--- title: 'Defense2Attack: Adaptive Defense & Attack Modeling' url: https://www.emergentmind.com/topics/defense2attack type: topic --- # Defense2Attack: Adaptive Defense & Attack Modeling Defense2Attack is a cross-domain research motif in which defensive structure is modeled explicitly with respect to attacker behavior, used to adapt defensive action to attack characteristics, or, in one adversarial reinterpretation, repurposed to strengthen attacks by exploiting defensive patterns. The term does not denote a single canonical algorithm. Instead, it spans multi-agent target defense, network intrusion detection, ATT&CK-grounded cyber policy evaluation, physical-layer wireless security, and multimodal model jailbreaking, with each literature instantiating the defense–attack coupling differently [2112.12098], [2603.00859], [2504.13301], [2107.04075], [2407.04905], [2509.12724]. ## 1. Defense2Attack as a cross-domain design pattern Across the cited works, Defense2Attack consistently centers the attack model inside the defense logic rather than treating defense as attack-agnostic. In the multi-agent interception setting, IDCAIS is explicitly described as a Defense2Attack framework that couples time-optimal interception with collision-aware assignment and real-time safety augmentation against multiple attackers [2112.12098]. In machine-learning intrusion detection, AMDS defines Defense2Attack as defense explicitly conditioned on attack characteristics, learning how different attacks manifest across disagreement, uncertainty, and anomaly signals before adapting detection and classification decisions at inference time [2603.00859]. Dynamite operationalizes the same general principle as dynamic defense selection, learning a mapping from perturbed feature vectors to the defense that maximizes IDS performance [2504.13301]. In cyber campaign analysis, the ATT&CK-based Markov methodology uses defender resource allocation to quantify changes in an adversary’s multi-step progress, success probabilities, and timing, thereby turning defensive policy into an explicit model of attack progression [2107.04075]. In wireless communications, D-RIS constructs a non-reciprocal channel whose downlink and uplink CSIs act as pairwise secrets, so precoding and combining embed defensive structure directly into the adversary-facing channel [2407.04905]. Differential-game formulations in conical environments and turret–defender target defense similarly encode attacker sensing, geometry, and equilibrium response into defender strategy computation [2509.13564], [2509.09777]. A notable exception is the vision-language jailbreaking paper titled “Defense-to-Attack,” where weak defense-styled cues are deliberately co-opted to increase attack effectiveness and efficiency. That paper reverses the usual meaning: defense patterns become steering signals for a jailbreak pipeline rather than safeguards against one [2509.12724]. This suggests that the phrase has both protective and adversarial uses in current literature. | Domain | Defense2Attack instantiation | Representative work | |---|---|---| | Multi-agent interception | Collision-aware assignment plus ECBF safety | IDCAIS [2112.12098] | | Network intrusion detection | Attack-conditioned signal weighting | AMDS [2603.00859] | | ML-IDS defense orchestration | Per-sample defense selection | DYNAMITE [2504.13301] | | ATT&CK-based cyber operations | Resource allocation mapped to attack progression | [2107.04075] | | Physical-layer wireless security | Non-reciprocal RIS link as secret defensive channel | D-RIS [2407.04905] | | Vision-language model security | Defense-styled cues used to strengthen jailbreaks | [2509.12724] | ## 2. Multi-agent target defense and interception games In