Cat-and-Mouse Chain Dynamics

• Cat-and-Mouse Chain is a concept describing iterative asymmetric interactions where one agent continually pursues or adapts to another across diverse domains.
• It is modeled in graph theory with deterministic strategies achieving O(√n) localization, in stochastic processes with meeting-time driven updates, and in AI with generator–detector arms races.
• Open problems persist in optimizing detection strategies, refining mathematical bounds, and designing robust countermeasures across theoretical, computational, and biological frameworks.

Searching arXiv for papers related to “Cat-and-Mouse Chain” and closely related formulations. “Cat-and-Mouse Chain” is used in several technically distinct literatures to denote a sequential interaction in which one process pursues, localizes, exploits, or adapts to another under asymmetric information or asymmetric capability. In graph theory it denotes pursuit–evasion and localisation processes on graphs; in stochastic-process theory it denotes hierarchical Markov chains in which lower-level components move only at meeting times; in AI safety, media forensics, and cybersecurity it denotes iterative generator–detector or attacker–defender adaptation; and in biology it denotes trophic or host-transition mechanisms involving mice and cats as coupled agents in a larger system (Guggiari et al., 2018, Prasolov et al., 2018, McGlinchey et al., 26 Jun 2025, Laurier et al., 2024, Sato et al., 29 Jul 2025, Ingram et al., 2013, Tao et al., 2020).

1. Scope of the term

The expression appears across domains with different formal meanings but a shared sequential structure: one side updates in response to the other, and the resulting interaction unfolds as a chain rather than a single static confrontation.

Domain	Core chain	Representative source
Graph pursuit	Cat tests vertices while mouse moves on a graph	(Guggiari et al., 2018)
Markov chains	Cat moves every step; mouse moves only when cat and mouse meet	(Prasolov et al., 2018)
Fake-text detection	LLM generators improve deceptiveness while classifiers adapt	(McGlinchey et al., 26 Jun 2025)
Diffusion forensics	Diffusion generators and detectors form a repeated min–max game	(Laurier et al., 2024)
Phishing simulation	LLM-generated attacks evolve against adaptive victim knowledge	(Sato et al., 29 Jul 2025)
Ecology and epidemiology	Mouse–cat interactions mediate parasite or virus transmission hypotheses	(Ingram et al., 2013, Tao et al., 2020)

A useful unifying feature is that the “chain” is not merely a binary opposition. It is a temporally extended dependence structure: the next state of the cat depends on previous observations or adaptations, and the next state of the mouse depends on the current configuration, constraints, or environment. This suggests that the term functions as a cross-domain label for iterative asymmetric interaction rather than a single standardized model.

2. Pursuit, evasion, and localisation on graphs

In the graph-theoretic formulation of the relative-distance cat-and-mouse game, the arena is a simple, undirected, connected graph $G=(V,E)$ on $n$ vertices. The mouse produces a trajectory $m_1,m_2,\dots$ with $m_i\in N[m_{i-1}]$ for $i\ge 2$, where $N[v]$ is the closed neighbourhood. The cat chooses any test vertex $c_i\in V$ at each time, with no movement restriction, and after time $i\ge 2$ receives only the bit

$$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$

From the history it computes the feasible mouse set $M_i$, and localisation quality is measured by

$n$0

The main theorem states that on every connected $n$1-vertex graph the cat has a deterministic strategy guaranteeing that at some time $n$2 it attains $n$3; moreover, for infinitely many $n$4 there is a tree $n$5 such that no cat strategy ever achieves $n$6 for some constant $n$7. In particular, this disproves the conjecture that $n$8 localisation is always possible (Guggiari et al., 2018).

The upper bound is obtained by a maximal packing argument. Choosing $n$9, one finds a maximal set of centres $m_1,m_2,\dots$0 with pairwise distances greater than $m_1,m_2,\dots$1, so that $m_1,m_2,\dots$2 and the balls $m_1,m_2,\dots$3 cover $m_1,m_2,\dots$4. The cat then runs a “knock-out tournament” on these centres: it keeps a current champion index $m_1,m_2,\dots$5, tests the current champion against the next centre, and updates $m_1,m_2,\dots$6 according to the received comparison bit. After $m_1,m_2,\dots$7 tests, the champion $m_1,m_2,\dots$8 satisfies

$m_1,m_2,\dots$9

hence $m_i\in N[m_{i-1}]$0. The lower bound uses a subdivided-star tree: for $m_i\in N[m_{i-1}]$1 a multiple of $m_i\in N[m_{i-1}]$2, one subdivides each edge of a star with $m_i\in N[m_{i-1}]$3 leaves into $m_i\in N[m_{i-1}]$4 segments, obtaining $m_i\in N[m_{i-1}]$5. By staying on a branch that the cat will not test soon, the mouse ensures that the feedback remains consistent with two positions at distance greater than $m_i\in N[m_{i-1}]$6 apart, so that $m_i\in N[m_{i-1}]$7 is impossible (Guggiari et al., 2018).

