transient gap.
• Embargo: new model withheld from both; both locked to previous capability.

The capability profile of each side is a five-dimensional vector governing pipeline transitions: vulnerability detection, exploit generation, reverse engineering, patch generation, and patch testing. The stochastic game between defender and adversary models the asymmetric offensive/defensive lifecycles, with per-round advancement in pipeline stages determined by the current capability rate Figure 1.

Figure 1: Overview of the bilevel game. The AI lab (leader) commits to a release policy, setting defender/adversary capabilities, which parameterize a stochastic adversary-defender subgame.

Empirically, the defender must traverse a longer pipeline (detection $\to$ patching $\to$ fleet adoption), while the adversary can either independently weaponize a vulnerability or exploit “patch diffing” (reverse engineering shipped patches), yielding a persistent structural asymmetry favoring adversary speed.

Calibration Methodology and Sensitivity Analysis

Realistic calibration of model parameters is critical. Environmental quantities (e.g., patch adoption rate $\rho$) are fixed from industry data; model-specific per-stage capabilities must be elicited. A custom LLM-Delphi panel is utilized, with five expert personas iteratively estimating per-round Bernoulli transition rates, given the latest evidence from offensive/defensive benchmarks and evaluation reports.

The analysis leverages global sensitivity methods (Morris elementary effects) across offensive and defensive outcomes. Defensive rates ($\kappa^{\mathrm{pgen}}, \kappa^{\mathrm{ptest}}$) and adversarial exploit generation ($\kappa^{\mathrm{egen}}$) dominate outcome sensitivity, aligning with core threat models Figure 2.

Figure 2: Global capability sensitivity analysis. Defensive rates and exploit generation are principal drivers of welfare and attack success.

Patch diffing emerges as a significant post-ship risk factor, especially where fleet remediation is slow Figure 3.

Figure 3: Patch-diffing share as a function of patch adoption and adversarial exploitability, highlighting the threat of reverse engineering shipped patches.

Main Results: The Primacy of the Capability Gap

Sequential evaluation across major model transitions (GPT-4o, o4-mini, Opus 4.5, Opus 4.6, Mythos Preview) yields two central findings:

1. Symmetric capability scaling (both parties receive new model): defender welfare does not improve—and may worsen—despite more advanced tools, due to symmetric acceleration of attack/defense. Attack frequency consistently rises (Figure 5a).
2. Pre-release windows (asymmetric access): defender welfare is reliably and substantially improved by temporal sequencing, opening a gap during which the defender can patch before the adversary upgrades, reducing attack success and loss (Figure 5b).

Figure 4: Defender welfare responds to the capability gap, not the absolute level. Public release offers no net welfare gain, whereas pre-release windows produce significant benefits for defense.

Monte Carlo simulation, propagating panel uncertainty, confirms the robustness of the Stackelberg-optimal policy: for all model transitions, pre-release is optimal in 80–95% of draws. For instance, during the pivotal Opus 4.6 $\to$ Mythos transition, the model recommends a median 12–24 round pre-release (~84–168 days), matching the timing of real-world programs such as Anthropic’s Project Glasswing.

Implications and Extensions

The theoretical and empirical results highlight the inadequacy of current threshold-based safety policies, which focus on deployment or withholding but not on sequencing access. In the dual-use context, optimal risk mitigation is achieved via carefully calibrated pre-release windows that create and exploit capability gaps, rather than blanket embargoes or universal release. This lever can significantly reduce attacks, contingent on accurate measurement of cost-of-delay and on the willingness of labs to factor societal benefits into private payoff Figure 5.

Figure 5: Lab payoff and welfare as functions of release windows, with an interior optimum for pre-release. The optimal window length depends on balancing welfare gain and opportunity cost.

The framework’s structure generalizes to richer settings: repeated releases, heterogeneous defenders, market competition between labs, or the addition of “soft” release mechanisms such as throttling or guardrails. Further, aligning the lab’s incentive with societal optima suggests future directions in policy and mechanism design.

Conclusion

The model formalizes AI release as a bilevel strategic game, providing quantitative support for graduated, gap-maximizing release policies. Defender welfare in the AI era is governed by the existence and magnitude of a capability gap, not by the absolute level of model capabilities—public or embargoed. Sequential access, not hard thresholds, is the principal mechanism for defensive advantage. This paradigm should inform future norms, regulation, and mechanisms for the release of dual-use AI systems.