IDCAIS, the environment is a 2D workspace \(W\) containing a circular protected area \(P\) with center \(r_p\) and radius \(\rho_p\), where \[ P = \{ r \in \mathbb{R}^2 \mid \|r - r_p\| \le \rho_p \}. \] There are \(N_a\) attackers and \(N_d\) defenders with \(N_d \ge N_a\), each modeled as discs, and each agent evolves under damped double-integrator dynamics with bounded acceleration and linear drag \(C_D>0\). Defenders are assumed at least as fast as attackers, capture occurs when \(\|r_{dj}(t)-r_{ai}(t)\| \le \rho_d^{int}\), and inter-defender collision occurs if \(\|r_{dj}(t)-r_{dj'}(t)\| < \rho_d^{col}\) [2112.12098]. The framework combines three layers: one-vs-one time-optimal guidance, a mixed-integer quadratic program for collision-aware defender-to-attacker assignment, and ECBF-based quadratic programs that minimally perturb time-optimal controls to guarantee online defender safety. The time-optimal control under damped double-integrator dynamics is constant in direction, with \[ u^*(t)=\bar u[\cos(\theta^*),\sin(\theta^*)]^T, \] and the associated trajectory coefficients \[ E_1(t)=\frac{1-e^{-C_D t}}{C_D}, \qquad E_2(t)=\frac{t-E_1(t)}{C_D}. \] The attacker’s worst-for-defender strategy is minimum-time motion to the protected area, while the defender solves a minimum-time interception problem in relative coordinates. The resulting interception time \(T_{ij}=T_d(x_{dj},x_{ai})\) is treated as a robust metric because if the attacker starts in the defender’s winning region \(R_d(x_d)\), then time-optimal play leads to interception before reaching \(P\), and time-sub-optimal attacker behavior does not help because \(R_d(x_d)\) is forward invariant [2112.12098]. Assignment is then solved via the collision-aware defender-to-attacker assignment MIQP. Binary variables \(\delta_{ji}\) encode matching, the interception cost uses a winning-region filter with a large penalty \(c_l\) for non-interceptable pairings, and predicted inter-defender collision risk is penalized by \[ C_d^{col}(X_{dj}^{ai},X_{dj'}^{ai'})= \begin{cases} 1/t_d^{col}, & \text{if trajectories collide}\\ 0, & \text{otherwise.} \end{cases} \] The weight \(w\in(0,1)\) trades interception time against collision risk, and the MIQP is solved using Gurobi. Since the problem is NP-hard in the number of binary variables \(N_\delta=N_dN_a\), the paper introduces a trajectory-bounding heuristic using \(\trianglesIntersect\) and \(\collisionTime\), reporting about \(4\times\) average speed-up, for example \(61.0\) vs \(222.1\) s for \(N_a=15\) and \(1057.1\) vs \(3883.5\) s for \(N_a=30\) [2112.12098]. Safety is enforced through Exponential Control Barrier Functions. For each defender pair, the safety function is \[ h_{jj'}=(\rho_d^{col})^2-\|r_{dj}-r_{dj'}\|^2, \] and forward invariance of the safe set is imposed by \[ \ddot h_{jj'}+2k_{jj'}\dot h_{jj'}+k_{jj'}^2 h_{jj'}\le 0. \] At each time step, the control correction \(\Delta u\) minimizes \(\Delta u^T\Delta u\) subject to ECBF constraints and input bounds, yielding a minimal safety augmentation of the time-optimal controls. The guarantees require \(h_{jj'}(0)\le 0\), \(\psi_{jj'}(0)\le 0\), and suitable \(k_{jj'}\); a rare measure-zero set \(Q_0\) is identified as a “deadlock” boundary case [2112.12098]. The simulation study illustrates both the strengths and limits of this formulation. MATLAB experiments use \(C_D=0.5\), \(\bar v_a=6\) m/s, \(\bar v_d=6.8\) m/s, \(\rho_a=\rho_d=0.5\) m, \(\rho_d^{int}=1\) m, \(\rho_d^{col}=2\) m, \(r_p=[0,0]^T\), \(\rho_p=2\) m, and \(w=0.5\). CADAA avoids predicted collision under collision-unaware assignment in some 2D-vs-2A scenarios, delays inevitable collision in others, and, when paired with ECBF-QCQP, can preserve inter-defender safety while