Related pursuit models sharpen the role of feedback. In the invisible-mouse teleporting-cat game on trees, $m_i\in N[m_{i-1}]$8 cats can always catch a mouse on a tree of order $m_i\in N[m_{i-1}]$9, while there exists a collection of trees where the mouse can avoid being caught by $i\ge 2$0 cats (Gruslys et al., 2015). In a partial-distance variant, the cat has a winning strategy if and only if $i\ge 2$1 is a forest (Rautenbach et al., 2017). On a path, the specialized analyses in these sources yield sharply different operational regimes depending on the feedback model: a one-cat bisection strategy gives $i\ge 2$2 capture time in the invisible-mouse path setting, whereas the noisy-distance path strategy is linear-time, with $i\ge 2$3 and a matching $i\ge 2$4 lower bound (Gruslys et al., 2015, Rautenbach et al., 2017).

3. Cat-and-Mouse chains as stochastic processes

In stochastic-process theory, the Cat-and-Mouse chain is a two-component Markov chain on $i\ge 2$5 whose first coordinate $i\ge 2$6 is the cat and second coordinate $i\ge 2$7 is the mouse. Given an irreducible transition kernel $i\ge 2$8, the cat evolves as $i\ge 2$9 independently of history; the mouse stays put when $N[v]$0, and when $N[v]$1 it jumps according to a $N[v]$2-distributed step independent of $N[v]$3. Thus the mouse only moves at meeting times (Prasolov et al., 2018).

The principal scaling limit concerns the rescaled continuous-time mouse path $N[v]$4. When the cat is a simple symmetric random walk, the mouse jumps $N[v]$5 have finite first moment, and $N[v]$6 lies in the domain of attraction of a strictly $N[v]$7-stable law, the meeting times

$N[v]$8

satisfy $N[v]$9, where $c_i\in V$0 is a positive $c_i\in V$1-stable law. If $c_i\in V$2 is the inverse subordinator, then

$c_i\in V$3

when $c_i\in V$4, and

$c_i\in V$5

when $c_i\in V$6. The mechanism is a composition of stable jump fluctuations with heavy-tailed waiting times between meetings (Prasolov et al., 2018).

The same qualitative structure persists under more general assumptions. If the cat increments are zero-mean, finite-variance, and strongly aperiodic, and the mouse increments are zero-mean and finite-variance, then the same statements hold with $c_i\in V$7, producing the characteristic $c_i\in V$8 spatial scaling in the $c_i\in V$9 case. The recurrence tail of the cat drives the waiting-time exponent, while the mouse jump law controls the spatial limit (Prasolov et al., 2018).

The model also extends to higher-dimensional hierarchies. In the Dog-Cat-Mouse chain, the dog drives the cat exactly as the cat drives the mouse. If

$i\ge 2$0

then $i\ge 2$1 and $i\ge 2$2, a $i\ge 2$3-stable law. The mouse satisfies

$i\ge 2$4

where $i\ge 2$5 is standard Brownian motion and $i\ge 2$6 is the inverse $i\ge 2$7-stable subordinator. For an $i\ge 2$8-component linear hierarchy $i\ge 2$9, one obtains the fixed-time scaling $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$0. This makes the “chain” literal: each extra layer compounds the slowdown through nested meeting-time processes (Prasolov et al., 2018).

4. Generator–detector and attacker–defender chains in AI

In current AI literature, “Cat-and-Mouse Chain” often denotes an adversarial adaptation loop rather than a literal cat or mouse. In fake-text detection, the interaction is framed as an “arms race” between text generators and detectors. One study evaluates successive GPT and Gemini versions on rewritten Agatha Christie excerpts of approximately 100 words, using balanced datasets of 1,000 to 1,735 samples per model with an 80/20 train/test split. Four off-the-shelf classifiers—Random Forest with 100 trees, SVM with RBF kernel and $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$1, a one-hidden-layer MLP with 100 neurons and ReLU, and Multinomial Naïve Bayes with Laplace smoothing $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$2—were trained on word uni-/bi-grams, character 3-/4-grams, shallow stylometric features, and small-GPT-2 perplexity. Detector accuracies for GPT-3.5-turbo, GPT-4o-mini, and GPT-4.1 lie between approximately $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$3 and $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$4; GPT-4o-mini is the easiest to detect, with MLP accuracy approximately $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$5; GPT-4.1 shows no meaningful decrease in detectability relative to GPT-3.5, with accuracy difference below $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$6. By contrast, Gemini-1.5-flash yields approximately $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$7–$$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$8 detection accuracy with deception rate $$b_i = \begin{cases} 1 & \text{if } d(c_i,m_i)\le d(c_{i-1},m_{i-1}),\ 0 & \text{otherwise.} \end{cases}$$9–$M_i$0, whereas Gemini-2.0-flash drops to approximately $M_i$1–$M_i$2 accuracy with deception rate $M_i$3–$M_i$4, and the inter-version drop is reported as significant by paired McNemar test with $M_i$5 (McGlinchey et al., 26 Jun 2025).

