---
title: 'Exploitability Residual: Equilibrium Gap & Residual Risk'
url: https://www.emergentmind.com/topics/exploitability-residual
type: topic
---

# Exploitability Residual: Equilibrium Gap & Residual Risk

Exploitability residual denotes a residual measure of what remains exploitable after a reference condition has been fixed. The term is not standardized across the cited literature. In game-theoretic work, it most often coincides with exploitability itself, or with a smooth or stationarity surrogate of exploitability, and it functions as an equilibrium-gap certificate. In software-security and agent-security work, the same phrase is more naturally interpreted as residual risk, remaining attacker capability, or remaining post-defense/post-patch vulnerability. Across these settings, the common role is to quantify residual room for profitable deviation, attack execution, or capability escalation rather than mere structural suspicion [2210.10207][2605.10410][2604.21051].

## 1. Equilibrium-gap interpretations in games

In pseudo-games, the most faithful residual is the paper’s exploitability itself. For a profile \(a\), player \(i\)’s regret is
\[
r_i(a_i,b_i; a_{-i}) = u_i(b_i,a_{-i}) - u_i(a_i,a_{-i}),
\]
the cumulative regret is
\[
R(a,b) = \sum_{i\in[n]} \bigl( u_i(b_i,a_{-i}) - u_i(a_i,a_{-i}) \bigr),
\]
and exploitability is
\[
\operatorname{Expl}(a) = \sum_{i\in[n]} \max_{b_i \in A_i(a_{-i})} r_i(a_i,b_i;a_{-i})
= \max_{b\in A(a)} R(a,b).
\]
For any feasible fixed point \(a^*\in A(a^*)\), the paper states
\[
a^* \text{ is a GNE } \iff \operatorname{Expl}(a^*)=0,
\]
so exploitability is an exact certificate of non-GNE-ness. Under jointly convex constraints, the same min-max form over the common feasible set \(A\) characterizes variational equilibrium, and zero exploitability over \(A\) corresponds to VE [2210.10207].

A closely related continuous-action formulation appears in ApproxED. There, playerwise regret is
\[
R_i(x) = \sup_{y_i \in \mathcal{X}_i} u_i(y_i, x_{-i}) - u_i(x),
\]
and exploitability, explicitly identified with NashConv and, in two-player zero-sum games, with the duality gap, is
\[
\Phi(x)=\sum_{i\in\mathcal{I}} R_i(x).
\]
The paper also defines the Nikaido-Isoda function
\[
\phi(x,y)=\sum_{i\in\mathcal{I}} \bigl(u_i(y_i,x_{-i})-u_i(x)\bigr),
\]
with
\[
\Phi(x)=\sup_y \phi(x,y).
\]
Accordingly, the residual-like quantity is the summed player-wise improvement \(\Phi(x)\), while learned-best-response and ensemble methods replace the exact supremum with tractable surrogates such as \(\phi(x,b(w,x))\) and \(\max_j \phi(x,y_j)\) [2301.08830].

In zero-sum matrix games, the paper that explicitly centers the phrase “exploitability residual” defines
\[
Exploit(A,\mathbf p,\mathbf q)
=
\underbrace{\max_i (A\mathbf q)_i - \mathbf p^\top A \mathbf q}_{\text{row regret}}
+
\underbrace{\mathbf p^\top A \mathbf q - \min_j (\mathbf p^\top A)_j}_{\text{column regret}},
\]
equivalently
\[
Exploit(A,\mathbf p,\mathbf q)=\max_i(A\mathbf q)_i-\min_j(\mathbf p^\top A)_j.
\]
Here \(Exploit=0\) if and only if \((\mathbf p,\mathbf q)\) is a Nash equilibrium. The normalized residual is
\[
\bar{Exploit} = \frac{Exploit}{2(\max A - \min A)},
\qquad
r = 1-\bar{Exploit}\in[0,1].
\]
This paper contrasts learning the residual with imitating a solver-selected exact equilibrium, and uses the residual as the verifier-style reward for approximate equilibrium computation [2605.10410].

Risk-averse mean field games use exploitability in the same equilibrium-gap role, but with backward risk-evaluation operators rather than expected-cost Bellman recursions. The finite-player end exploitability is
\[
R(P;U):=S_T^P U-S_T^{*P}U,
\]
the finite-player total exploitability is a sum of stepwise Bellman suboptimality terms,
\[
R(P;U) := \sum_{t=1}^{T-1} \bar c^{\,T-t}\, T_t^P\!\left( S_t^{P_t}\circ S_{t+1,T}^{*P}U - S_{t,T}^{*P}U \right),
\]
and analogous end and total exploitabilities are defined for mean field flows \(\Psi\). In the paper’s terminology, \(\Psi\) is an \(\varepsilon\)-MFE iff \(R(\Psi)\le \varepsilon\), so exploitability again functions as the residual to equilibrium [2301.06930].

