Deceptive Risk Minimization

• Deceptive Risk Minimization is a framework that explicitly optimizes model representations to ‘deceive’ statistical detectors, improving robustness against out-of-distribution shifts.
• It employs differentiable surrogates such as soft-ranking and conformal martingales to penalize non-iid patterns without relying on explicit domain labels.
• Variations of DRM extend to risk scoring for manipulative digital patterns and sequential decision-making, emphasizing observer-relative deception in diverse settings.

Searching arXiv for papers relevant to “Deceptive Risk Minimization” and closely related uses of the DRM acronym. arxiv_search(query="Deceptive Risk Minimization OR deceptive risk minimization DRM out-of-distribution generalization deceiving distribution shift detectors", max_results=10) Deceptive Risk Minimization (DRM) denotes a family of optimization and assessment formulations in which “deception” is treated as an explicit object of minimization or control. The term is not yet standardized across the literature, and its meaning varies by subfield. In one line of work, DRM is a representation-learning principle for out-of-distribution generalization: a model is trained so that encoded training data appear iid to a distribution-shift detector, with the aim of suppressing unstable cues and retaining stable predictive structure (Majumdar, 15 Sep 2025). In a second line of work, DRM refers more broadly to frameworks that quantify or reduce the risk posed by deceptive artifacts, such as manipulative interface patterns, by combining detectability, human susceptibility, and impact into a risk score (Shi et al., 2024). A related sequential-decision perspective optimizes policies that intentionally induce false inferences in an observer, thereby trading off task reward against adversarial inference risk, although that work does not itself use the DRM label (Kim et al., 30 Jan 2025). Because “DRM” is also a well-established acronym for unrelated concepts such as distortion risk measures in reinforcement learning (Vijayan et al., 2021), domain-specific risk minimization in domain generalization (Zhang et al., 2022), dummy risk minimization in supervised learning (Wang et al., 2023), and diametrical risk minimization in robust empirical risk minimization (Norton et al., 2019), careful disambiguation is essential.

1. Terminological scope and disambiguation

The phrase “Deceptive Risk Minimization” is currently polysemous. The most direct usage appears in the 2025 paper “Deceptive Risk Minimization: Out-of-Distribution Generalization by Deceiving Distribution Shift Detectors,” which defines DRM as a method for OOD generalization based on learning representations that make training data look iid to an observer implemented as a shift detector (Majumdar, 15 Sep 2025). In that setting, deception is not directed at humans or strategic opponents in the ordinary sense; rather, the learned representation is optimized to “deceive” a statistical detector into failing to identify non-iid structure.

A distinct but conceptually adjacent usage arises in the study of deceptive patterns on digital platforms. There, the core problem is not representation learning but risk assessment. The formalism models deceptive behavior as an adversarial divergence between intended specification and implemented interface, then scores the resulting risk using a combination of adversary advantage against humans, watchdog detection capability, and impact severity (Shi et al., 2024). This is DRM in the sense of minimizing the risk attributable to deception, rather than learning deceptive invariances.

A third nearby literature concerns deceptive sequential decision-making. The 2025 work on regularized policy optimization does not use the phrase “Deceptive Risk Minimization,” but it is closely aligned with the idea: the policy is synthesized to preserve high task reward while inducing an inverse-reinforcement-learning adversary to infer an incorrect reward function or goal (Kim et al., 30 Jan 2025). This suggests a broader interpretation of DRM as optimization under an explicit deception–performance trade-off.

The acronym itself is heavily overloaded. In reinforcement learning, “DRM” often means distortion risk measure, a coherent risk-sensitive functional of return distributions rather than anything involving deception (Vijayan et al., 2021). In domain generalization, DRM may refer to domain-specific risk minimization, which uses domain-specific heads and online model steering to reduce the adaptivity gap (Zhang et al., 2022). Supervised-learning papers also use DRM for dummy risk minimization (Wang et al., 2023), and optimization theory uses DRM for diametrical risk minimization (Norton et al., 2019). Consequently, any technical discussion must specify which DRM is intended.

