How do human and AI defenders adapt differently in cyber-defense games?

Four defender settings against one DQN attacker

The paper asks what is lost when a human-versus-AI cyber-defense interaction is summarized by a single 40-round average. All four defender settings face the same Deep Q-Network (DQN) attacker on the same six-node attack graph. Each round, the defender chooses one node to protect and the attacker chooses one node to target; a targeted node is compromised only if the attacker selects it and the defender does not. The reported score is a weighted data-protection ratio: the data volume of protected nodes divided by total data volume across nodes.

The four settings are two human-playable games and two automated baselines. In the reward-only human game, participants see the attack graph, the payoff table, the round counter, and the realized attacker action and reward after each round. In the reward-plus-transition human game, they see the same information plus attacker-aware transition probabilities displayed as numeric annotations on the graph edges. The automated DQN defender and the automated CHT-DQN defender play the same role in matched simulations, with the CHT-DQN version consuming those transition probabilities in its value update.

The two human games are the primary human-subject comparison: between-participant conditions with 40 completed Mechanical Turk participants each, 80 in total. The automated settings are matched simulation baselines averaged over 40 random seeds. Because the four settings are not four arms of one randomized experiment, the paper reserves inferential statistical claims for the contrast between the two human games and treats human-versus-automated comparisons as descriptive.

Cognitive hierarchy assigns roles, not a payoff recipe

Cognitive Hierarchy Theory describes bounded reasoning rather than equilibrium play: a level-k player best responds to a belief about opponents who reason at lower levels. In this study the defender is treated as the more sophisticated player because the defender is human and the attacker is a bot, which fixes the defender at level 1 and the attacker at level 0. The level-1 defender is therefore defined as best responding to a single level-0 attacker.

The level-0 attacker is not a randomizing player in the original sense. Following prior work, the authors replace uniform randomization with a goal-directed policy that does not maintain a model of the other player: here, a DQN that learns from its own payoffs and acts by softmax. The CHT-DQN defender then marginalizes that attacker policy through the attack graph to obtain transition probabilities, and uses them in its own value backup.

Crucially, the hierarchy is the model's assumption about who is more sophisticated, not a claim that recorded human actions are level-1 play. The authors state they do not claim participants compute the level-1 best response. What the two human games vary is which model structure the human game copies: reward feedback alone for DQN, or reward feedback plus attacker-aware transition probabilities for CHT-DQN. The transition display shows probabilities; it does not recommend an action.

Extra transition information did not lift overall protection

The paper's primary human-subject contrast does not show a statistically reliable overall gain in weighted data protection from exposing the CHT-DQN transition structure to human defenders. The reward-plus-transition game preserves the CHT-DQN information structure, but it does not produce a protection improvement that this study can resolve.

A structural reason the score has limited room to separate settings is that at most one node is compromised per round, so the protection ratio cannot fall below one minus the largest node's share of total data volume. All four settings therefore sit in a narrow band near the top of the scale. The authors note that asset value protected is the quantity a security operations center would report, yet that number can still leave little room to distinguish the four settings.

This is a bounded result about one comparison, not evidence that transition information is useless. The paper's own framing is that showing extra quantities is not the same as better play, and that the value of the study lies in what the aggregate score fails to show rather than in a demonstrated protection improvement.

Humans persist after success and avoid after failure

The clearest behavioral difference is a reselection asymmetry. Across both human games, human defenders were more likely to reselect a node after a successful defense than after a failure. The automated DQN and CHT-DQN defenders did not show this pattern.

The authors interpret this asymmetry as consistent with Prospect Theory and Cumulative Prospect Theory, which describe decisions that weigh losses and gains asymmetrically rather than maximizing expected value in a straightforward way. The paper presents this as an interpretation of the observed reselection pattern, not as a measured psychological parameter or a causal demonstration that prospect-theoretic weighting produced the behavior.

This matters for evaluation because the asymmetry is a property of how defenders allocate actions over time, and it is not captured by the overall protection score. Two defenders could reach similar average protection through different reselection dynamics, and the paper's design records action allocation and reselection precisely to make that difference visible.

The final stage reverses what the average suggests

The 40-round average mixes two different phases of the game. In early rounds the DQN attacker acts mostly at random; in late rounds it mostly exploits. Because the attacker's behavior changes, an average over all 40 rounds can obscure a stage-dependent ordering among defenders.

In the final stage, mean protection ranks the reward-plus-transition human game above the reward-only human game, then the automated CHT-DQN defender, then the automated DQN defender. The overall mean hides this ordering. The authors present this stage-wise comparison as descriptive, consistent with their rule that human-versus-automated comparisons are not inferential claims from a randomized experiment.

The practical point is about aggregation, not about which defender is best in general. A single 40-round score blends rounds where the attacker is nearly random with rounds where it exploits, so a reader comparing defenders on that score alone could miss a reversal that appears when the session is split by stage.

A controlled game, not a deployed SOC

The study uses one synthetic six-node attack graph, with node values, exploit likelihoods, and costs generated inside the simulator so the same graph can be given to a human and an automated defender. No external vulnerability or advanced persistent threat dataset is used. Human sessions last 40 rounds, and participants were Mechanical Turk workers with software or IT backgrounds.

These conditions bound the claims. The authors explicitly do not claim deployment-level security-operations-center validity, do not claim equilibrium play, and do not claim that CHT-DQN is a generally superior algorithm. They also note that a 40-round session cannot speak to temporal distribution shift of the size reported in longer-horizon benchmarks.

The automated comparisons are matched simulations averaged over random seeds, not additional human participants, so the human-versus-automated ordering should be read as descriptive. The inferential contrast the design supports is between the two human games, and even there the overall protection difference was not statistically reliable.

Report stage-wise protection and reselection, not just the mean

The paper's central evaluation claim is that an averaged task score can miss behaviorally meaningful differences in adaptation, action allocation, and bounded human reasoning. The evidence for that claim is specific: a reselection asymmetry present in both human games and absent from the automated defenders, and a final-stage protection ordering that the 40-round mean hides.

For readers comparing human-agent cyber-defense systems, the paper's priority is therefore to report stage-wise performance and human decision dynamics alongside aggregate protection. The relevant variables are the ones the study actually recorded: weighted data protection, action allocation, response time, and reselection after success or failure.

The most decision-relevant distinction is between the two human games at the final stage, where the reward-plus-transition game ranks above the reward-only game, even though the overall 40-round comparison shows no statistically reliable gain. That split, rather than the overall average, is where this study locates the difference the CHT-DQN information structure made for human defenders.

Sources used in this answer