Norm-Responsive Punishers: Social Norm Enforcement

• The paper demonstrates that conditioning punishment on learned social norms increases enforcement efficiency compared to fixed or payoff-based strategies.
• It details computational models where agents learn norm signals from public sanctions, enabling context-sensitive escalation and targeted punishment.
• The research highlights potential pitfalls like norm lock-in, misclassification, and antisocial punishment, underscoring the need for careful system design.

Searching arXiv for the cited and closely related work on norm-responsive punishment and social norms. Norm-responsive punishers are agents or actors whose sanctioning decisions are contingent on an inferred or explicit social norm rather than on a fixed punitive heuristic or on immediate self-regarding payoff alone. Across computational multi-agent systems, evolutionary public-goods models, indirect-reciprocity frameworks, and game-theoretic treatments of institutional emergence, the common feature is conditional enforcement: punishment is activated, modulated, or justified by the local or collective standard of acceptable conduct. In decentralized multi-agent learning, this standard can be learned from public sanction streams alone (Vinitsky et al., 2021). In spatial public-goods models, it can be implemented as context-sensitive escalation rules tied to local cooperation density (Lee et al., 6 Jul 2025). In indirect reciprocity and institutional theory, it appears as punishment of those categorized as norm violators under a public assessment rule or emergent sanctioning convention (Murase, 2024); (Sasaki et al., 2014). The resulting literature treats norm-responsive punishment as a mechanism for equilibrium selection, startup-problem resolution, cost containment, and the endogenous stabilization of cooperative orders.

1. Definition and conceptual scope

Norm-responsive punishment denotes sanctioning behavior that is responsive to a norm signal, where the norm may be learned from observed sanctions, derived from local majority behavior, encoded by a reputation system, or institutionalized as a rule about contributions and compliance. In the decentralized multi-agent setting of “A learning agent that acquires social norms from public sanctions in decentralized multi-agent settings,” norm-responsive punishers are defined as agents whose decisions to punish or refrain from punishing are driven by learned predictions of the group’s social norm inferred solely from publicly observable sanctioning events (Vinitsky et al., 2021). Formally, each agent maintains a binary classifier $C_\phi(c)\in[0,1]$ over sanction contexts and is intrinsically motivated to align its own punishment choice with the classifier’s prediction.

This distinguishes norm-responsive punishers from unconditional punishers and from purely payoff-based punishers. Unconditional punishers enforce fixed target rules regardless of context. Purely payoff-based punishers punish only when doing so immediately improves extrinsic reward. By contrast, norm-responsive punishers condition enforcement on whether a behavior is classified as approved or disapproved by a collective rule representation, whether implicit or explicit (Vinitsky et al., 2021). In a spatial public-goods formulation, this same idea appears as context-sensitive punishers that intensify sanctions only when at least half of the focal group already cooperates, rather than punishing at uniform intensity across all contexts (Lee et al., 6 Jul 2025).

The literature uses several non-equivalent operationalizations. One line models norm responsiveness as conformity to a learned group classifier from public sanction data (Vinitsky et al., 2021). Another treats it as dependence on local majority composition, so that majority strategies punish minority strategies or cooperative-majority groups trigger intensified sanctions (Yang et al., 2018); (Lee et al., 6 Jul 2025). A third ties punishment to reputation and second-order assessment, such that bad recipients or low-reputation actions become legitimate punishment targets under a social norm (Murase, 2024); (Podder et al., 2021). A fourth places norm responsiveness at the level of institutional legitimacy: once a rule such as “non-contribution to the punishment pool is bad” is retrospectively recognized, punishers enforce it prospectively and preemptively (Sasaki et al., 2014).

A plausible implication is that “norm-responsive punishers” is best understood as a family resemblance concept rather than a single formal object. What unifies the family is not one payoff equation, but the dependence of sanctioning on a socially grounded evaluative state.

2. Learned norm responsiveness in decentralized multi-agent systems

A particularly explicit formalization appears in the CNM architecture of (Vinitsky et al., 2021). Each agent receives a per-agent local observation $o^{(i)}_t$, consisting of an $88\times 88$ RGB egocentric view plus internal state, and a public sanction observation

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$

where $z=1$ denotes disapproval and $z=0$ approval (Vinitsky et al., 2021). Sanctioning events are the only shared learning signal; agents do not access others’ rewards or policies.

