---
title: Dynamic Adversary Agent (DAA)
url: https://www.emergentmind.com/topics/dynamic-adversary-agent-daa
type: topic
---

# Dynamic Adversary Agent (DAA)

Dynamic Adversary Agent (DAA) is, in the literature surveyed here, an adversarial agent whose behavior evolves during interaction rather than remaining fixed. This usage spans pursuit–evasion under fog of war, cooperative multi-agent deception, adversarial red-teaming of AI agents, and dynamic cybersecurity evaluation. In these settings, the adversary is not merely a disturbance model or a static attack script; it is an explicit decision-making entity with observations, actions, and an adaptation loop, often implemented with deep reinforcement learning, graph-based communication, or closed-loop attack optimization [2108.11010] [2008.07698] [2605.04808] [2505.18384].

## 1. Scope and research usage

The term is used across several adjacent lines of work to denote adversarial agency under temporal adaptation. In multi-agent deep reinforcement learning, the adversary may be tasked with discovering a high-value target by observing cooperative agents, or with evading capture in a partially observable environment [2008.07698] [2108.11010]. In agent security, the adversary may be an autonomous red-teaming system that iteratively refines attacks against a victim AI agent using environmental feedback and a verifiable judge [2605.04808]. In cybersecurity evaluation, the adversary may be modeled as an entity that exploits multiple “degrees of freedom” such as repeated sampling, iterative prompt refinement, self-training, and workflow refinement within a fixed compute budget [2505.18384].

| Research setting | Representative DAA instantiation |
|---|---|
| Multi-agent deception | An adversary agent infers the true target landmark from cooperative agents’ behavior [2008.07698] |
| Pursuit–evasion | Independent pursuer and evader agents interact under fog of war in the SAAC environment [2108.11010] |
| Agentic red-teaming | DTap-Red autonomously discovers and optimizes attacks across prompt, tool, skill, and environment channels [2605.04808] |
| Cyber risk assessment | Adversaries iteratively improve offensive agents through compute-bounded adaptation [2505.18384] |

A consistent feature is explicit adversarial policy adaptation. The surveyed works therefore distinguish DAA-like systems from fixed scripted opponents, one-shot prompt attacks, or static benchmark perturbations. This suggests that DAA is best understood as a modeling pattern for adaptive adversarial behavior rather than as a single canonical algorithm.

## 2. Reinforcement-learning formulations

In graph-based multi-agent deception, cooperative agents and the adversary are represented through modular neural components. Each good agent has an **Agent State Encoder**, **Environment State Encoder**, **Opponent State Encoder**, and **Inter-Agent Communication Module**; all cooperating agents share network weights under centralized training and decentralized execution [2008.07698]. The adversary’s role is to discover the high-value landmark by observing the good agents. Training uses a two-stage curriculum: first coverage, then deception, with the combined reward
$$
R = \alpha R_{\text{cov}} + (1-\alpha) R_{\text{dec}}.
$$
The reported effect is that increasing deception weight makes the agents more successful at deceiving the adversary, at the cost of less-than-optimal coverage [2008.07698].

In pursuit–evasion, the SAAC environment extends StarCraft II mini-games so that both pursuers and evaders can be controlled by separate agents in a zero-sum dynamic game under fog of war [2108.11010]. The evader-side DAA is trained with DQN, and the environment is grounded in control and differential game theory through a linear-quadratic cost
$$
J_{ij} = \|\mathbf{x}_{p_i} - \mathbf{x}_{e_j}\|^2 + R_p \int_0^{T_f} \|\mathbf{u}_{p_i}\|^2 dt.
$$
The paper reports that trained adversary evaders reduce the number of captured units from approximately \(51\) for a random-action baseline to approximately \(30\), while also exhibiting team clustering and corner hiding reminiscent of known hiding strategies [2108.11010].

A closely related formulation appears in the Traitor Markov Decision Process (TMDP), where adversarial “traitor” agents are injected into a cooperative multi-agent reinforcement learning system and trained with the same MARL algorithm as victim agents, but with adversarial reward
$$
R_T = -R(s_n,a_n).
$$
Because direct credit assignment is difficult, CuDA2 adds Random Network Distillation (RND)-based curiosity through dynamic Potential-Based Reward Shaping, while preserving optimal policy invariance for the traitors [2406.17425]. Empirically, CuDA2 yields comparable or superior attack capabilities on SMAC relative to baselines such as `stop`, `random`, and `minus_r` [2406.17425].

