Sequential Stackelberg Security Game

• Sequential Stackelberg Security Game is a leader–follower model where the defender commits to a mixed protection strategy and the attacker best-responds.
• The framework models resource allocation using mixed strategies and coverage vectors to precisely quantify defensive payoffs and attacker incentives.
• Dynamic extensions incorporate Bayesian and partially observable settings, using methods like backward induction and MILP to refine equilibrium and inducibility.

A Sequential Stackelberg Security Game is a leader–follower security setting where the defender commits to a possibly mixed protection strategy first, the attacker observes this commitment, and then chooses an attack strategy as a best response. In the basic formulation, the interaction is modeled as a dynamic, extensive-form game with perfect information, and the solution concept is Stackelberg equilibrium, computed via backward induction. In the security literature, this template appears in static target-allocation models, stochastic Markov games with attacker types, partially observable stochastic games with public actions, and graph-based multi-drone defense, with different equilibrium refinements used to capture observability, tie-breaking, and information leakage (Iqbal et al., 22 May 2025).

1. Canonical leader–follower structure

In a standard Stackelberg security game, the defender chooses a mixed strategy $x$ over feasible resource allocations, the attacker observes $x$, and then chooses a best-response mixed attack strategy $y(x)$ over targets. The attacker’s problem is written as

$y^*(x) \in \arg\max_y \; U_A(x,y),$

while the defender anticipates this response and solves

$x^* \in \arg\max_x \; U_D\bigl(x,y^*(x)\bigr).$

The pair $(x^*,y^*(x^*))$ is the Stackelberg equilibrium. This is the basic backward-induction template: characterize the follower’s best response for each leader action, then choose the leader action that maximizes the leader payoff under that response (Iqbal et al., 22 May 2025).

The extensive-form foundation is broader than security alone. In finite sequential games, the leader publicly commits to a strategy and the follower plays a best response to this strategy, with ties broken in favor of the leader in the classical definition. The game is represented by non-terminal states, terminal states, chance nodes, a transition function, and behavioral strategies; expected utilities are obtained by summing utilities at leaves weighted by reach probabilities (Bosansky et al., 2015). In security applications, targets, patrol schedules, coverage vectors, or defense policies instantiate this general extensive-form skeleton.

A central modeling distinction is between simultaneous and sequential competition. Simultaneous security competition is commonly represented by Nash equilibrium. Sequential security competition imposes commitment and observation, making the attacker’s optimization conditional on the defender’s earlier move. This asymmetry is precisely what gives the Stackelberg solution its operational interpretation as optimal commitment under anticipated attack.

2. Strategy spaces, coverage, and payoffs

A common attacker–defender instantiation uses a finite set of assets or targets

$$T = \{\mathfrak{T}_1,\mathfrak{T}_2,\ldots,\mathfrak{T}_N\}$$

and a finite set of defensive resources

$$S=\{\mathcal{S}_1,\mathcal{S}_2,\ldots,\mathcal{S}_M\}.$$

The defender’s mixed strategy is a vector of marginal protection probabilities

$$\langle D_{\mathfrak{T}}\rangle=(D_1,D_2,\ldots,D_N),$$

with

$$D_n=\frac{1}{M}\sum_{m=1}^M \Pr(\mathfrak{T}_n,\mathcal{S}_m),\qquad D_n\in[0,1],\qquad \sum_{n=1}^N D_n=1.$$

The attacker chooses a probability distribution over targets,

$x$0

This representation makes the defender’s commitment a coverage vector and the attacker’s response an attack distribution (Iqbal et al., 19 Dec 2025).

With per-target defender reward $x$1 for a protected attacked asset and defender cost $x$2 for an unprotected attacked asset, the defender’s expected payoff is

$x$3

With attacker reward $x$4 for attacking an unprotected target and attacker cost $x$5 for attacking a protected one, the attacker’s expected payoff is

$x$6

The shorthand parameters

$x$7

summarize the total stake on each target for defender and attacker. In analytical models, these quantities control which targets become attractive, which targets require threshold deterrence, and how equilibrium coverage depends on attacker incentives (Iqbal et al., 19 Dec 2025).

This formulation also underlies worked military examples. In a drone–tank scenario, the Blue team acts as defender and the Red team as attacker; Blue chooses a protection vector over tanks, Red observes it and chooses an attack distribution, and both payoffs depend on whether the attacked tank is protected (Iqbal et al., 22 May 2025).