The classifier module implements

$C_\phi(c)=\Psi_\phi(c)\in[0,1],$

interpreted as the probability that the group disapproves in context $c$. The classifier uses a ConvNet $(16,32)$ with kernel sizes $(8,4)$ and strides $o^{(i)}_t$0, followed by an MLP $o^{(i)}_t$1 and a softmax over $o^{(i)}_t$2 (Vinitsky et al., 2021). In the reported environments, the context is the single image frame immediately preceding a potential sanction. The classifier is trained with labels derived exclusively from public sanctions using a cross-entropy loss,

$o^{(i)}_t$3

Balanced sampling and RMSProp optimization are used, and classifier learning is frozen after a fixed number of steps to avoid catastrophic forgetting under distribution shift (Vinitsky et al., 2021).

The policy module is

$o^{(i)}_t$4

with

$o^{(i)}_t$5

The binary classifier output is concatenated after the policy MLP and before the LSTM, and passes without gradient so as to avoid entangling learning dynamics (Vinitsky et al., 2021). Enforcement is shaped by the intrinsic pseudoreward

$o^{(i)}_t$6

The agent thereby maximizes discounted extrinsic reward plus this intrinsic term:

$o^{(i)}_t$7

This formulation makes norm responsiveness endogenous. The norm is not hard-coded; it is the fixed point of public sanction observations, classifier training, and intrinsic alignment. The paper reports that classifier balanced accuracy rapidly becomes high using only one prior frame as context, and that freezing the classifier at $o^{(i)}_t$8 to $o^{(i)}_t$9 steps prevents forgetting while norms persist (Vinitsky et al., 2021). In Allelopathic Harvest, CNM increases monoculture fraction above $88\times 88$0 and raises collective return over $88\times 88$1 seeds; in Clean Up with Startup Problem, it increases pollution imbalance and substantially raises collective return over $88\times 88$2 seeds (Vinitsky et al., 2021). Notably, welfare gains do not arise from reducing punishment volume: total zaps do not decrease in AH and increase in CSP, so improvement is attributed to better-directed enforcement (Vinitsky et al., 2021).

3. Context sensitivity, sanction intensity, and spatial allocation

A second major formalization treats norm responsiveness as adaptive sanction intensity tied to local cooperation conditions. In the four-strategy spatial public-goods model of Lee, Cleveland, and Szolnoki, norm-responsive punishers $88\times 88$3 double both fine and cost whenever at least half of the focal group cooperates (Lee et al., 6 Jul 2025). The population is arranged on an $88\times 88$4 square lattice with periodic boundary conditions and von Neumann neighborhoods. Each player participates in $88\times 88$5 overlapping games. The strategies are cooperators $88\times 88$6, defectors $88\times 88$7, uniform punishers $88\times 88$8, and norm-responsive punishers $88\times 88$9 (Lee et al., 6 Jul 2025).

Let

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$0

denote the local cooperation level. In Model 1, escalation occurs when $$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$1; in Model 2, when $$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$2. With $$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$3 for Model 1, the payoffs are

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$4

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$5

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$6

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$7

where $$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$8 (Lee et al., 6 Jul 2025). Thus, the same norm-responsive punisher can punish “hard” in one group and “soft” in another simultaneously.

Monte Carlo simulations with asynchronous Fermi updating,

$$\mathcal{B}(s_{t-1}, a_{t-1}) = \{(i,j,c,z): (i,j)\in\mathcal{J}(s_{t-1}),\ c=\mathcal{C}(s_{t-1},i,j),\ z=\mathcal{Z}(s_{t-1},a_{t-1},i,j)\},$$9

show that Model 1 eliminates defectors at fines about $z=1$0–$z=1$1 lower than uniform enforcement, with the benchmark comparison at $z=1$2, $z=1$3 giving $z=1$4 versus $z=1$5, a relative reduction of about $z=1$6 (Lee et al., 6 Jul 2025). The paper attributes this to interface targeting: norm-responsive punishers conserve resources in defector-dominated regions and intensify sanctions only near cooperative–defector boundaries, creating self-reinforcing fronts.

Related spatial work uses other local triggers. In the altruistic-punisher model of (Flores et al., 2020), punishers behave exactly like cooperators when no defectors are present locally and punish all local defectors otherwise, with payoffs

$z=1$7

where $z=1$8 and $z=1$9 (Flores et al., 2020). This is norm responsiveness in the minimal sense that sanctioning is triggered only by local norm violations. In the adaptive-punishment framework of (Perc et al., 2012), each cooperator has a punishing activity $z=0$0 that increases when defectors successfully invade and decreases when defectors fail to spread. Per-group payoffs are

$z=0$1

$z=0$2

Punishment thus escalates precisely at invasion fronts and decays elsewhere, yielding what the paper characterizes as globally negligible investments (Perc et al., 2012).