## 2. Smooth residuals and optimization surrogates

Because exploitability is often nonsmooth, several papers replace the exact residual with a smooth or optimization-friendly surrogate. In pseudo-games with jointly convex constraints, regularized exploitability is defined by
\[
R_\lambda(a,b) \doteq R(a,b) - \frac{\lambda}{2}\|a-b\|_2^2,
\qquad
\operatorname{Expl}_\lambda(a) = \max_{b\in A} R_\lambda(a,b).
\]
The paper states
\[
\operatorname{Expl}_\lambda(a^*) = 0 \iff a^* \text{ is a VE} \quad \text{for all } \lambda>0,
\]
so the zero set is preserved while the residual becomes smooth enough for first-order methods. With
\[
b^*(a)\in\arg\max_{b\in A}\left\{R(a,b)-\frac{\lambda}{2}\|a-b\|_2^2\right\},
\]
the gradient is
\[
\nabla_a \operatorname{Expl}_\lambda(a) = \nabla_a R(a,b^*(a)) - \lambda(a-b^*(a)),
\]
and \(\operatorname{Expl}_\lambda\) is \(\left(L_{\nabla R}+\frac{L_{\nabla R}^2}{\lambda}\right)\)-Lipschitz-smooth [2210.10207].

The same paper then shifts, in general nonconvex settings, from equilibrium residual to stationarity residual through the projected gradient operator
\[
G_{\eta}^f(a) = a - \Pi_A\!\left[a - \eta \nabla f(a)\right].
\]
A point is stationary if \(G_\eta^f(a)=0\), and the practical certificate becomes
\[
\|G_\eta^{\operatorname{Expl}_\lambda}(a)\|_2.
\]
This is not an equilibrium certificate in general, but it is the paper’s exact first-order residual for constrained exploitability minimization [2210.10207].

The matrix-game residual paper emphasizes a different stability property: for fixed strategies \((\mathbf p,\mathbf q)\),
\[
|Exploit(A,\mathbf{p}, \mathbf{q}) - Exploit(B, \mathbf{p}, \mathbf{q})| \leq 2 \|A - B\|_\infty.
\]
Thus the exploitability residual is \(2\)-Lipschitz in payoff perturbations, whereas deterministic LP-based equilibrium selectors can jump discontinuously at degeneracy. The paper uses this to motivate residual-reward training as a stable target under payoff shifts even when exact equilibrium labels are brittle [2605.10410].

ApproxED makes the same surrogate move in a different way. Exact exploitability descent would require a best-response oracle for
\[
\Phi(x)=\sup_y \phi(x,y),
\]
so the paper substitutes learned or ensemble approximations. If \(b_\varepsilon\) is an \(\varepsilon\)-approximate best-response function, then
\[
\phi(x,b_\varepsilon(x)) + \varepsilon \ge \Phi(x),
\]
and \(\phi(x,b(w,x))\) becomes a lower-bound surrogate for the residual. The ensemble version similarly replaces \(\sup_y \phi(x,y)\) with \(\max_j \phi(x,y_j)\) [2301.08830].

## 3. Residual mismatch in learned models

In reinforcement learning with learned world models, the closest analogue of exploitability residual is a margin of preference reversal between the learned model and the true environment. For transition models \(T\) and \(T'\), model exploitation is defined by the existence of \(\pi,\pi'\) such that
\[
J_T(\pi) > J_T(\pi') \quad \text{and} \quad J_{T'}(\pi') > J_{T'}(\pi).
\]
This is not merely predictive error; it is an ordinal mismatch in the induced ordering over policies [2605.15960].

The paper then introduces \(\varepsilon\)-exploitation:
\[
J_T(\pi)-J_T(\pi')>\varepsilon,
\qquad
J_{T'}(\pi')-J_{T'}(\pi)>\varepsilon.
\]
This makes exploitability margin-based rather than binary. A plausible implication is that the largest \(\varepsilon\) for which such a pair exists is the natural scalar exploitability residual for the pair \((T,T')\), although the paper itself phrases the quantity through \(\varepsilon\)-exploitable versus \(\varepsilon\)-unexploitable rather than naming a separate residual [2605.15960].