3. Equilibrium concepts and inducibility

The standard solution concept in much of the security-game literature is Strong Stackelberg Equilibrium (SSE), which assumes that the follower breaks ties in favor of the leader. Weak Stackelberg Equilibrium instead assumes pessimistic tie-breaking against the leader. In resource-constrained security games, however, the usual justification for SSE—that the defender can induce a preferred follower action by an infinitesimal adjustment—need not hold. The utility of SSE can therefore be higher than its utility guarantee (Guo et al., 2018).

To address this, inducibility-based analysis defines the utility guarantee of a defender strategy and introduces Inducible Stackelberg Equilibrium (ISE). ISE owns the highest utility guarantee and always exists. The paper on inducibility further shows the conditions when ISE coincides with SSE, and that in the general case SSE can be extremely worse with respect to utility guarantee. Importantly, introducing ISE does not invalidate existing algorithmic results, because the problem of computing an ISE polynomially reduces to that of computing an SSE (Guo et al., 2018).

This debate matters because it clarifies a common misconception: Stackelberg commitment is not, by itself, a guarantee that optimistic tie-breaking is enforceable under arbitrary resource-assignment constraints. A plausible implication is that equilibrium selection in security games should be tied to actual inducibility properties of the feasible coverage polytope, not only to the conventional optimistic equilibrium definition.

Related Stackelberg formulations outside security sharpen the same intuition. In a regularized leader–follower preference game, the solution is unique under KL regularization and full support, while in the unregularized case a deterministic Stackelberg solution exists and randomization is unnecessary when the follower observes the realized leader action. This suggests why, in some security settings with complete observation, pure commitments can be sufficient even though mixed strategies remain standard in classical SSG formulations (Pásztor et al., 18 Dec 2025).

4. Dynamic, Bayesian, and partially observable extensions

Sequential Stackelberg security games become substantially richer when the interaction evolves over states. A Bayesian Stackelberg Markov Game (BSMG) formalizes a dynamic leader–follower security interaction with state space $x$8, attacker type distribution $x$9, action sets for defender and attacker types, type-dependent transition kernels $y(x)$0, utilities $y(x)$1, and discount factor $y(x)$2. The defender commits to a stationary policy $y(x)$3, each attacker type chooses a deterministic best-response policy $y(x)$4, and the equilibrium concept is Strong Stackelberg Equilibrium in the Markov setting. The associated Bayesian Strong Stackelberg Q-learning algorithm maintains stage-game Q-values, solves a Bayesian Stackelberg game at each state, and converges to the BSS of a BSMG (Sengupta et al., 2020).

A different extension models security as a one-sided two-player zero-sum partially observable stochastic game with public actions. In that OTZ-POSG formulation, the follower knows the true state while the leader maintains a belief over states; actions are public, so current behavior can reveal private information and alter future incentives. The one-stage Stackelberg equilibrium can be converted into a linear-fractional program and then solved by linear programming. For finite horizons, the paper adopts the concept of $y(x)$5-Stackelberg equilibrium and proves existence when the follower uses $y(x)$6-sacrifice policies to limit information leakage. It also proves that the leader’s value function is piece-wise linear and the follower’s value function is piece-wise constant in belief space (Zheng et al., 2021).

A third dynamic line studies stochastic Stackelberg games with private evolving types for both leader and followers. There, the leader commits to a dynamic strategy, types evolve as conditionally independent controlled Markov processes, and equilibrium computation is reduced from a whole-game fixed point to a backward recursive algorithm that solves smaller fixed-point equations at each time $y(x)$7. This decomposition gives a dynamic-programming interpretation of stochastic Stackelberg equilibrium in sequential security environments with private information (Vasal, 2020).

Across these dynamic models, the baseline one-shot security game becomes a stage game inside a larger stochastic system. This suggests that the canonical defender-first, attacker-second timing survives, but equilibrium computation must additionally account for beliefs, transitions, information revelation, and attacker heterogeneity.

5. Computation and algorithmic methods

Backward induction remains the canonical computational principle, but concrete algorithms depend on the information structure. In finite sequential extensive-form games, exact algorithms, approximate algorithms, and hardness results are available for several classes of Stackelberg games; the leader’s commitment is computed directly in the game tree rather than only through normal-form coverage variables (Bosansky et al., 2015).

For closed-form analytical resource allocation, one attacker–defender model derives equilibrium protection probabilities for a general number of assets and defensive resources. The attacker’s first-order conditions equalize expected payoff across attacked targets, the defender’s optimization collapses to a scalar choice, and three payoff regimes are identified according to the sign of a coefficient $y(x)$8: concentration on one asset, spreading protection across many assets, or indifference (Iqbal et al., 19 Dec 2025).

