Species Perturbation
Perturbation
Add noise to data or outputs so an observer cannot learn the true values.
e.g.Differential privacy on released statistics
Primer · What is cyber deception?
Winning with information the other side doesn’t have
Every cyber attack is a contest over information. Attackers hide malware, spoof identities and send phishing emails. Defenders can turn the same idea around: decoy servers, fake credentials and shifting network addresses make an attacker waste time, reveal their tools, or give up.
Deception works only if the other side believes it, and they are strategic too.
That is why we use game theory. A game lets us write down what each player knows, what they want, and how they update their beliefs when they see evidence. We can then ask the design questions that matter: How many decoys are enough? What if the attacker can partly detect them? When should a defender reveal, conceal, or commit?
A field guide
Six species of defensive deception
Our taxonomy groups defensive deception by the kind of information it manipulates and the game that models it. It gives researchers and practitioners a shared vocabulary.
Species MTD
Moving target defense
Keep changing the system’s configuration so the attacker’s reconnaissance quickly goes stale.
e.g.Randomized IP addresses and ports
Species Obfuscation
Obfuscation
Hide real signals among useless or misleading ones.
e.g.Dummy queries that mask a user’s location
Species Mixing
Mixing
Exchange identities among many parties so no single one can be traced.
e.g.Mix networks for anonymous communication
Species Honey-X
Honey-X
Make fake systems or data look real to lure and study attackers.
e.g.Honeypots, honeytokens, honey-files
Species Engagement
Attacker engagement
Use feedback over time to keep an attacker busy and learn their goals.
e.g.Adaptive honeynets that observe advanced persistent threats
From J. Pawlick, E. Colbert & Q. Zhu, “A Game-theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy,” ACM Computing Surveys 52(4), 2019.
Interactive · Try it yourself
The leaky honeypot game
You defend a network of 100 hosts. Some are honeypots. An attacker scans one host and sees whether it looks real. Adjust your defense and watch the attacker’s belief and decision change.
The fraction of hosts that are decoys. Decoys cost money to run.
How often the attacker’s scan correctly spots a honeypot as fake. Better decoys leak less.
Gain from hitting a real host versus the loss from being caught in a honeypot.
Real host
Honeypot that looks real
Honeypot the scan exposes
Attacker’s belief · μ—P(honeypot | looks real)
Expected attack value—(1−μ)·gain − μ·loss
A simplified version of the signaling games with evidence in Pawlick, Colbert & Zhu, IEEE TIFS 2019. The full model also lets the defender choose when to deceive and at what cost.
New to the field?
A four-step reading path
For students and practitioners: start short and free, then go deep.
The tutorial
A short, free introduction to game theory for cyber deception. Read it in an afternoon.
Read the tutorial →The survey
The six-species taxonomy and a map of the game models behind each species.
Read the survey →The textbook
Nash and Stackelberg games, incomplete information, honeypots, and strategic trust in the IoT.
Open the book →The frontier
Deception by and against AI: LLM agents, agentic workflows, and spear-phishing.
Read the overview →Books
The bookshelf
Monographs and edited volumes that define the game-theoretic study of deception.
Birkhäuser · 2021
Game Theory for Cyber Deception
Jeffrey Pawlick
Quanyan Zhu
Quanyan Zhu
Featured monograph
Game Theory for Cyber Deception: From Theory to Applications
Draws on a decade of deception research to build a game-theoretic taxonomy, then applies it to privacy in the Internet of Things, dynamic honeynets against advanced persistent threats, and active defense against physical denial-of-service attacks.
- For security practitioners who want to learn game theory
- For game theorists moving into cybersecurity
- Covers signaling, Stackelberg, and large-population games
Springer · 2026Foundations of Cyber DeceptionEds. Q. Zhu, Z. Lu,
P. L. Yu, C. Wang
P. L. Yu, C. Wang
Foundations of Cyber DeceptionModeling, analysis, design, human factors, and how they fit together.
SpringerBriefs · 2023Cognitive SecurityLinan Huang
Quanyan Zhu
Quanyan Zhu
Cognitive SecurityA system-scientific approach to human attention, bias, and deception.
Wiley-IEEE · 2021Game Theory & Machine Learning for Cyber SecurityEds. Kamhoua, Kiekintveld,
Fang, Zhu
Fang, Zhu
Game Theory and Machine Learning for Cyber SecurityIncludes chapters on manipulating reinforcement learning.
Wiley · 2026Autonomous Cyber ResilienceEds. Kamhoua, Kott,
Zhu, Leslie
Zhu, Leslie
Autonomous Cyber ResilienceIncludes resilience against deceptive information attacks on transportation systems.
Research
What we work on
Six research threads, each with a few papers to start from. The full list is on the Publications page.
Signaling & Bayesian deception
How beliefs are formed and manipulated when one side holds private information and evidence can leak.
- Modeling and Analysis of Leaky Deception Using Signaling Games With EvidencePawlick, Colbert, Zhu · IEEE TIFS 2019
- Hypothesis Testing Game for Cyber DeceptionZhang, Zhu · GameSec 2018
Honeypots & attacker engagement
When to lure, how long to engage, and how to learn from an attacker without being found out.
- Adaptive Honeypot Engagement Through Reinforcement Learning of Semi-Markov Decision ProcessesHuang, Zhu · GameSec 2019
- Duplicity Games for Deception Design With an Application to Insider Threat MitigationHuang, Zhu · IEEE TIFS 2021
Deception in AI & LLM agents
NewGame-theoretic models of deception by and against language models and agentic AI workflows.
Cognitive security & phishing
NewHuman attention and bias are part of the attack surface. We design defenses that account for them.
- ADVERT: An Adaptive and Data-Driven Attention Enhancement Mechanism for Phishing PreventionHuang, Jia, Balcetis, Zhu · IEEE TIFS 2022
- GAMBiT Experiments: Revealing Cognitive Bias in Human-Subjects Red-Team Cyber Range OperationsBeltz et al. · arXiv 2025
Advanced persistent threats & moving targets
Multi-stage attackers who stay hidden for months, and defenses that keep moving.
- A Dynamic Games Approach to Proactive Defense Strategies against Advanced Persistent Threats in Cyber-Physical SystemsHuang, Zhu · Computers & Security 2020
- Manipulating Adversary’s Belief: A Dynamic Game Approach to Deception by DesignHorák, Zhu, Bošanský · GameSec 2017
Cyber-physical & robotic deception
Deception that moves through the physical world: drones, vehicles, robots, and navigation systems.
- A Dynamic Game Framework for Rational and Persistent Robot DeceptionHuang, Zhu · IEEE T-ASE 2022
- Strategic Defense Against Deceptive Civilian GPS Spoofing of Unmanned Aerial VehiclesZhang, Zhu · GameSec 2017
Talks & events
Where we’ve presented
Human-Aware AI Agents for the Cyber Battlefield
AAAI Summer Symposium, Seoul, organizing committee · Symposium site
Dynamic Games for Cyber Deception
Seminar, Oden Institute, UT Austin · Event page
Bayesian Persuasion and Cognitive Security
Midwest Workshop on Control and Game Theory, University of Minnesota · Talk page
AAAI-20 Workshop on AI for Cyber Security (AICS)
New York City
Tutorial: Game Theory for Cyber Deception
HoTSoS, Nashville · Tutorial paper
Open resources
Dataset · 2026GAMBiT red-team datasetsHuman-subjects cyber-range data for studying attacker cognitive bias. VideoConversations at the Forefront of CybersecurityNYU CCS interview with Quanyan Zhu. Essay · 2023The Doctrine of Cyber EffectAn ethics framework for defensive cyber deception.