Bias-Informed Adaptive Defenses

• Bias-informed adaptive defenses are strategies that use explicit models of bias—such as prior probabilities and cognitive biases—to guide fine-grained, context-aware security adaptations.
• They employ probabilistic and decision-theoretic frameworks like Bayesian games and bounded exploration to optimize responses in component-level and system-wide defenses.
• Validated through metrics in cyber competitions, ML intrusion detection, and retrieval pipelines, these defenses show promise while facing challenges in dynamic adaptation and adversarial environments.

Bias-informed adaptive defenses are defense strategies that use an explicit model of bias to guide adaptation. Across recent work, the relevant “bias” may be a prior probability of component compromise, a cognitive bias in human attackers, a spurious correlation learned by a model, a structural bias against low-degree nodes, or a perspective bias induced in retrieved context. The common element is that defense is not treated as a static reaction to signatures alone: adaptation is driven by probabilistic beliefs, behavioral regularities, or measured distributional asymmetries that are already known to distort decisions or learning (Zhang, 2021, Carreira et al., 7 Oct 2025, Ennaji et al., 15 Dec 2025, Gao et al., 4 Mar 2026).

1. Conceptual scope and major meanings

One established meaning treats bias as prior belief under incomplete information. In component-level self-adaptive security, the system is modeled at the granularity of components, attacks are encoded as uncertainty over component types, and the probabilities of successful compromise $p_i$ act as priors that directly shape defensive strategy. This shifts adaptation from a monolithic system-level defender toward fine-grained, component-level decisions such as isolating or rerouting around high-risk components (Zhang, 2021).

A second meaning treats bias as predictable deviation from rational attacker behavior. Recent cyber-defensive work uses availability bias, sunk cost fallacy, loss aversion, confirmation bias, ambiguity aversion, base-rate neglect, and representativeness as exploitable regularities. In this view, defenses are designed around “triggers–sensors–defenses”: a defender deliberately presents stimuli that activate a bias, monitors behavior for a bias signature, and then deploys diversion, throttling, deception, or intensified monitoring (Carreira et al., 7 Oct 2025, Huang et al., 2024, Carney et al., 8 Dec 2025, Beltz et al., 27 Nov 2025).

A third meaning treats bias as a property of data, representations, or retrieval distributions. Here the defense objective is to repair or neutralize the bias itself: bounded exploration counteracts censoring and selective labels, cross-class augmentation removes attacker-induced co-occurrence bias, residual learning corrects biased observational priors, post-retrieval filtering removes perspective-skewed clusters, and graph augmentation compensates for structural bias on tail nodes (Yang et al., 2021, Liu et al., 2020, Gao et al., 4 Mar 2026, Wu et al., 30 Nov 2025, Fang et al., 29 Apr 2025). This suggests that “bias-informed” is not a single algorithmic family, but a design principle spanning cyber-physical systems, adversarial ML, causal experimental design, and LLM applications.

2. Probabilistic and decision-theoretic formulations

A canonical probabilistic formulation appears in component-level self-adaptive security. The system is modeled as $S=\langle C,A,Q\rangle$, attacks as $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$, and the attacked architecture is translated into a Bayesian game $B=\langle P,A,\Theta,U,\rho\rangle$. Each component becomes a player, vulnerable components have type space $$\Theta_i=\{\theta_i^{\text{N}},\theta_i^{\text{M}}\}$$, and the local prior is

$$\rho_i(\theta_i^{\text{M}})=p_i,\quad \rho_i(\theta_i^{\text{N}})=1-p_i.$$

The defense then optimizes expected utility under $\rho$, using pure-strategy Bayesian equilibria and Shapley-value decomposition of system utility. In the MAPE-K loop, the Planner transforms architecture plus attack information into the Bayesian game and uses Gambit to compute equilibria that maximize expected system utility (Zhang, 2021).