For dynamic incomplete-information security, Bayesian Strong Stackelberg Q-learning combines Q-learning with state-wise Bayesian Stackelberg equilibrium computation. At each visited state, it builds the Bayesian stage game from current Q-values, solves for SSE policies and values, and uses those equilibrium values in the Bellman backup (Sengupta et al., 2020). In partially observable zero-sum settings, LP/LFP reformulations and belief-space partitioning yield stage-wise solutions and finite-horizon $y(x)$9-equilibria (Zheng et al., 2021).

Graph-based sequential defense against multi-drone attacks introduces a different computational pattern. The S2D2 algorithm first coarsens the city graph into neighborhoods, then solves single-attacker single-defender sequential games per neighborhood, and finally solves a multi-resource Stackelberg meta-game over neighborhoods. Under a $y^*(x) \in \arg\max_y \; U_A(x,y),$0-coarsening assumption, S2D2 outputs an $y^*(x) \in \arg\max_y \; U_A(x,y),$1-approximate Strong Stackelberg Equilibrium with

$y^*(x) \in \arg\max_y \; U_A(x,y),$2

where $y^*(x) \in \arg\max_y \; U_A(x,y),$3 is the number of attacker drones, $y^*(x) \in \arg\max_y \; U_A(x,y),$4 is payload capacity, and $y^*(x) \in \arg\max_y \; U_A(x,y),$5 bounds single-neighborhood approximation error (Mutzari et al., 15 Aug 2025).

Mixed discrete–continuous security design also appears in service-delivery settings. There, a binary-search/Dinkelbach transform, a piecewise-linear MILP approximation, and a switched dual solved by projected gradient descent exploit a general minimax equality for problems combining discrete center selection with continuous protection variables. This yields a scalable approximation of a quantal Stackelberg equilibrium when the defender chooses both which centers to open and how much security to allocate (Mai et al., 2022).

6. Representative domains, assumptions, and limitations

Sequential Stackelberg security games have been instantiated in a range of domains.

Domain	Sequential feature	Representative paper
Drone–tank conflict	Defender commits to tank protection, attacker observes and attacks	(Iqbal et al., 22 May 2025)
Multi-drone city defense	Mixed sequential defense strategy on a city graph, attacker chooses paths and payload use	(Mutzari et al., 15 Aug 2025)
Adaptive moving target defense	Dynamic policy over configurations with attacker types and Markov transitions	(Sengupta et al., 2020)
Partially observable cyber defense	Public actions, hidden state, finite-horizon $y^*(x) \in \arg\max_y \; U_A(x,y),$6-Stackelberg equilibrium	(Zheng et al., 2021)
Critical service delivery	Defender chooses both center set and security allocation under fairness constraints	(Mai et al., 2022)
ISAC low-altitude defense	Stackelberg game with attack power, sensing, communication, and backward induction	(Wang et al., 9 Nov 2025)

These applications differ sharply in assumptions. Some assume complete and perfect information, single-shot attacks, and perfect rationality; others admit Bayesian attacker types, public actions with information leakage, or stochastic state evolution. Some are zero-sum, others general-sum. Some use exact equilibrium solvers, others rely on MILP, projected gradient descent, reinforcement learning, or approximate coarsening.

Several limitations recur. Complete information about rewards and costs is standard in analytical models. Perfect observation of the leader’s strategy is often assumed. Many formulations are single-attacker or single-stage, even when the motivating security problem is repeated. In Bayesian and Markovian models, the attacker-type distribution must be specified. In partially observable models, belief-space partitioning can be computationally expensive. In graph-based defense, approximation guarantees depend on coarsening assumptions. In inducibility analysis, optimistic SSE may overstate the defender’s actual guarantee when resource-assignment constraints prevent infinitesimal enforcement of the preferred follower action (Guo et al., 2018).

For that reason, the term “Sequential Stackelberg Security Game” does not denote a single model class so much as a family of leader–follower security models organized around commitment, observation, and best response. The common core is the defender’s anticipation of rational attack. The main technical differences concern whether the game is static or stochastic, fully observed or partially observed, exact or approximate, and whether equilibrium is interpreted through SSE, $y^*(x) \in \arg\max_y \; U_A(x,y),$7-SSE, or inducibility-sensitive refinements.