2. DRM as observer-centric OOD generalization

In the OOD generalization formulation, DRM begins from an observer-centric premise: if a learned representation hides the temporal or domain structure present in training data from a distribution-shift detector, then it has likely discarded the unstable factors that drive spurious correlations, leaving more stable features for prediction (Majumdar, 15 Sep 2025). The method therefore couples standard supervised learning with a deception objective directed at the detector.

The formal optimization problem is posed over a predictor $f$ and representation $\phi$. The task loss is

$$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$

subject to the requirement that the encoded sequence be “$\Delta$-practically iid” to a detector $\Delta$. For covariate shift this constraint is applied to $(\phi(x_t))_{t=1}^T$, whereas for concept shift it is applied label-conditionally to $(\phi(x_t)\mid y)_{t=1}^T$ for each $y\in\mathcal{Y}$ (Majumdar, 15 Sep 2025).

The hard constraint is relaxed into a differentiable objective: $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))) + \lambda \frac{1}{T}\sum_{t=1}^T \tilde S_t(\phi(x_1),\dots,\phi(x_t)),$$ where $\lambda$ controls the trade-off between task performance and deception, and $\phi$0 is a softened detector statistic derived from conformal martingales (Majumdar, 15 Sep 2025). The task term preserves predictive performance; the martingale penalty penalizes representations whose output stream appears non-iid to the observer.

This formulation differs from domain adaptation and invariant risk minimization in several respects. It does not require access to target data, explicit source/target domain labels, a partition of the training set into a finite number of environments, or knowledge of the shift points in the training stream (Majumdar, 15 Sep 2025). Instead, it assumes only that the order of observed training data preserves informative shift structure and that the detector is sensitive to the relevant instability. This suggests that DRM is especially aimed at settings with continuous, gradual, or weakly structured shifts for which discrete environment labels are unavailable or ill-posed.

A central interpretive claim is that many OOD failures arise because models rely on features that vary across time or environments in ways detectable from the training stream. By forcing the representation to eliminate exactly the signal that allows detection, DRM biases learning toward features that remain stable under further shift (Majumdar, 15 Sep 2025). This suggests a noncausal but practically motivated route to invariance: stability is inferred from what an observer cannot detect.

3. Conformal-martingale machinery and differentiable implementation

The detector in the OOD DRM framework is instantiated using conformal martingales, which provide an online test for departures from iid or exchangeability (Majumdar, 15 Sep 2025). The pipeline proceeds by computing conformity scores on encoded samples, converting them to conformal p-values, and feeding the p-values into a betting martingale whose capital serves as a shift statistic.

For covariate shift, the conformity score at time $\phi$1 is defined by nearest-neighbor distance in feature space: $\phi$2 where $\phi$3 can be cosine distance (Majumdar, 15 Sep 2025). For concept shift, the score is label-conditional: $\phi$4

These scores yield conformal p-values. In the covariate-shift case,

$\phi$5

and in the concept-shift case,

$\phi$6

with $\phi$7 providing randomized tie-breaking (Majumdar, 15 Sep 2025). Under iid data, these p-values are uniform, so the betting martingale remains controlled; under non-iid data, the capital can grow quickly.

The paper uses a betting martingale with bet set $\phi$8 and notes that thresholding the capital at $\phi$9 yields false alarm control at level $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$0 under iid data (Majumdar, 15 Sep 2025). This gives the deception objective a concrete statistical interpretation: a representation is successful when it prevents the detector statistic from reaching levels that would certify shift.

Because the raw procedure is nondifferentiable, the implementation replaces hard minima with soft-min operations and rank-based computations with smooth sorting or soft-ranking approximations, thereby defining the differentiable surrogate $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$1 (Majumdar, 15 Sep 2025). Additional implementation details include unit-norm feature normalization when cosine distance is used, averaging the martingale penalty across multiple sampled detection subsequences for large datasets, and warm-starting with ERM in Colored-MNIST (Majumdar, 15 Sep 2025). These details matter because the detector term is otherwise computationally expensive: conformity-score computation scales quadratically in sequence length, and the authors identify scalability as a limitation.