still capturing attackers. It can also sacrifice capture to maintain safety, as shown in scenarios where one attacker reaches \(P\) after ECBF-induced delay. Across 20 randomized 2D-vs-2A scenarios, the CADAA success rate \(\sigma\) averages \(68\%\) [2112.12098]. The sequential target-defense differential games extend the same defense–attack coupling into geometric environments. In the conical single-defender problem, attackers appear one at a time at the boundary of a target sensing region, move radially until they sense the defender, and then choose among breach, evasion, or a capture point that minimizes future defender effectiveness. The defender maximizes the expected capture fraction \[ J=\frac{\mathbb{E}[S(N)]}{N}, \qquad J_\infty=\liminf_{N\to\infty}\frac{\mathbb{E}[S(N)]}{N}, \] using an engagement policy constrained by guard and no-escape inequalities, Apollonius-circle geometry, and a Stackelberg max-min problem over feasible engagement configurations and capture points [2509.13564]. In the turret–mobile-defender game, the protected target is a unit disk centered at a stationary turn-constrained turret, the objective is the terminal safety margin \(J=r_A(t_f)-1\), and the solution partitions team-winning play into solo capture by the defender, solo capture by the turret, and simultaneous capture at the intersection of the defender’s Apollonius circle and the turret’s alignment-time boundary [2509.09777]. ## 3. Attack-conditioned machine-learning intrusion defense AMDS defines Defense2Attack as a defense explicitly conditioned on attack characteristics. The system first profiles attack signatures across multiple detection signals and then adapts its detection and classification at inference time based on an inferred attack family. It considers two threat-model families relevant to network intrusion detection: gradient-based evasion and distribution-shift manipulations. The seven evaluated attacks are FGSM, PGD-\(L_\infty\), PGD-\(L_2\), CW-\(L_2\), SPSA, Injection, and Morphing [2603.00859]. The three integrated signals are ensemble disagreement, predictive uncertainty, and distributional anomaly. With \(K=6\) ensemble members and \(C\) classes, disagreement is \[ D(x)=\frac{1}{C}\sum_{c=1}^C \mathrm{Var}(\{p_c^{(k)}\}_{k=1}^K), \] predictive uncertainty is the Shannon entropy of the ensemble average \[ H(\bar p)=-\sum_{c=1}^C \bar p_c \log \bar p_c, \] and anomaly is the Mahalanobis distance \[ M(x)=\big(f(x)-\mu\big)^\top \Sigma^{-1}\big(f(x)-\mu\big) \] computed in the standardized feature space. The normalized signals are combined by an attack-conditioned weighted sum \[ D(x;a)=w_1(a)s_{\mathrm{disagree}}(x)+w_2(a)s_{\mathrm{uncert}}(x)+w_3(a)s_{\mathrm{anom}}(x), \] with \(w_i(a)\ge 0\) and \(\sum_i w_i(a)=1\) [2603.00859]. The weight-learning mechanism is a constrained black-box optimization over the simplex maximizing ROC-AUC, \[ \hat{\mathbf w}_S=\arg\max_{\mathbf w\in\Delta^2}\mathrm{AUC}\big(\{(D(x;\mathbf w),y)\}_{(x,y)\in S}\big), \] implemented with SciPy SLSQP on validation splits. Stage 1 learns generic, attack-specific, and category-level weights. Stage 2 performs runtime adaptation: the system computes the three signals, evaluates a generic detector, infers the category by the fixed anomaly threshold \(\tau_{\mathrm{anomaly}}=0.50\), refines the detector with the category-level weights, and declares an attack if the refined score exceeds \(\tau_{\mathrm{detect}}\), tuned to \(10\%\) false positive rate on validation [2603.00859]. AMDS also includes attack-adaptive ensemble weighting after detection. For category \(c\), member \(i\) receives weight \[ v_i^{(c)}=\frac{(\mathrm{Acc}_i^{(c)})^3}{\sum_{j=1}^K(\mathrm{Acc}_j^{(c)})^3}, \] and the final class prediction