These models share a structural claim: sanctioning efficiency depends not only on fine magnitude, but on spatial and contextual allocation. Experimental evidence from a repeated five-person snowdrift game points in the same direction. With identical punisher cost $z=0$3, mild punishment $z=0$4 and severe punishment $z=0$5 perform differently depending on whether cooperation is likely ($z=0$6) or highly improbable ($z=0$7). When cooperation is likely, severe punishment does not materially increase cooperation over mild punishment but lowers average payoffs; when conditions are adverse, severe punishment is necessary to raise both cooperation and welfare (Jiang et al., 2013). This suggests that norm responsiveness can also be understood as regime-sensitive calibration of sanction severity.

4. Social norms, reputation, and norm internalization

In indirect reciprocity, norm-responsive punishment is grounded in assessment rules that specify when punishment is justified and how it affects the punisher’s reputation. In the donation-game model with costly punishment and asymmetric detection errors, actions are $z=0$8 and reputations are binary $z=0$9. A social norm comprises an action rule $C_\phi(c)=\Psi_\phi(c)\in[0,1],$0 and an assessment rule $C_\phi(c)=\Psi_\phi(c)\in[0,1],$1 (Murase, 2024). The norm-responsive punitive class is the set of CP norms with $C_\phi(c)=\Psi_\phi(c)\in[0,1],$2 and $C_\phi(c)=\Psi_\phi(c)\in[0,1],$3: good recipients are helped, bad recipients are punished.

The model introduces assessment error $C_\phi(c)=\Psi_\phi(c)\in[0,1],$4 and a defection-detection error $C_\phi(c)=\Psi_\phi(c)\in[0,1],$5, with detectability $C_\phi(c)=\Psi_\phi(c)\in[0,1],$6 and social resolution $C_\phi(c)=\Psi_\phi(c)\in[0,1],$7. Effective assessments are

$C_\phi(c)=\Psi_\phi(c)\in[0,1],$8

$C_\phi(c)=\Psi_\phi(c)\in[0,1],$9

$c$0

For CP norms, necessary conditions include

$c$1

and, under a stern-judging-like map with $c$2, $c$3, $c$4, sufficient conditions include

$c$5

All listed ESS CP norms achieve cooperation level $c$6 (Murase, 2024).

The interpretation is explicitly norm responsive. Punishment is not simply available; it is prescribed against bad recipients and rewarded if justified. Under low detectability of defection, costly punishment can become the most efficient evolutionarily stable regime because it raises the value of being good from $c$7 to $c$8, restoring deterrence when misperceived defection undermines reputation-only cooperation (Murase, 2024).

A different route to norm-responsive punishment uses coarse public reputations and conditional participation. In the optional public goods game, actions are cooperate $c$9, defect $(16,32)$0, or opt out $(16,32)$1, and social norms assign reputations $(16,32)$2 to $(16,32)$3 and $(16,32)$4 while always giving $(16,32)$5 reputation $(16,32)$6 (Podder et al., 2021). Conditional strategies of the form $(16,32)$7 choose a primary action $(16,32)$8 when the average co-player reputation exceeds $(16,32)$9 and a backup action $(8,4)$0 otherwise. The main result is that norms satisfying $(8,4)$1 permit reputation and punishment to act synergistically, yielding high cooperation, typically $(8,4)$2–$(8,4)$3 under the main parameterization with $(8,4)$4 (Podder et al., 2021). Under these conditions, prosocial punishment persists at low levels, antisocial punishment is almost completely eliminated, and transitions flow predominantly from punishing to non-punishing variants.

Norm internalization can also amplify norm-responsive sanctioning without explicit punisher roles. In the group-selection model of (Odouard et al., 2021), agents cooperate when

$(8,4)$5

where $(8,4)$6 is updated by conformist learning in norm internalizers. Punishment is exclusion from the current public-good share when defection is observed, and the expected sanction equals $(8,4)$7, with

$(8,4)$8

Since $(8,4)$9 increases with the cooperation rate $o^{(i)}_t$00, sanction severity rises with norm strength. The paper reports that norm internalizers often remain a minority, around $o^{(i)}_t$01 when most effective, yet polarize, catalyze, and stabilize cooperation by raising the deterrent effect of this endogenous punishment regime (Odouard et al., 2021). This suggests that norm responsiveness can reside not only in punisher policy, but in the social process that makes violations more consequential as compliance grows.