A closely related decision-theoretic pattern treats a biased model as a usable prior rather than a liability to be discarded. In Active Residual Learning, the causal estimand is written as

$\tau(x)=\tau_o(x)+\tau_\delta(x),$

where $\tau_o(x)$ is the observational contrast and $\tau_\delta(x)$ is the residual contrast that corrects observational bias. R-Design then allocates randomized experiments to reduce uncertainty in $S=\langle C,A,Q\rangle$0 rather than relearning the full outcome surface. The paper proves a structural efficiency gap and introduces R-EPIG, a criterion that targets the causal estimand directly by minimizing residual uncertainty for estimation or clarifying decision boundaries for policy (Gao et al., 4 Mar 2026). A similar bias-aware logic appears in sequential classification with censored feedback: “Adaptive Data Debiasing through Bounded Exploration” defines a bounded exploration band $S=\langle C,A,Q\rangle$1, proves that exploitation-only yields persistent overestimation, and shows that bounded exploration can make $S=\langle C,A,Q\rangle$2 under the stated assumptions (Yang et al., 2021).

These formulations share a common structure. A biased prior is first made explicit, then the adaptive mechanism is aimed at the residual uncertainty that matters for the task: compromise probabilities over hidden component types, residual causal bias, or truncation-induced distributional bias. This suggests that bias-informed defense is fundamentally a problem of selective information acquisition and selective intervention, rather than blanket conservatism.

3. Cognitive-bias exploitation and attacker-state inference

Empirical evidence for cognitive-bias-informed defense is strongest in cyber-competition and red-team settings. In picoCTF, a study of 26,716 unique participants, 525,771 submissions, and 378 challenges identified behavioral signatures of availability bias and the sunk cost fallacy. Availability bias was operationalized as “misformatted-but-core-correct” submissions, and 165 of 378 challenges had at least one such submission; the median misformatting ratio was approximately 0.63% and the mean approximately 2%. Sunk cost was operationalized through repeated attempts despite declining success probability: 48.5% of submissions succeeded on the first attempt, while the mixed-effects logistic model estimated $S=\langle C,A,Q\rangle$3, with $S=\langle C,A,Q\rangle$4, meaning each additional failure approximately halved the odds of success on later attempts (Carreira et al., 7 Oct 2025). On that basis, the paper proposed a “triggers–sensors–defenses” framework in which non-standard formatting requirements or sticky decoys become triggers, repeated near-misses or persistent low-payoff probing become sensors, and throttling, logging, redirection, or deception become adaptive responses.

PsybORG$S=\langle C,A,Q\rangle$5 provides a more explicit attacker-modeling substrate. It encodes loss aversion through a prospect-theoretic subjective utility, confirmation bias through a confirming-evidence rate $S=\langle C,A,Q\rangle$6, and sunk cost through target selection

$S=\langle C,A,Q\rangle$7

A Bayesian inference procedure achieved 0.965 accuracy for bias state $S=\langle C,A,Q\rangle$8 on synthetic data for loss aversion and confirmation bias, while a decision-tree classifier reported 0.95 accuracy for loss aversion, 0.99 for confirmation bias, and 0.83 for sunk cost fallacy (Huang et al., 2024). GAMBiT extends this logic from simulation to human-subject experimentation: across three rounds with total $S=\langle C,A,Q\rangle$9, cognitive triggers significantly reduced mission progress, diverted actions off the true attack path, and increased detectability. In one analysis, the proportion of commands on the 13 critical VMs was 67.823% in the control condition and 49.501% in the trigger condition, with a main effect of Group $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$0, $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$1 (Beltz et al., 27 Nov 2025).

Ambiguity aversion adds another cognitive dimension. In GAMBIT red-team data, a PsychSim-based model operating on 1,583 actions from 29 participants inferred a mean ambiguity-aversion trait probability of $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$2, with 15.0% of probabilities above 0.5. The tactic-level pattern was distinctive: ambiguity aversion was highest for Discovery, whereas loss aversion was highest for Lateral Movement (Carney et al., 8 Dec 2025). In Stackelberg security games, a different cognitively grounded route uses Instance-Based Learning Theory and Theory of Mind. There, a ToM+IBL defender reduced attacker payoff to approximately 0.3 against an IBL attacker, whereas a ToM attacker against an IBL defender reached approximately 0.8, and transfer of learning between attack and defense roles improved performance in the new role (Malloy et al., 2023). A CTF case study on representativeness reached a parallel conclusion: one representativeness challenge significantly thwarted attackers away from vulnerable attack vectors and onto non-vulnerable paths (Hitaj et al., 28 Apr 2025).

