Defensive M2S: Multi-Source Defense

• Defensive M2S is a framework combining multi-source and multi-stage defense techniques to optimize robustness against diverse adversarial challenges.
• It decomposes defense logic into modular components, enabling fine-grained trade-offs between accuracy, cost, and resource allocation in fields like neural network security and LLM safety.
• Empirical studies show significant improvements in attack resistance, efficiency, and strategic adaptability using methods such as AdvMS, M2S compression, and multi-stage moving target defense.

Defensive M2S encompasses a family of techniques and analytical frameworks for constructing, optimizing, and analyzing system defenses that leverage multi-source or multi-stage mechanisms. These approaches are applied across domains—including neural network security, cyber-physical attacks, conversation-based LLM guardrails, cryptographic key randomization, drone pursuit-evasion, and swarm defense—united by the shared goal of improving security, resilience, or robustness by systematically composing diverse defensive mechanisms or strategically partitioning both defense logic and cost. Below, principal Defensive M2S paradigms from contemporary research are surveyed in depth according to their technical formulations, algorithmic structures, and empirical properties.

1. Multi-source Multi-cost Defenses for Adversarial Robustness

Defensive M2S in adversarial machine learning is formally instantiated in the AdvMS (Adversarially Trained Model Switching) scheme, which addresses the limitation of single-source single-cost defenses—such as vanilla adversarial training or stochastic activation—by jointly leveraging multiple sources of robustness and distributing trade-off costs across system axes. The AdvMS formulation is as follows:

• Sources of robustness:

1. Adversarial training, in which each sub-model $f_m(x;\theta_m)$ is individually optimized for $\ell_\infty$-bounded worst-case perturbations ($\|\delta\|_\infty\le\varepsilon_{\rm train}$).
2. Random model switching, in which the inference-time model $m \sim \pi$ is randomly selected (typically uniform).

• Cost axes:

1. Clean test-accuracy drop (as a function of $\varepsilon_{\rm train}$).
2. Memory usage (scaling linearly in $M$, the number of sub-models).

The associated training objective is: $$\min_{\theta_1,\dots,\theta_M} \mathbb{E}_{(x,y)\sim D} \left[\frac{1}{M}\sum_{m=1}^M\max_{\|\delta\|_\infty\le\varepsilon_{\rm train}}\ell(f_m(x+\delta;\theta_m),y)\right].$$ At inference, a prediction is made via a randomly sampled $f_m$. By grid-searching $(\varepsilon_{\rm train},M)$, AdvMS produces a robustness–accuracy–memory Pareto curve, systematically escaping the performance plateau encountered by either dimension alone. Empirical studies on MNIST/CIFAR-10 under strong white-box and EOT attacks confirm that AdvMS lowers attack success rates and allows fine-grained trade-off control (Wang et al., 2020).

2. M2S Compression for Efficient Guardrail Training in Multi-turn Dialogues

In guardrail LLM architectures, Defensive M2S denotes the Multi-turn-to-Single-turn (M2S) compression paradigm. Rather than training or running guardrail models on $\mathcal{O}(n^2)$ prefixes of $n$-turn multi-turn dialogues, Defensive M2S compresses dialogue into a single prompt by extracting and reformatting only the user turns, discarding system responses. Three canonical template functions are proposed:

• Hyphenize: Each turn becomes a bullet item.
• Numberize: Each turn is numbered.
• Pythonize: User turns assigned to variables in a code-like format.

Formally, for a conversation $C = \{(u_1,a_1),\ldots,(u_n,a_n)\}$ and template function $f_\theta$, the compressed prompt is $\tilde{C}=f_\theta(C)$. Complexity analysis demonstrates a reduction of both data generation and guardrail training from $\mathcal{O}(n^2)$ tokens to $\mathcal{O}(n)$, resulting in a $93\times$ reduction in training tokens and $20\times$ reduction in inference tokens per conversation for SafeDialBench jailbreak detection (Kim, 1 Jan 2026).

Empirically, the best configuration (Qwen3Guard + hyphenize) achieves 93.8% detection recall—38.9 points higher than the full-history baseline—using only 173 tokens per conversation versus 3,231. Model–template compatibility is crucial: for example, LlamaGuard exhibits degraded recall under compression, whereas Qwen3Guard improves substantially. M2S is implementation-agnostic and can be combined with parameter-efficient finetuning or fast architectures for scalable LLM safety screening.

3. Model-to-Suffix Defensive Prompting in LLMs

Defensive M2S is also realized as "Model-to-Suffix" defensive prompting for LLM robustness. Here, a short, fixed token sequence (the "defensive suffix") is optimized to be concatenated to any (adversarial) input prompt, steering the LLM away from harmful completions without model retraining. The suffix is learned via gradient-based optimization of token embeddings, using a loss function $$L_{\mathrm{total}} = L_{\mathrm{def}} - \alpha \log L_{\mathrm{adv}}$$ balancing cross-entropy for desired (defensive) targets and penalizing probability of forbidden tokens.

Algorithmic structure:

• Initialize $s$; for each $(p,y,a)$ (prompt, defensive target, adversarial tokens), append $s$ to $p$.
• Compute gradient of $L_{\mathrm{total}}$ w.r.t. $s$ using a suffix-generator model.
• Select top-$k$ tokens per gradient, step via learning rate $\eta$.
• Iterate until convergence.