The appendix provides a theoretical bridge from deception to generalization. A proposition states, roughly, that if there exists a detector $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$2 and encoding $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$3 such that the encoded train–test sequence is practically iid to that detector, then the KL divergence between test and training losses is small: $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$4 This is not presented as a complete OOD theory, but it formalizes the intended mechanism: failure of a sufficiently good detector to distinguish pre- and post-shift encoded data implies closeness of loss statistics (Majumdar, 15 Sep 2025).

4. Empirical behavior and limitations of the OOD formulation

The OOD DRM paper reports three experimental settings: a toy 2D concept-shift problem, Colored-MNIST with phase-wise changes in color–label correlation, and a simulated imitation-learning pick-and-place task under covariate shift (Majumdar, 15 Sep 2025). Across these experiments, ERM is described as latching onto spurious or unstable features, whereas DRM suppresses the unstable factors and generalizes better.

In the toy 2D concept-shift task, one feature is genuinely predictive and the other is spuriously correlated with the label during training, with that spurious correlation changing over time and reversing at test (Majumdar, 15 Sep 2025). DRM learns a classifier aligned with the stable predictive dimension and attains near-oracle performance, whereas ERM exploits the spurious feature and fails under test reversal. In Colored-MNIST, DRM performs much better than ERM and nearly matches IRM while not requiring domain labels or change-point annotations; t-SNE plots indicate that ERM embeddings cluster by color whereas DRM embeddings cluster by digit identity (Majumdar, 15 Sep 2025). In the robotics setting, conformal martingales detect shift strongly in raw images and ERM features but not in DRM features, and DRM yields more robust placement behavior under novel visual conditions (Majumdar, 15 Sep 2025).

The method is explicitly positioned as less demanding than domain adaptation and IRM because it does not require test data or environment partitioning (Majumdar, 15 Sep 2025). That does not imply weaker assumptions overall; rather, the assumptions shift from environment annotation to temporal structure and detector adequacy. The paper notes three substantive failure modes. First, training shifts may fail to span the relevant test shifts. A representation could remove the unstable dimensions present in training while remaining sensitive to unobserved unstable factors that change at deployment (Majumdar, 15 Sep 2025). Second, a weak detector may be easy to fool without producing genuine robustness. Third, there are settings in which invariant prediction rules exist but making the representation itself look iid is unnecessarily restrictive, so an IRM-style method may be preferable (Majumdar, 15 Sep 2025).

These caveats are important for interpreting the “deception” metaphor. The representation is not guaranteed to capture causal structure simply because it fools the observer. At most, the observer acts as a proxy for instability in the training stream. This suggests that DRM’s success depends critically on detector design and on alignment between the training shifts and the deployment shifts of interest.

5. DRM as deceptive-pattern risk assessment

A different DRM-style formulation appears in the study of deceptive patterns on the web and in mobile interfaces. Here the problem is not to hide distribution shift, but to formalize and score the risk posed by manipulative digital design (Shi et al., 2024). The paper introduces a game involving an Adversary $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$5, a Watchdog $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$6, and a Challenger $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$7, where a software scheme $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$8 has an intended specification $$\inf_{f,\phi}\ \frac{1}{T}\sum_{t=1}^T l(x_t, f(\phi(x_t))),$$9 and a potentially manipulated implementation $\Delta$0. If implementation matches specification, then $\Delta$1; deceptive behavior arises when the implementation diverges in ways that manipulate users (Shi et al., 2024).

The watchdog’s detection capability is formalized as

$\Delta$2

and the adversary’s advantage against the human challenger is

$\Delta$3

A system is deceptive-pattern-resistant if there exists a watchdog such that either detection is non-negligible or adversary advantage against users is negligible (Shi et al., 2024).

On top of this game, the paper defines a quantitative risk score: $\Delta$4 where $\Delta$5 is impact severity, $\Delta$6 is an offset chosen so that $\Delta$7, and $\Delta$8 scales the final value into $\Delta$9 (Shi et al., 2024). Risk is interpreted coarsely as low for $\Delta$0, high for $\Delta$1, with the intermediate regime implicitly corresponding to medium risk.