4. Runtime adaptation against behavioral and prompt-based adversaries

Behavior-aware runtime adaptation can also be implemented without modeling attacker cognition explicitly. “Adaptive Feature Poisoning” for ML-based intrusion detection systems maintains baseline windows of traffic features $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$3 and side-channel signals $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$4, uses change-point detection on $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$5, identifies a set of deviated features $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$6, and perturbs selected features according to

$ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$7

The perturbation is therefore dynamic and context aware: persistent deviation on a feature increases its poisoning magnitude. On CSE-CIC-IDS2018, selectively triggered AFP preserved overall accuracy at 0.9925, benign recall at 1.00, and attack recall at 0.97, while AFP was triggered for only 100 flows out of 1,314,720 (Ennaji et al., 15 Dec 2025). This suggests a different form of bias-informed defense: rather than exploiting human cognitive bias, the defender exploits the attacker’s feature-selection bias in black-box probing.

Prompt-injection studies sharpen the architectural lesson. One large-scale evaluation built an adaptive attacker that evolved strategies over hundreds of rounds and tested nine defense configurations across more than 20,000 attacks. Every defense that relied on the model to protect itself eventually broke, whereas output filtering in separate application code achieved zero leaks across 15,000 attacks (Deep et al., 26 Apr 2026). A related study evaluated eight defenses against indirect prompt injection in LLM agents and bypassed all of them with adaptive attacks, consistently achieving an attack success rate of over 50% (Zhan et al., 27 Feb 2025). In both cases, the failure mode was not merely weak prompting; it was the brittleness of model-internal defenses under adaptive pressure. A plausible implication is that runtime bias-informed defense for LLM agents must place the root of trust outside the attacked model and use adaptive monitoring only to strengthen external enforcement, not to replace it.

5. Bias-aware defenses in learning systems, retrieval pipelines, and graph models

In adversarial ML, one branch of work treats attacker-induced bias as a spurious conditional dependence in the training data. “Bias Busters” studies backdooring in lithographic hotspot detection and reframes the backdoor as an intentional bias $ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$8 linking a trigger to the non-hotspot label. Its trigger-oblivious cross-class augmentation introduces trigger-bearing examples in both classes and reduces attack success rate from 84% to approximately 0% (Liu et al., 2020). BLADE addresses a different but related problem: implicit biases and spurious correlations in fully biased datasets without prior knowledge of the bias or access to bias-conflicting samples. It uses a generative model for bias-domain translation, adaptive refinement based on bias-conflicting severity, alignment with bias-translated counterparts, and regularization against same-bias clustering. On corrupted CIFAR-10 under the worst group setting, it exceeds the closest baseline by an absolute margin of around 18% (Arora et al., 5 Oct 2025).

In retrieval-augmented generation, the bias object is the ideological distribution of retrieved passages. Bias injection attacks insert factually correct yet semantically biased passages so that top-$ATT=\langle C_{att},A_{att},P_{att},R_{att}\rangle$9 retrieval becomes dominated by one pole of a polarization axis. BiasDef responds with post-retrieval filtering that estimates a per-query polarization axis, searches for a similarity threshold with maximal KL separation, and prunes the high-similarity biased cluster. The reported results are distributional rather than instance-local: BiasDef reduces adversarial passages retrieved by 15%, mitigates perspective shift by 6.2$B=\langle P,A,\Theta,U,\rho\rangle$0 in answers, and enables the retrieval of 62% more benign passages (Wu et al., 30 Nov 2025). This is a precise example of a bias-informed defense in which the target of adaptation is the joint relevance–perspective distribution rather than factual error.