Empirical results:

• Deployable across open LLMs (Gemma-7B, Mistral-7B, Llama2-7B/13B), and suffixes generated by openELM-270M or Llama3.2-1B.
• Mean Attack Success Rate (ASR) drops by $\approx$11%, perplexity improves (e.g., 6.57 → 3.93), and TruthfulQA truthfulness increases by up to 10% (Kim et al., 2024).
• The method is model-agnostic, requires no changes to victim model parameters, and can be stacked with rule-based or policy guardrails.

4. Multi-mode Swarm Defense via Multi-Objective Decomposition

In cyber-physical defense for aerial swarms, Defensive M2S refers to a "multi-mode swarm" decomposition, where defender resources are partitioned across interception and herding tasks in response to heterogeneous attacker behaviors (risk-taking versus risk-averse swarms). This framework uses a hierarchical combination of mixed-integer programming (for exact small-team assignments) and fast geometry-inspired heuristics (for large-scale coordination).

• Interception mode: Assigns defenders to individually intercept risk-taking attackers via a mixed-integer linear program (CADAA).
• Herding mode: Forms defender sub-teams into open-string-nets that spatially enclose and direct clusters of risk-averse attackers, with assignment via MILP/MIQCQP.
• Assignment heuristics: Hierarchical recursive bisection for rapid reassignment when MIP complexity exceeds real-time constraints.

Simulations on multi-attacker, multi-defender instances demonstrate 100% interception success, $<$4% assignment suboptimality, and real-time solver performance for up to 60 attackers and 24 unclustered (Chipade et al., 2023). This architecture allows provably-safe, dynamic defender allocation and is extensible to 3D and uncertain settings.

5. Single-Controller Stochastic Games for Moving Target Defense

In cryptographic MTD for wireless networks, Defensive M2S is expressed through a single-controller stochastic game formulation. The system's "attack surface" is randomized over $K=NM$ cipher–key pairs, with only the defender (base station) controlling the active state; the adversary selects attacks but does not control state evolution.

• Defender action space: $A_D = \{a_D^1,\dots,a_D^K\}$, each corresponding to a different state.
• Attacker action space: $A_A = \{a_A^1,\dots,a_A^N\}$, each brute-forcing a technique.
• Utilities: Per-stage defender utility includes attack deterrence rewards, switching rewards $T_1$, power costs $P_1$, and change costs $C(q,n)$. Attacker utility models trial opportunity and power cost.
• Equilibrium: Existence of stationary Nash equilibrium is guaranteed; equilibrium policies are solved via bimatrix game over pure strategies, projected back to stationary randomized defense strategies.

Compared to uniform randomization, equilibrium MTD policies raise long-run defender utility by 20–40% (depending on discount factor and costs) (Eldosouky et al., 2016). The defender's optimal strategy almost never remains in the same state, favoring switch actions that maximize unpredictability conditional on cost.

6. Multi-stage Moving Target Defense in Critical Infrastructure

Defensive M2S encompasses multi-stage moving target defense (MMTD) in power grid security, where sequentially varied security-oriented configurations (e.g., via D-FACTS devices) precede a return to the economic-optimal state. Attack detection optimality is characterized via the dimension of the intersection of attack spaces across stage-wise perturbed system matrices.

• Attack-space metric: The dimension $\text{DoA} = \dim\bigcap_i \mathrm{col}(H_i)$ quantifies residual attack stealthiness under $k$ perturbations.
• Supremum: Achievable when system topology and D-FACTS deployment enable full-dimension circuit/cut matrices; $m_{sc}$ (single-line cuts) determine minimal undetectable attack subspace.
• Stage sequencing: Greedy rank-maximizing search over reactance vectors $x_i$ ensures rapid approach to supremum detection in $\leq n - m_{sc}$ steps.
• Economic tradeoff: MMTD incurs only a few percent additional power loss over baseline (e.g., $1.0478 \times$ ECASE); permanent one-stage MTDs inflict much higher steady-state inefficiencies (Wang et al., 2022).

Empirical results demonstrate consistent $>$98% detection (close to theoretical maxima) and scalable costs on IEEE test cases with up to 118 buses.

7. Defense-margin Strategies in Pursuit–Evasion

For single-defender, single-attacker pursuit with noisy measurement, the defense-margin M2S approach combines policies to maximize the guaranteed margin for preventing an attacker from reaching a safe zone. The defense margin $$\rho_{x^a_t} = \frac{1}{2}\frac{\|x^a_t\|^2 - \|x^d_t\|^2}{\|x^a_t-x^d_t\|}$$ provides a closed-form measure of the minimal lead preventing system invasion.

• Pure pursuit is optimal for capture but unstable under noise.
• Defense-margin control prioritizes safe-zone protection but may fail to capture.
• Adjusted combination (ADM) weights both baselines by instantaneous track reliability ($P_t$ from observation noise covariance).

Simulations show that ADM increases mission success rates by $\ge$36% over pure pursuit across diverse attacker behaviors (Sung et al., 2022), and remains computationally lightweight for online deployment.

---

Defensive M2S unifies a broad spectrum of multi-source, multi-stage, or multi-objective defensive frameworks grounded in rigorous mathematical models and empirically validated algorithms. Its principal significance lies in the capacity to break performance plateaus, distribute costs over deployable axes, enable robust scalability, and provide formal guarantees in adversarial or uncertain environments.