is \[ \hat y_{\mathrm{adaptive}}=\arg\max_c \sum_{i=1}^K v_i^{(\hat c)} p_c^{(i)}. \] The classifier pool is deliberately diverse: Decision Tree, Random Forest, XGBoost, LightGBM, Logistic Regression, and an MLP. Features are \(77\) standardized flow-level attributes from CSE-CIC-IDS2018, and a cascade router avoids computing Mahalanobis for most benign samples by gating on confidence and disagreement [2603.00859]. Empirically, attack signatures are heterogeneous. Gradient attacks are disagreement-dominant, with average \(\beta\approx 0.47\) across FGSM, PGD-\(L_\infty\), CW-\(L_2\), and SPSA, and AUCs \(\approx 0.74\)–\(0.76\) for attack-specific detectors. Morphing is anomaly-dominant with \(\gamma=0.533\) and AUC \(=0.988\), while Injection is entropy-dominant with \(\alpha=0.433\) and AUC \(=0.896\) [2603.00859]. On CSE-CIC-IDS2018, two-stage detection achieves \(94.2\%\) average ROC-AUC across the seven attacks, improving \(+36.3\) AUC points over generic-only and \(+17.2\) points over attack-specific-only. End-to-end, the method reports overall accuracy \(84.8\%\) versus \(80.3\%\) for adversarially trained ensembles, and F1 \(71.7\%\) versus \(62.7\%\). Under the evaluated adaptive white-box attacks, it appears to maintain \(94.4\%\) accuracy with a \(4.2\%\) attack success rate, but the paper explicitly notes that this evaluation is limited to two adaptive variants and does not constitute a formal robustness guarantee [2603.00859]. Dynamite addresses a related problem from a different angle: rather than learning weights over detection signals, it learns a selector over a defense pool. The setting is ML-based IDS for IoT and Industrial IoT networks, with six evasion attacks—FGSM, BIM, PGD, DeepFool, AutoPGD, and ZOO—at \(\epsilon\in\{0.01,0.1,0.2,0.3\}\) [2504.13301]. Nine defenses are instantiated as models or preprocessing pipelines: PGD Adversarial Training, Interpolated Adversarial Training, TRADES, Free Adversarial Training, Gaussian Augmenter, Defensive Distillation, RSLAD, Feature Squeezing, and Gaussian Noise [2504.13301]. Selector training uses adversarial datasets at \(\epsilon=0.1\) to build oracle labels from Macro F1. The defense objective is formalized as \[ d^*=\arg\max_{d\in\mathcal D}\mathbb E_{(x,y)\sim\mathcal X,\ a\sim\mathcal A}\big[M(f_d(a(x)),y)\big], \] and the selector policy \(\pi\) is trained by supervised classification, \[ \min_\theta \mathbb E_{x\sim AttackTrain}\big[\ell(\pi_\theta(\Phi(x)),d^*(x))\big]. \] At inference time, XGBoost predicts a defense ID \(\hat d\), and the corresponding defended model \(f_{\hat d}\) produces the IDS decision [2504.13301]. The principal empirical claim is that no single static defense dominates across attacks and intensities. On UNSW-NB15, averaged Macro F1 values are \(38.10\) for No Defense, \(61.60\) for Random, \(69.59\) for Best-Static, \(77.49\) for Dynamite, and \(79.20\) for Oracle. On WUSTL-IIoT they are \(32.28\), \(49.89\), \(58.52\), \(66.73\), and \(75.23\), respectively. Processing time per sample is \(22.077\) ms for Oracle and \(0.8396\) ms for Dynamite on UNSW-NB15, and \(24.276\) ms versus \(0.6670\) ms on WUSTL-IIoT, corresponding to computational reductions of \(96.2\%\) and \(97.3\%\) [2504.13301]. This suggests a second major Defense2Attack pattern in ML security: attack adaptation can occur either at the signal level, as in AMDS, or at the defense-portfolio level, as in Dynamite. ## 4. ATT&CK-grounded defender policy evaluation and resource allocation In the ATT&CK-based defender-policy framework, Defense2Attack means quantifying how defender resource allocation and policies translate into changes in an adversary’s multi-step attack progress, success probabilities, and timing using empirical parameters