These RL formulations show that DAA behavior can emerge either from explicit adversarial objectives, from game-theoretic asymmetry between teams, or from reward shaping that encourages the adversary to drive the system into unfamiliar regions of state space.

## 3. Communication, roles, and adversarial interaction in multi-agent systems

A second strand of work treats dynamic adversariality as a problem of communication structure and team coordination. TodyComm addresses multi-round LLM-based multi-agent systems in which fixed communication topologies fail when agents’ roles change across rounds due to dynamic adversary, task progression, or communication bandwidth constraints [2602.03688]. At each round, communication is a directed acyclic graph \(G_t = (V_t^c, E_t^c)\), and agent participation is determined by per-agent, per-round credits \(c_i^t\) computed from a gated recurrent network and an MLP. Training uses REINFORCE over communication and decision graphs, and the reported result is that TodyComm identifies adversarial agents with more than \(85\%\) accuracy on average without access to adversarial labels, while retaining token efficiency and scalability [2602.03688].

Collaborative Threat-Aware Autonomy (CTAA) addresses dynamic, adversarial Weapon Engagement Zones by assigning Autonomous Collaborative Platforms distinct roles: **primary intercept**, **escort**, and **decoy** [2605.25741]. Each ACP independently applies a reactive guidance law derived from the Collision Sphere Boundary for Evader Zero-Set (CSBEZ), and the architecture exploits two effects: probabilistic redundancy and threat saturation. In deterministic simulation, the reported mission success rises from \(0.72\) for a single CSBEZ-aware vehicle to \(0.978\) for a three-ACP team; in Monte Carlo experiments, the single-vehicle success is \(0.66 \pm 0.09\) and the multi-ACP team reaches \(1.00 \pm 0.00\) [2605.25741].

These results broaden the DAA concept beyond a single hostile policy. Dynamic adversariality can also be mediated by communication topology, route separation, role differentiation, and adaptive exclusion of unreliable agents. In that sense, the adversary is partly a property of the interaction graph, not only of an isolated attacking policy.

## 4. Autonomous red-teaming and offensive cybersecurity agents

Recent work recasts DAA as an autonomous attack-generation system for AI agents. DTap introduces a controllable and interactive red-teaming platform spanning **14 real-world domains and over 50 simulation environments**, and DTap-Red is described as the first autonomous red-teaming agent that systematically explores prompt, tool, skill, environment, and combined injection vectors [2605.04808]. Its architecture is a closed loop: attack optimization and generation, execution against the victim agent, verifiable judge evaluation, and iterative refinement. The system includes a **Multi-Layer Memory Module**, an **Attack Skill Library** with **200+ advanced strategies**, flexible spatial-temporal injection, and an \(\epsilon\)-greedy exploration–exploitation policy [2605.04808].

| Agent framework and model | Direct ASR (%) | Indirect ASR (%) |
|---|---:|---:|
| Google ADK (Gemini) | 48 | 56 |
| OpenAI Agents SDK (GPT-5.2) | 59 | 47 |
| OpenClaw (DeepSeek-V4-Pro) | 60 | 42 |
| Claude Code (Sonnet-4.5) | 27 | 25 |

The same paper reports that multi-vector, chain-composed attacks yield superlinear ASR improvements, that harness flaws such as batch tool invocation can create “execute-then-refuse” failures, and that attacks transfer across models [2605.04808]. The adversary here is dynamic in a strong sense: it retrieves prior successes and failures, selects or adapts attack skills, executes them in a realistic environment, and re-optimizes against a verifiable objective.