Graph adversarial defense exposes another bias surface: degree-based structural bias. Existing defenses such as Jaccard and SVD improve global robustness but remain systematically weaker on low-degree tail nodes. De2GNN addresses this by combining hetero-homo augmented graph construction, $B=\langle P,A,\Theta,U,\rho\rangle$1NN augmented graph construction, and a multi-view node-wise attention module. The hetero-homo view globally removes heterophilic links and adds homophilic links for nodes with low degree, while node-wise attention adaptively weights the hetero-homo and $B=\langle P,A,\Theta,U,\rho\rangle$2NN views. Under 25% Metattack, De2GNN improved both all-node and tail-node accuracy and substantially reduced the robustness gap between them (Fang et al., 29 Apr 2025). Taken together with bounded exploration for censored feedback (Yang et al., 2021), these results indicate that bias-informed adaptive defense often operates by repairing the structure through which information flows: training distributions, neighborhood graphs, or retrieved context sets.

6. Evaluation practices, limitations, and open problems

A recurring limitation is that the usefulness of the defense depends on the usefulness of its bias model. In component-level Bayesian defense, wrong compromise probabilities $B=\langle P,A,\Theta,U,\rho\rangle$3 miscalibrate adaptation, and the current framework does not specify an explicit Bayesian update rule for continuously adjusting $B=\langle P,A,\Theta,U,\rho\rangle$4 from observations (Zhang, 2021). In ambiguity-aversion modeling, there is no direct ground-truth label for ambiguity aversion, the model parameters are exploratory, and validation is presently limited to consistency with theoretical expectations and comparison to a loss-aversion model (Carney et al., 8 Dec 2025). PsybORG$B=\langle P,A,\Theta,U,\rho\rangle$5 likewise reports that sunk cost is less well modeled than loss aversion and confirmation bias: classification accuracy is 0.83 and synthetic-data quality for file cracking remains weak (Huang et al., 2024).

Another limitation is ecological and population validity. picoCTF logs are large and naturalistic, but the participants are mostly students, and the data capture submissions and timestamps rather than the full cognitive process (Carreira et al., 7 Oct 2025). GAMBiT demonstrates significant behavioral disruption in a simulated small-business network, yet its adaptive loop is still mainly conceptual: the architecture includes cognitive triggers, an ASM, a CogVuln sensor, and a PsychSim Theory-of-Mind defender, but the experiments use static pre-embedded triggers rather than fully autonomous real-time adaptation (Beltz et al., 27 Nov 2025). This suggests that the field is already rich in sensing and modeling components, but end-to-end closed-loop deployment remains comparatively immature.

A third limitation is adversarial adaptation. Both prompt-injection studies show that defenses can look adequate under short or non-adaptive evaluation and then fail under sustained adaptive pressure (Deep et al., 26 Apr 2026, Zhan et al., 27 Feb 2025). The same concern plausibly extends to any defense that relies on superficial regularities, static thresholds, or bias models estimated once and then frozen. Future directions stated in the literature follow directly from that diagnosis: automated game construction from architecture descriptions such as Acme and application to SWaT or ICS-BlockOpS (Zhang, 2021); controlled manipulations in CTF platforms to isolate causal effects of biases and extend the set of studied biases (Carreira et al., 7 Oct 2025); defender-side optimization in PsybORG$B=\langle P,A,\Theta,U,\rho\rangle$6 as an MDP or POMDP over beliefs $B=\langle P,A,\Theta,U,\rho\rangle$7 (Huang et al., 2024); richer cognitive sensors and real-time trigger selection in GAMBiT (Beltz et al., 27 Nov 2025); and broader defense-in-depth combinations for RAG, IDS, and LLM-agent systems (Wu et al., 30 Nov 2025, Ennaji et al., 15 Dec 2025, Deep et al., 26 Apr 2026).

Across these lines of work, a durable pattern emerges. Bias-informed adaptive defenses are strongest when they make the bias explicit, target the residual uncertainty or exploitable regularity that the bias creates, and place adaptation at a layer that the attacker cannot trivially repurpose. Where defenses instead rely on the attacked model’s own behavior to remain stable, or on unexamined proxies such as fluency, delimiters, or static pattern matching, adaptive attackers eventually turn those assumptions into an attack surface.