The subfactors for $\Delta$2 are UI, Pre-knowledge, and Sequence. UI captures cues such as small icon, double negation, and inconsistent UI metaphor; Pre-knowledge captures the degree of domain expertise needed to recognize the deception; Sequence captures whether the pattern unfolds as a multi-step process (Shi et al., 2024). The subfactors for $\Delta$3 are time wasting, privacy breach, and financial loss (Shi et al., 2024). This decomposition makes human vulnerability a first-class element of deceptive risk rather than treating risk as a function of detector accuracy alone.

The paper evaluates four representative cases. Privacy Zuckering / Forced Action receives final risk score $\Delta$4 and is classified as low risk; Pop-up to Rate receives $\Delta$5, at the boundary of medium risk; Pop-up Ads receives $\Delta$6, medium risk; and Roach Motel, a multi-step cancellation trap, receives $\Delta$7, high risk (Shi et al., 2024). The case analyses are used to argue that human factors materially change the score in both directions: they can lower risk when users are likely to recognize the manipulation, and raise risk when dynamic or subtle patterns remain harmful despite detector support (Shi et al., 2024).

In this literature, DRM is best understood as deceptive-risk prioritization rather than representation learning. The aim is to rank patterns for mitigation, regulation, redesign, or governance. This suggests a broader family resemblance across DRM usages: deception is modeled as a structured interaction among an actor, an observer, and an at-risk target, and the optimization or assessment objective is built around controlling the resulting risk.

6. Sequential decision-making, deceptive evidence, and neighboring formulations

The policy-optimization literature extends the idea of deception into sequential control. In “Deceptive Sequential Decision-Making via Regularized Policy Optimization,” an autonomous system is modeled as an MDP or MMDP, and the adversary uses maximum-entropy inverse reinforcement learning to infer the system’s reward function from trajectories (Kim et al., 30 Jan 2025). The core idea is to synthesize a high-performing policy whose occupancy measures induce false reward inferences.

Two deception notions are defined. A policy is diversionary deceptive if the adversary infers the wrong goal state in any way, and targeted deceptive if the adversary is led to infer a particular user-specified false goal state (Kim et al., 30 Jan 2025). These are implemented by regularizing occupancy-measure optimization. Diversionary deception adds a quadratic term that rewards deviation from the nominal optimal occupancy $\Delta$8: $\Delta$9 subject to standard flow and goal-reachability constraints (Kim et al., 30 Jan 2025). Targeted deception instead penalizes deviation from a user-specified target occupancy $(\phi(x_t))_{t=1}^T$0: $(\phi(x_t))_{t=1}^T$1 under the same constraints (Kim et al., 30 Jan 2025). In both cases, $(\phi(x_t))_{t=1}^T$2 controls the deception–performance trade-off.

The paper derives explicit bounds on normalized revenue loss

$(\phi(x_t))_{t=1}^T$3

showing linear dependence on $(\phi(x_t))_{t=1}^T$4 and structure-dependent dependence on $(\phi(x_t))_{t=1}^T$5 (Kim et al., 30 Jan 2025). In a moving-target-defense experiment with one real agent and two decoys, diversionary deception causes the adversary to rank the real agent as least important while retaining $(\phi(x_t))_{t=1}^T$6 of optimal revenue at $(\phi(x_t))_{t=1}^T$7, and targeted deception makes a specified decoy appear most important while retaining $(\phi(x_t))_{t=1}^T$8 of optimal revenue at the same $(\phi(x_t))_{t=1}^T$9 (Kim et al., 30 Jan 2025). Although this work does not call itself DRM, it operationalizes the same general pattern: optimize behavior to reduce the risk that an observer infers the true objective.