5. Institutional emergence, majority norms, and second-order enforcement

Norm-responsive punishment is central to theories of sanctioning institutions because institutions require punishment to track rule compliance, not merely direct harm. In (Sasaki et al., 2014), the key puzzle is the origin of second-order pool punishment: punishing those who do not contribute to the punishment fund seems tautological, since the legitimacy of such punishment presupposes the norm it is supposed to create. The proposed resolution is preemptive punishment of homo sacer, coupled with symmetry bias in observers’ reasoning. A public, preemptive sanction causes observers to infer retrospectively that the target was bad and that the punisher was good, thereby retrospectively constructing the rule “non-contribution is bad.” Once that rule is collectively recognized, punishment becomes norm responsive in the institutional sense: sanctions track conformity to the rule “contribute to the punishment pool or be punished” (Sasaki et al., 2014).

The paper’s reconstructed formalization uses pool-punishers $o^{(i)}_t$02, cooperators $o^{(i)}_t$03, defectors $o^{(i)}_t$04, and optional zealots $o^{(i)}_t$05 in a two-stage public-goods game with institutional activation probability

$o^{(i)}_t$06

Expected payoffs are

$o^{(i)}_t$07

with corresponding replicator dynamics

$o^{(i)}_t$08

Although the article explicitly notes that these equations are reconstructed rather than given directly by the authors, the conceptual point is unambiguous: once a rule exists, punishers become norm-responsive because they sanction second-order noncompliance rather than personal injury (Sasaki et al., 2014).

A more local and composition-driven notion appears in majority-based punishment. In (Yang et al., 2018), majority players punish minority players within each public-goods group, regardless of whether the minority are cooperators or defectors. This makes sanctions prosocial when cooperators are locally dominant and antisocial when defectors are dominant. The interface analysis yields

$o^{(i)}_t$09

For strong punishment, the model exhibits a discontinuous transition: at $o^{(i)}_t$10, the cooperation fraction jumps from $o^{(i)}_t$11 to $o^{(i)}_t$12 at approximately $o^{(i)}_t$13, and coexistence disappears for $o^{(i)}_t$14 (Yang et al., 2018). Here norm responsiveness means conformity enforcement relative to the local majority norm, not to an exogenous prosocial standard.

The distinction matters because it reveals a recurrent ambiguity in the literature. “Norm-responsive” does not necessarily mean “cooperation-promoting.” It means sanctioning is conditional on a norm signal, and the norm signal may encode a harmful equilibrium. The CNM paper explicitly identifies harmful norm lock-in, arbitrary or unfair rules, and manipulative sanctioning as failure modes (Vinitsky et al., 2021). Majority-based punishment similarly shows that when defectors are locally prevalent, cooperative minorities can become punishment targets (Yang et al., 2018).

6. Efficiency, failure modes, and open controversies

A central claim across the literature is that norm-responsive punishment can be more efficient than uniform or unconditional punishment because it targets sanctions where they have highest marginal effect. In the spatial public-goods model of (Lee et al., 6 Jul 2025), the efficiency gain does not come from cheaper punishment per act: norm-responsive punishers and uniform punishers maintain identical fine-to-cost ratios. The gain comes from better spatial targeting. In the adaptive-punishment lattice model of (Perc et al., 2012), punishing activity rises only when defectors invade and decays when they do not, so long-run sanctioning costs vanish in pure-cooperation states. In the snowdrift experiment of (Jiang et al., 2013), mild punishment is welfare-superior when cooperation is already likely, whereas severe punishment is warranted only under highly adverse conditions. In the optional public-goods game, reputation makes punishment largely redundant, so norm-responsive systems can sustain cooperation while substantially reducing both punishment use and antisocial punishment (Podder et al., 2021).

A second recurring theme is second-order burden. Punishers bear costs and thus invite free-riding by nonpunishing cooperators. Different models address this differently. In spatial altruistic punishment, compact cluster geometry insulates interior punishers and creates a symbiotic $o^{(i)}_t$15 structure when punishment cost is high (Flores et al., 2020). In cooperator-driven versus defector-driven punishment, structured populations favor cooperator-driven punishment because it better exploits network reciprocity and mutualism with nonpunishing cooperators, but only at intermediate feedback sensitivity $o^{(i)}_t$16; excessive responsiveness produces over-punishment at cluster borders (Cui et al., 2019). In CNM, the intrinsic terms $o^{(i)}_t$17 and $o^{(i)}_t$18 must satisfy heuristic thresholds such as $o^{(i)}_t$19 and $o^{(i)}_t$20 for stable alignment (Vinitsky et al., 2021).