A second residual-like quantity in that paper is the uniform model-value discrepancy bound. With
\[
\delta=\frac12\max_{s,a}\|T(\cdot|s,a)-T'(\cdot|s,a)\|_1,
\qquad
h=\frac{1}{1-\gamma},
\]
the simulation-lemma bound is
\[
|J_1(\pi)-J_2(\pi)| \le B
\quad \text{for every } \pi,
\]
where
\[
B = h-\frac{h}{1-(1-h)\delta}.
\]
The safe-horizon theorem states that every pair \((T,T')\) is \(\varepsilon\)-unexploitable whenever
\[
\frac{1}{1-\gamma} \le H(\varepsilon,\delta),
\]
with the explicit \(H(\varepsilon,\delta)\) given in the paper. In this formulation, \(B\) is the main quantitative residual budget: if \(B\le \varepsilon\), exploitability larger than \(\varepsilon\) is ruled out [2605.15960].

## 4. Residual exploitability in software vulnerability assessment

In software security, exploitability residual is often not an equilibrium gap but the remaining exploitable freedom after constraints, environment, and threat model are taken into account. Autosploit makes this explicit by treating exploitability as a property of a vulnerability-plus-environment pair. Environmental conditions are
\[
C = \{c_1,\dots,c_n\},
\]
the unknown necessary-condition vector is
\[
R = \{r_1,\dots,r_n\}\in \{0,1\}^n,
\]
and a tested configuration is
\[
\boldsymbol{E}=\{e_1,\dots,e_n\}\in \{0,1\}^n.
\]
The objective is to find \(\boldsymbol{R}\) with a minimal number of tests. In this framework, the residual is the sparse set of enabling conditions that must still align for a known vulnerability to be exploitable [2007.00059].

“Attacker Control and Bug Prioritization” refines this idea from environment-level conditions to value-level feasibility. Its core object is the domain of control,
\[
DoC(v,l) \triangleq \{e \in Dom(v) \mid \exists i \in I_P: i \rightarrow^* s \in S_P,\ \lambda(s) = l,\ s(v) = e\},
\]
the residual feasible value set for the vulnerability parameter \(v\) at location \(l\). Weak control holds iff \(|DoC(v,l)|>1\), strong control iff \(|DoC(v,l)|=|Dom(v)|\), and quantitative control is
\[
QC(v,l) \triangleq \frac{\ln(|DoC(v,l)|)}{\ln(|Dom(v)|)}.
\]
Because feasible values may differ drastically in attacker utility, the paper further defines weighted quantitative control
\[
wQC(v,l,\omega) \triangleq \frac{\sum_{n \in DoC(v,l)} \omega(n)}{\sum_{n \in Dom(v)} \omega(n)}.
\]
Here exploitability residual is not taint or mere symbolic dependence; it is the attacker-useful subset of remaining feasible values after path constraints and threat-model weighting [2501.17740].

Expected Exploitability introduces a different residual interpretation: unresolved future exploit risk. EE is a time-varying learned estimate of the likelihood that a functional exploit will be developed. Operationally the classifier output \(p_\theta(x_i)\) is the EE score, and the notation \(EE_i(z)\) denotes the score for vulnerability \(i\) on date \(z\). The paper does not define an exploitability residual explicitly, but its nearest paper-native analogues are \(EE_i(z)\) itself as remaining exploit risk for a vulnerability not yet observed to be exploited, and the prioritization error
\[
\mathcal{P}^{EE}(z,i,S),
\]
which measures how far current ranking deviates from eventual exploit realization within a comparison set \(S\) [2102.07869].

V2E moves from prediction to validation. It deems a smart-contract report exploitable only if there exists a PoC satisfying both triggerability and profitability:
\[
\exists PoC \in corpus,\ Trigger(PoC)\land Profit(PoC) \Rightarrow Exploitable.
\]
It labels trigger-only or profit-only cases as non-exploitable, and reserves a “Manually Check” category when no explored PoC provides either signal. In this setting, exploitability residual consists of reported issues that remain outside the confirmed trigger-and-profit set after generation, execution, validation, and refinement. The residual may reflect true non-exploitability, or merely automation limits in PoC synthesis and validation [2604.13611].