derived from MITRE ATT&CK Evaluations data [2107.04075]. The modeled attack is an indefinite stream of campaigns, each comprising multiple attack steps with uncertain durations. Defender resources are continuously allocated to sensing, detection, assessment, and “take moves,” and these allocations affect step-specific detection probabilities \(d_i\) and, in the general case, time-to-success distributions \(f_i(t)\) [2107.04075]. The paper maps a simplified APT3 campaign into GPLADD success conditions \(c_1,\dots,c_9\), from Start to Ready, where Ready denotes at least one RTU found. Detection capabilities are derived from ATT&CK Evaluations categories Blue 0, Blue 1, and Blue 2, corresponding to IOC detections only, IOC plus Specific Alert, and IOC plus Specific plus General Alert. Step detection probabilities are computed from vendor fractions in the Evaluations, taking ceilings across sub-steps and applicable categories [2107.04075]. The attacker–defender interaction is approximated as a discrete-time Markov chain. In Method 1, with time step \(\delta t\), \[ F_i(\delta t)=\int_0^{\delta t} f_i(t)\,dt, \] \[ p_{i,i+1}=F_i(\delta t)(1-d_i), \qquad p_{i,1}=d_i, \qquad p_{i,i}=1-p_{i,i+1}-p_{i,1}. \] In the Evaluations-consistent Method 2, there is no “stay” probability: \[ p_{i,i+1}=1-d_i, \qquad p_{i,1}=d_i, \qquad p_{i,i}=0. \] At Ready, \[ p_{9,1}=d_9, \qquad p_{9,9}=1-d_9. \] The stationary distribution \(\pi\) satisfies \(\pi=\pi P\), and the key long-run metric is the Ready residence time \(\pi_9\), interpreted as the fraction of time the attacker spends in Ready over an indefinite horizon [2107.04075]. The same Markov representation supports first-passage analysis. By making \(c_9\) absorbing, the paper uses the standard absorbing-chain matrix \[ N=(I-Q)^{-1}, \] with absorption probabilities \(b=NR\) and expected time to absorption \(E[T]=N\cdot 1\). For a linear chain without “stay,” the probability of undetected success in exactly nine steps is \[ \Pi_{\mathrm{undetected}}=\prod_{i=1}^8 (1-d_i), \] reported as “small (\(\approx 4\%\))” in the literature/SME-parameterized example [2107.04075]. Defender optimization is formulated over allocations \(r=(r_2,\dots,r_9)\) subject to a budget, with example monotone-concave detection model \[ d_i(r_i)=1-e^{-\alpha_i r_i}. \] Two natural objectives are minimizing Ready residence time \(\pi_9(P(r))\) and maximizing expected time to Ready or minimizing success probability over a horizon. The paper emphasizes policy evaluation and sensitivity-guided improvement rather than a fully developed MDP solution, but it explicitly notes that \(\pi_9\) and \(E[T]\) are differentiable with respect to \(d_i\) under standard regularity [2107.04075]. The case study shows that distributed investment across the chain is superior to concentrating only on the final step. For B0 (Evaluation B20), \(\pi_9\approx 1\); for B1 (B21), \(\pi_9\approx 5\%\); for B2 (B22), \(\pi_9\approx 2\%\). First-passage distributions show approximately \(80\%\) rapid success in B20, reduced to approximately \(10\%\) in B21 and approximately \(6\%\) in B22. A cross-scenario comparison between B12 and B22 further shows that stronger detection at Ready alone is not sufficient: despite \(d_9=0.67\) in B12 versus \(0.42\) in B22, rapid success remains approximately \(20\%\) in B12 and approximately \(6\%\) in B22 because B22 allocates disruption more effectively across earlier steps [2107.04075]. This work clarifies an important misconception. Defense2Attack in this setting is not attack generation or attack-specific model selection; it is the quantitative propagation of defensive choices through a stochastic attack graph. A plausible implication is that the term can denote a