Dynamic risk assessment for offensive cybersecurity agents generalizes this idea from single attacks to compute-bounded adversarial improvement [2505.18384]. The paper identifies five degrees of freedom: **repeated sampling**, **increasing max rounds of interactions**, **iterative prompt refinement**, **self-training**, and **iterative workflow refinement**. Under an **8 H100 GPU-hour** budget, adversaries improve an agent’s cybersecurity capability on InterCode CTF by **more than 40\% relative to the baseline**, without external assistance [2505.18384]. The threat model differentiates **stateful** environments, where only one trajectory may be possible, from **non-stateful** environments, where resets allow much greater exploitation of these degrees of freedom [2505.18384].

This line of work shifts DAA from a reinforcement-learning opponent inside a simulated environment to an agentic attacker that treats the victim system itself as the environment and uses iterative search to discover high-yield vulnerabilities.

## 5. Defensive and diagnostic counterparts

DAA research has also stimulated defensive systems that explicitly reason about adversary dynamics. In agentic honeynet configuration, an AI-driven architecture analyzes IDS alerts and network state to infer attack progression, identify compromised assets, predict likely attacker targets, and dynamically select a subset \(\mathcal{E}_t \subseteq \mathcal{H}\) of honeypots under an exposure budget \(|\mathcal{E}_t| \le K\) [2603.14122]. The agent operates in a perception–inference–action loop and is evaluated with an **Attack-Stage Inference Score**
$$
\text{score} = \frac{TP}{TP + FP + FN}.
$$
Preliminary results indicate that stronger LLMs achieve higher phase-inference accuracy, while even weaker models can sometimes sustain attacker engagement when the attack surface is unambiguous [2603.14122].

In reinforcement learning, PolicyGuard addresses **adversary-agent attacks** at test time and step level through GP posterior variance over state-action trajectories [2606.12896]. The paper reports average **AUROC of \(0.859\)** for original adversary-agent attacks and **\(0.878\)** for hard-coded adversary-agent attacks, under black-box constraints and without access to internal agent parameters [2606.12896]. The key idea is that backdoor-triggered behaviors induced by adversarial interactions produce elevated uncertainty relative to clean behavior.

For LLM-based multi-agent systems, SafeAgents provides a fine-grained diagnostic framework for adversarial prompting [2511.10949]. Its DHARMA taxonomy localizes whether a harmful trajectory was stopped or ignored at the planner or sub-agent level. The reported results include **66.37\% unmitigated execution** for Magentic on SafeArena under atomic delegation, and **51.97\% of attack stoppages at the sub-agent level** on AgentHarm for centralized Magentic [2511.10949]. These findings show that, once adversaries are dynamic and multi-stage, evaluation must also become pipeline-aware and temporally localized.

Together, these systems indicate that DAA research is inseparable from adversary-aware observability, verifiable judging, and step-level or stage-level diagnostics. A dynamic adversary is difficult to study with only final-outcome metrics.

## 6. Terminology, misconceptions, and related acronyms

A recurring source of confusion is acronym overload. In the cited literature, **DAA** may also denote **Dynamic Attention Analysis**, a backdoor-detection method for text-to-image diffusion models [2504.20518], or **Dynamic Asset Allocation**, an adaptive financial evaluation method [2110.11156]. In adversarial representation learning, **DAA** is also used for **downstream-agnostic attacks**, including targeted downstream-agnostic attack variants [2605.19446]. These usages are unrelated to Dynamic Adversary Agent.

Another common misconception is that a DAA must be a fully learned neural policy. The surveyed work includes heuristic adversaries that move toward the landmark closest to any good agent [2008.07698], DQN-trained evaders under fog of war [2108.11010], traitor agents trained with adversarial reward shaping [2406.17425], and autonomous red-teaming systems with memory, attack libraries, and iterative refinement rather than a single end-to-end policy [2605.04808]. Dynamicity, likewise, is not confined to online gradient updates: it may arise from multi-round communication adaptation [2602.03688], role-based threat saturation [2605.25741], compute-bounded prompt and workflow refinement [2505.18384], or sequential exposure control in a honeynet [2603.14122].

Taken together, these works trace a clear transition from fixed or heuristic opponents toward adversaries that learn, communicate, remember, diagnose outcomes, and iteratively refine behavior. This suggests that the modern DAA is less a single architecture than a unifying abstraction for adversarial agency under feedback, partial observability, and temporal adaptation.

Source: https://www.emergentmind.com/topics/dynamic-adversary-agent-daa