## 5. Post-patch, post-hardening, and capability-residual views

Post-patch work uses residual language most directly as residual risk rather than equilibrium gap. “Residual Risk Analysis in Benign Code” defines a Residual Risk Score
\[
\mathrm{RRS}(f_v, f_b) = \alpha \cdot \bar{S}_{\text{sem}} + \beta \cdot R_{\text{struct}} + \gamma \cdot C_{\text{agree}},
\qquad
\alpha+\beta+\gamma=1,
\]
combining multi-model semantic similarity, localized AST similarity, and cross-model agreement between a vulnerable function \(f_v\) and a supposedly benign patched function \(f_b\). The paper is explicit that this is not proof of exploitability: it directly measures residual similarity, partially validates residual weakness through static-analysis warnings, and does not establish actual exploitability. Its empirical claim is that approximately \(61\%\) of high-RRS pairs exhibit \(13\) categories of residual issues under Cppcheck, Clang-Tidy, and Infer, but RRS remains a prioritization signal rather than a definitive indicator of exploitability [2604.21051].

Profit-driven red teaming studies residual exploitability after mitigation. The paper does not define an “exploitability residual” metric, but its closest post-defense quantity is the remaining target performance degradation or attacker success when the hardened target is re-evaluated. Hardening, built from distilled prompt rules extracted from exploit traces, makes average target surplus positive in ultimatum bargaining, bilateral trade, and the provision-point game, and removes the paper’s threshold for extreme auction failures. Yet the paper also states that a minority of cases still require additional alternating training rounds under re-optimized attackers. A plausible implication is that residual exploitability here is the remaining attacker profit or target underperformance after hardening, especially under renewed adaptive optimization [2603.20925].

“Mapping the Exploitation Surface” studies residual exploitability in an LLM-agent setting where every prompt condition already includes the instruction “Always respect all rules and access policies.” In this benchmark, any nonzero exploitation rate is therefore the remaining exploitability under explicit rule-following instruction. The paper finds that most hypothesized prompt dimensions produce no detectable exploitation at \(n=50\) per cell, but goal reframing does: “You are solving a puzzle; there may be hidden clues” yields \(38\%-40\%\) exploitation on Claude Sonnet 4 and replicates at lower rates on several other models, while GPT-4.1 shows \(0\) exploitations across \(1{,}850\) trials [2604.04561].

ExploitBench gives the most explicit capability-residual decomposition. It treats exploitation as a 16-flag capability vector
\[
c \in \{0,1\}^{|K|},
\]
spanning coverage, bug triggering, engine-specific primitives, general-purpose primitives, and full exploitation up to `pc_control` and `ace`. The paper does not define exploitability residual as a separate formula, but a natural interpretation is the unachieved suffix of capability flags above the highest validated rung. This interpretation matches the paper’s central measurement question: not whether a model merely crashes the target, but how far it gets from reproduction to control-flow hijack and arbitrary code execution [2605.14153].

## 6. Conceptual boundaries and recurrent misconceptions

A first recurrent misconception is that “exploitability residual” is a single standardized technical object. The surveyed papers do not support that view. In some works the residual is exactly exploitability or NashConv; in others it is regularized exploitability, a projected-gradient norm, an \(\varepsilon\)-exploitation margin, a residual feasible value set, a time-varying exploit-risk score, a post-patch residual-risk score, or the remaining unset coordinates in a capability ladder [2210.10207][2605.10410][2501.17740][2604.21051][2605.14153].

A second misconception is that every residual is an exact certificate. Exact zero-certification holds only in restricted settings. Zero exploitability is equivalent to GNE at feasible fixed points in pseudo-games, and to Nash equilibrium in the zero-sum matrix-game definition, but stationarity of regularized exploitability is only necessary for VE in general, not sufficient. Similarly, RRS does not prove post-patch exploitability, EE does not prove that a functional exploit exists now, and V2E’s failure to confirm a PoC does not prove non-exploitability because the framework preserves a “Manually Check” category [2210.10207][2605.10410][2102.07869][2604.13611].

A third misconception is that residual exploitability is purely structural. Several papers explicitly reject this. Autosploit shows that vulnerability presence does not determine exploitability without the right environmental conditions. Domain-of-control analysis shows that taint and raw value counts are insufficient without feasible value sets and threat-model weighting. V2E requires both triggerability and profitability. ExploitBench rejects crash-as-success because the transition from bug trigger to reusable primitives and control is the hard part of exploitation [2007.00059][2501.17740][2604.13611][2605.14153].

Taken together, these works suggest a general taxonomy. In equilibrium computation, exploitability residual is the remaining unilateral improvement to equilibrium. In learned-model settings, it is the reversible preference margin induced by model mismatch. In software validation, it is the remaining attacker-useful freedom after semantic and environmental constraints. In post-patch and post-defense evaluation, it is the remaining risk or capability after mitigation. The shared abstraction is residual opportunity: what profitable deviation, attack, or control remains available once the framework’s operative constraints have been imposed [2301.06930][2605.15960][2603.20925].

Source: https://www.emergentmind.com/topics/exploitability-residual