A different neighboring line concerns belief manipulation in LLMs. “The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence” studies misleading but hard-to-falsify evidence that shifts model beliefs and downstream advice (Wan et al., 9 Jan 2026). The MisBelief framework generates $(\phi(x_t)\mid y)_{t=1}^T$0 instances across eight domains and three difficulty levels through multi-round interaction among Planner, Reviewer, and Refiner agents (Wan et al., 9 Jan 2026). Across seven evaluated LLMs, false-belief scores increase by an average of $(\phi(x_t)\mid y)_{t=1}^T$1 after evidence injection, and GPT-5 exhibits a $(\phi(x_t)\mid y)_{t=1}^T$2 relative increase (Wan et al., 9 Jan 2026). The proposed mitigation, Deceptive Intent Shielding (DIS), prepends analyst-generated intent warnings

$(\phi(x_t)\mid y)_{t=1}^T$3

to the evidence and produces average relative decreases in belief shift ranging from $(\phi(x_t)\mid y)_{t=1}^T$4 to $(\phi(x_t)\mid y)_{t=1}^T$5 depending on model and analyst configuration (Wan et al., 9 Jan 2026).

This LLM work is not labeled DRM, but it is closely related conceptually. The deceptive object is evidence rather than data distribution or occupancy measure; the risk is belief shift toward falsehood and corrupted downstream recommendations rather than generalization error; and the mitigation acts at inference time rather than as a training regularizer (Wan et al., 9 Jan 2026). A plausible implication is that DRM can be interpreted as an umbrella for optimization and governance schemes that explicitly treat deception as part of the environment or objective, even when the formal machinery differs substantially.

7. Relation to other “DRM” formulations and conceptual boundaries

Because the acronym is shared with several unrelated methods, distinguishing Deceptive Risk Minimization from neighboring frameworks is part of the subject itself.

Acronym expansion	Core setting	Relation to deception
Deceptive Risk Minimization	OOD generalization by deceiving shift detectors	Directly about deception of an observer (Majumdar, 15 Sep 2025)
Distortion Risk Measure	Risk-sensitive RL via Choquet-integral return functionals	Unrelated to deception (Vijayan et al., 2021)
Domain-Specific Risk Minimization	DG via domain-specific heads and online steering	Unrelated acronym overlap (Zhang et al., 2022)
Dummy Risk Minimization	ERM modification with dummy output classes	Unrelated acronym overlap (Wang et al., 2023)
Diametrical Risk Minimization	Worst-case neighborhood empirical risk in parameter space	Unrelated acronym overlap (Norton et al., 2019)

Distortion risk measures in RL define a risk-sensitive objective

$(\phi(x_t)\mid y)_{t=1}^T$6

and support policy-gradient theorems, LR estimators, and $(\phi(x_t)\mid y)_{t=1}^T$7 convergence to approximate stationary points (Vijayan et al., 2021). None of this is about deception. Domain-specific risk minimization addresses the adaptivity gap in domain generalization by training a shared encoder with source-specific heads and performing per-sample head selection or soft ensembling at test time (Zhang et al., 2022). Dummy risk minimization enlarges the classifier head with dummy classes to increase gradient variance and favor flatter minima (Wang et al., 2023). Diametrical risk minimization replaces empirical risk with

$(\phi(x_t)\mid y)_{t=1}^T$8

thereby favoring flatter parameter-space neighborhoods and obtaining generalization guarantees independent of Lipschitz moduli (Norton et al., 2019). These are technically distinct programs despite the common acronym.

Against this background, Deceptive Risk Minimization is best regarded not as a single settled theory but as an emerging research motif. In its narrowest, most explicit sense, it denotes OOD generalization by learning representations that fool distribution-shift detectors (Majumdar, 15 Sep 2025). In a broader sense suggested by adjacent work, it encompasses formal frameworks in which deceptive interactions among an actor, an observer, and a target are incorporated into optimization or risk assessment, whether through statistical detectors, human-centered risk scores, occupancy-measure regularization, or intent-aware evidence filtering (Shi et al., 2024, Kim et al., 30 Jan 2025, Wan et al., 9 Jan 2026).

This suggests two common structural elements across the literature. First, deception is observer-relative: success is defined with respect to some detector, watchdog, user, or inference adversary. Second, deception is not treated as a mere by-product but as an object that can be regularized, quantified, or bounded. The principal controversy is whether fooling the chosen observer is a reliable proxy for the underlying objective of interest—robust generalization, reduced user harm, or protection against adversarial inference. The existing papers support that proxy empirically in their respective settings, but they also document detector weakness, underspecification, and shift mismatch as central limitations (Majumdar, 15 Sep 2025, Shi et al., 2024).