policy-analysis methodology as much as an operational controller. ## 5. Physical-layer and embodied security formulations The D-RIS work studies a RIS-In-The-Middle attack, where an adversary uses a reconfigurable intelligent surface to create a higher-quality alternative path between a legitimate BS and UE, enabling both eavesdropping and false data injection [2407.04905]. The defensive response is a passive UPA controlled by the BS that creates a non-reciprocal cascaded channel through a common dynamic phase applied to all RIS elements. The D-RIS channel is \[ h_{a,n}=e^{j\varphi_{a,n}} h_a, \] with phase scheduling \[ \varphi_{a,n}= \begin{cases} \varphi_a^{\mathrm{DL}}, & n\in \mathcal N^{\mathrm{DL}}\\ \varphi_a^{\mathrm{UL}}, & n\in \mathcal N^{\mathrm{UL}}, \end{cases} \] so that \[ h_a^{\mathrm{DL}} \neq h_a^{\mathrm{UL}}, \qquad H_{AB}\neq H_{BA}. \] This non-reciprocity makes the DL and UL CSIs secret, pairwise keys that are embedded by precoding and verified by receive combining [2407.04905]. In the interference-free case, the MRT-variant precoders are \[ v_{b,n}=(h_a^{\mathrm{DL}})^* e^{j\theta_a^{\mathrm{UL}}}, \qquad v_{u,n}=(h_a^{\mathrm{UL}})^* e^{j\theta_a^{\mathrm{DL}}}, \] and the receivers apply phase-only combining, \[ z_{u,n}=e^{-j\theta_a^{\mathrm{UL}}}y_{u,n}, \qquad z_{b,n}=e^{-j\theta_a^{\mathrm{DL}}}y_{b,n}. \] An adversary observing only a reciprocal path cannot match both forward and backward keys, so it cannot reliably decode or inject valid symbols [2407.04905]. The channel-estimation procedure uses phase flipping at the D-RIS and three pilot stages \(p_0\), \(p_1\), and \(p_2\), allowing both BS and UE to estimate the DL and UL CSIs without CSI feedback. The work then evaluates secrecy via achievable rates \[ C_i=\eta_i\log_2(1+\rho_i), \qquad \eta_i=1-\frac{N_p}{N}, \] and defines reciprocal and non-reciprocal secrecy rates \[ E_{ar}=C_a-\left(1-\frac{N_r}{N}\right)C_e, \qquad E_{an}=C_a-\left(1-\frac{N_n}{N}\right)C_e, \] with \(N_n\approx 2N_r\). False-data detectability is analyzed through \[ P_r=\left(1-\frac{N_n'}{N}\right)P_2, \] and \[ P_2\approx Q\!\left(\frac{M_a\sigma_{qa}^2\sigma_{ga}^2+\sigma_d^2+\sigma_w^2}{M_e\sigma_e^2\sigma_{gv}^2}\right). \] The evaluation uses 3GPP TR 38.901 factory NLOS channels, \(N=22\) OFDM symbols, \(K=600\) subcarriers, \(M_a=2000\), \(M_e=1000\), and transmit power \(-30\) dBm. The paper reports that the non-reciprocal design yields higher secrecy than reciprocal baselines and can reduce false-data detection probability by up to an order of magnitude, especially when \(N_n'\) is large [2407.04905]. The conical and turret-based target-defense papers belong to the same broader category of embodied Defense2Attack formulations, though they operate in pursuit–evasion geometry rather than wireless channels. In the conical environment, the defender faces a sequence of attackers with limited-range sensing radius \(\rho_A\), and the core construct is the Apollonius circle at first mutual detection, \[ c(t)=\alpha x_A(t)-\beta x_D(t), \qquad r_C(t)=\gamma\|x_A(t)-x_D(t)\|, \] with \[ \alpha=\frac{1}{1-\nu^2},\quad \beta=\frac{\nu^2}{1-\nu^2},\quad \gamma=\frac{\nu}{1-\nu^2}. \] Breaches, evasions, and captures are classified by the intersection of this circle with the target region or the target sensing region. Monte Carlo experiments with \(r_T=6\), \(\rho_A=1\), \(r_0=8\), \(\nu=0.85\), and \(\Phi=\pi/3\) show empirical capture percentage converging near \(72.11\%\) at \(N=200\), bracketed by a lower bound \(63.48\%\) and upper bound \(80.96\%\) [2509.13564]. In the turret–defender problem, the target is a unit disk centered at a stationary turn-constrained turret, the defender has speed \(p\), the attacker has speed \(v\), and \(v