The same chain appears in diffusion-model forensics, but there the interaction is made explicit as a repeated zero-sum game. A canonical objective is

$M_i$6

with iterative updates of detector and generator parameters. The review distinguishes frequency-domain, spatial-domain, deep-learning, and hybrid detectors, and catalogs benchmarking resources including GenImage (approximately 1M real–fake pairs), COCOFake (1.2M text-to-image samples plus captions), DiFF (500K face forgeries from 13 generative methods), and WildFake. It reports that early Fourier-based detectors reached approximately $M_i$7 accuracy on Stable Diffusion v1.4, that CLIP-ViT and multi-scale fusion raised this to approximately $M_i$8 on the same split, and that new noise schedules later reduced the same detectors to approximately $M_i$9, prompting more elaborate spatial–frequency hybrids. Practical forensic interventions include Tree-Ring Watermarks with $n$00 detection under $n$01 crop and JPEG compression, Stable Signature with detection above $n$02, and prompt–image inconsistency detection with $n$03 recall at $n$04 false-positive rate (Laurier et al., 2024).

Across both settings, the chain is an adaptive loop in which one side targets statistical residues left by the other. A plausible implication is that the term identifies a regime of continual countermeasure turnover: surface artifacts support simple detectors, architectural changes erase those artifacts, and detector design then shifts toward richer feature spaces or multimodal evidence.

5. Self-evolving phishing chains

A distinct cybersecurity usage models the cat-and-mouse dynamic directly as co-evolution between phishing strategies and victim awareness. The framework couples LLaMA 3.1 with a genetic algorithm. An individual strategy $n$05 is a natural-language prompt of at most 50 words. For each strategy, the LLM generates $n$06 phishing messages; the same LLM, placed in a victim role with prior-knowledge parameter $n$07, scores each message with $n$08; the strategy’s average visit likelihood is

$n$09

and the fitness is

$n$10

Roulette-wheel selection, elitism, crossover, and mutation then generate the next population. Mutation injects a randomly selected psychological principle from a list of 250 cognitive biases and theories, and every $n$11 generations the victim’s prior knowledge may be updated from the top-$n$12 messages observed so far, producing an explicit co-evolutionary loop (Sato et al., 29 Jul 2025).

The reported dynamics depend on how much the victim learns. Without victim learning, average visit likelihood rises monotonically from about $n$13 at epoch 1 to approximately $n$14 at epoch 30. With static awareness guidance, the curve still trends upward. Against a victim supplied with a detailed list of 16 psychological techniques, click rate first drops and then climbs as attackers discover subtler persuasive strategies. In the full co-evolution setting, updating $n$15 every epoch yields an oscillatory pattern: epochs 1–2 show a sharp drop as the victim learns obvious techniques; epochs 3–16 show renewed attacker diversification and rising click rates; epoch 17 exhibits a second dip; and from epoch 24 onward the attacker surges ahead again. Simultaneously, cosine distance between successive strategy embeddings grows, whereas victim-knowledge embeddings converge (Sato et al., 29 Jul 2025).

The explicit conclusion is an asymmetry: attackers require only one high-success vector, whereas defenders must cover all evolving threats. This is not a metaphorical flourish but a structural property of the search spaces induced by the GA+LLM design. The framework therefore uses “Cat-and-Mouse Chain” to denote an adaptive sequence in which offensive policy search remains expansive while defensive guidance tends to collapse into generic rules (Sato et al., 29 Jul 2025).

6. Biological and epidemiological chains

In biology, the cat-and-mouse chain can denote a trophic manipulation pathway. In murine toxoplasmosis, infection with any of the three major North American clonal lineages of Toxoplasma gondii is reported to cause loss of innate aversion to cat urine, and for the attenuated Type I parasite this persists even when neither parasite nor ongoing brain inflammation are detectable. In the open-field assay, uninfected controls exposed to bobcat urine show mean $n$16 at 3 weeks post-infection, whereas Type I–infected and Type III–infected groups are approximately $n$17 and $n$18, respectively, with no statistically significant difference between the two infected groups and one-way ANOVA $n$19 versus uninfected. Rabbit urine produces no place preference in any group, and the hidden-cookie test shows intact olfaction with latencies around $n$20 s and $n$21. Type III infection retains chronic parasite load and elevated leukocyte counts, but Type I becomes undetectable in the central nervous system while the behavioural phenotype persists. The authors therefore argue against models requiring long-term cyst maintenance or sustained neuroinflammation, and propose an early acute-phase mechanism involving parasite effector proteins that permanently rewires predator-odor processing pathways (Ingram et al., 2013).