The literature also documents several failure modes.

Failure mode	Description	Source
Misclassification and forgetting	Continued classifier training can reinforce harmful sanctions after exploration noise or norm-induced distribution shift	(Vinitsky et al., 2021)
Harmful norm lock-in	Early random bandwagons can stabilize suboptimal or unfair conventions	(Vinitsky et al., 2021)
Antisocial norm enforcement	Majority- or defector-aligned punishment can entrench defection or punish cooperative minorities	(Yang et al., 2018); (Powers et al., 2012)
Over-punishment	Excessive responsiveness lowers punisher payoffs and can reverse border advantages	(Cui et al., 2019)

Antisocial punishment is particularly important. In group-structured populations with both pro-social and anti-social punishers, anti-social punishment can prevent the evolution of pro-social punishment and cooperation over a range of group sizes and dispersal frequencies (Powers et al., 2012). The model’s expected-fitness thresholds show strong positive frequency dependence for both prosocial and antisocial punishers. Thus, punishers enforce the prevailing norm in an evolutionary sense even when their target rules are unconditional. This extends the concept of norm responsiveness from policy to selection: whichever side is locally common bears lower punishment cost and inflicts greater cumulative harm on the minority (Powers et al., 2012).

A plausible implication is that norm-responsive punishment is not normatively benign by construction. Its effectiveness and ethical valence depend on how norm signals are generated, aggregated, and stabilized.

7. Research directions and practical significance

Several papers translate norm-responsive punishment into design guidance for artificial or institutional systems. The decentralized CNM framework is explicitly motivated by settings where sharing rewards or policies is infeasible or undesirable, including privacy-preserving and heterogeneous human–machine systems (Vinitsky et al., 2021). The practical prescription is to log public sanction tuples, learn a classifier over contexts, freeze or slow classifier updates after norm formation, calibrate intrinsic incentives to align with opportunity costs, audit sanction streams for manipulation, and provide interpretability and human oversight to detect harmful norms (Vinitsky et al., 2021).

Recent MARL work pushes this further by combining severity-sensitive sanctioning with learned defection awareness. In Adaptive Punishment for Cooperation, each ordered pair $o^{(i)}_t$21 is assigned a learned defection-severity distribution $o^{(i)}_t$22 and an adaptive punishment probability

$o^{(i)}_t$23

where $o^{(i)}_t$24 flags ineffective punishment windows (Tang et al., 23 May 2026). Punishment intensity is then

$o^{(i)}_t$25

with $o^{(i)}_t$26. The paper characterizes this as targeted, proportional, and cost-aware punishment and reports strong empirical performance across sequential social dilemmas (Tang et al., 23 May 2026). This suggests a convergence between sanction-learning architectures and older adaptive-punishment theory: both move toward context-dependent intensity and endogenous suppression of wasteful enforcement.

Indirect-reciprocity research also points to open analytical questions. The 2025 study on heterogeneous error-proneness shows that among the leading eight norms, L8 (“Judging”) is uniquely positioned to impose the strongest payoff penalties on error-prone assessors because only L8 has $o^{(i)}_t$27 in the continuous interpolation (Le et al., 28 Feb 2025). There, norm-responsive punishment takes the form of a social norm whose payoff consequences are highly sensitive to individual conformity in assessment, not just to action. This broadens the concept beyond punishing behaviors to punishing cognitive unreliability.

Across these domains, several unresolved issues recur. One is generalization across topologies, information regimes, and heterogeneous populations; many quantitative thresholds are environment-specific (Lee et al., 6 Jul 2025); (Perc et al., 2012). Another is adversarial manipulation of public sanctions or reputational data, especially when sanctions are the sole public signal (Vinitsky et al., 2021). A third is the ethical status of emergent norms: models repeatedly show that stable sanctioning patterns may be arbitrary, inequitable, or “silly,” yet still self-reinforcing (Vinitsky et al., 2021); (Sasaki et al., 2014).

Taken together, the literature portrays norm-responsive punishers as a general solution concept for enforcement under decentralization and uncertainty. They are most effective when the norm signal is informative, sanctioning is allocated to high-leverage contexts, and the system contains mechanisms that prevent misclassification, lock-in, and adversarial distortion. They are least benign when conformity itself, rather than prosociality, becomes the object of stabilization.