In epidemiology, the expression is used more explicitly as a transmission hypothesis. A host-genome similarity framework compares 399 complete SARS-CoV-2 genomes against ten candidate hosts. For each viral ORF of length $n$22, with BLASTn raw score $n$23 and Karlin–Altschul parameters $n$24 and $n$25, the bit score is

$n$26

and the ORF-level host-genome similarity is defined from $n$27 as

$n$28

Genome-wide similarity is the ORF-length-weighted sum. The reported mean genome-wide HGS ranking is bat $n$29, mouse $n$30, cat $n$31, then swine, snake, dog, pangolin, chicken, human, and monkey. On that basis the authors propose a possible chain bat $n$32 mouse $n$33 cat $n$34 human, with bat $n$35 mouse $n$36 human as an alternative simpler chain. They emphasize, however, that HGS does not measure receptor binding affinity, tissue tropism, or in vivo replication kinetics, and that no direct infection assays in wild-type mice or market cats were presented (Tao et al., 2020).

These biological usages differ sharply in evidential status. The T. gondii study reports a behavioural effect measured experimentally in mice; the SARS-CoV-2 “Cat-and-Mouse Chain” is a conjectural host-transition pathway derived from sequence-similarity ranking plus market ecology. The shared term reflects sequential mediation by mouse–cat interactions, but the underlying inferential bases are not equivalent (Ingram et al., 2013, Tao et al., 2020).

7. Common structure, misconceptions, and open problems

A common misconception is that “Cat-and-Mouse Chain” refers to a single canonical formalism. The literature instead contains at least three non-equivalent families: graph pursuit models with adversarial motion and sparse feedback, stochastic chains with meeting-time-driven updates, and adaptive adversarial loops in AI and cybersecurity. Biological uses add a fourth family in which the chain denotes trophic or host-transition mediation rather than formal pursuit (Guggiari et al., 2018, Prasolov et al., 2018, Laurier et al., 2024, Sato et al., 29 Jul 2025, Ingram et al., 2013, Tao et al., 2020).

Another misconception is that more information or more model scale necessarily collapses the chain. The graph-localisation result shows that relative distance feedback still leaves a worst-case $n$37 localisation radius, disproving an $n$38 conjecture (Guggiari et al., 2018). In fake-text detection, a roughly $n$39 parameter increase from GPT 3.5 to GPT 4 is associated with almost unchanged detectability, whereas Gemini’s architectural changes materially alter deception rates (McGlinchey et al., 26 Jun 2025). In phishing, defender learning can produce temporary dips but not stable dominance because the attacker’s strategy space continues to diversify (Sato et al., 29 Jul 2025). In diffusion detection, gains by one side are repeatedly offset by architectural and training changes on the other side (Laurier et al., 2024).

Open problems follow the same domain-specific pattern. For graph pursuit, one can ask for finer bounds on special graph classes such as planar graphs and expanders, or for the number of independent cats needed to pinpoint the mouse exactly (Guggiari et al., 2018). For stochastic chains, the $n$40-component hierarchy admits fixed-time limits, but a full functional limit is described as hard (Prasolov et al., 2018). For AI forensics, the stated gaps concern unseen generator architectures, social-media degradations, multimodal defenses, standardized evolving benchmarks, adversarial training, and explainability (Laurier et al., 2024). For fake-text detection, cross-architecture evaluations and continual detector updating are identified as crucial (McGlinchey et al., 26 Jun 2025). For phishing, the practical direction is proactive co-evolution of training, system-level controls, and AI-driven monitoring (Sato et al., 29 Jul 2025). For the SARS-CoV-2 host-transition hypothesis, the required validation includes controlled infection experiments, ACE2 binding studies, and serological surveys of market-associated rodents and cats (Tao et al., 2020).

Taken together, these literatures suggest that a cat-and-mouse chain is best understood as an iterated asymmetric process in which one side’s local move changes the feasible set, effective dynamics, or adaptive landscape of the other. The exact mathematics varies—from graph radius bounds, stable subordinators, and genetic-algorithm fitness functions to HGS scores and behavioural assays—but the central analytic theme is the same: sequential dependence under incomplete symmetry.