Multi-temporal adversaries

Extracted Attributes

Temporal fair division

Temporal fair division is a sequence of fair division instances among the same set of agents. Some examples are: A group of housemates that have to divide the house-chores among them, day after day. Dividing equipment between departments in a university, where various pieces of equipment arrive at different times. The standard fair division setting considers a one-shot division; but in reality, the same set of agents usually participate in several consecutive fair division instances. This adds more complexity to the fairness requirements. In some cases, the resources to allocate are not known in advance. Each day, a new resource (or set of resources) arrives, and must be immediately and irrevocably allocated. Fairness becomes much harder to attain, as the allocator might make an allocation decision that will in hindsight appear very unfair. This setting is explained in the page on online fair division. This article focuses on the setting in which the resources to allocate are all known in advance: we know exactly what is going to arrive and when. The challenge here is that, in a sequence of fair division instances, people have higher fairness expectations. While they agree to tolerate a slightly unfair allocation in a single day, they expect the fairness to be restored in following days. This gives rise to stronger fairness notions, that take the temporal nature of the problem into consideration.

Web Search Results

• Temporal Adversarial Attacks on Time Series and Reinforcement Learning Systems: A Systematic Survey, Taxonomy, and Benchmarking Roadmap

  Kurniawan et al. extended this analysis to multi-modal sensor systems, demonstrating that adversarial attacks can succeed by compromising only one of three sensor devices. Using GAN-based perturbation generators with conditional estimators for non-hacked sensor values, they achieved 50-100% attack success rates on the MHealth dataset depending on the target activity pair. This finding has profound implications for the security of multi-sensor HAR systems: an adversary need not compromise all sensors to defeat the recognition system. [...] Temporal dependencies: Activity patterns unfold over time with characteristic dynamics. Walking exhibits periodic patterns at approximately 1-2 Hz, while transitions between activities involve distinctive acceleration profiles. Perturbations must maintain temporal coherence to remain imperceptible. Multi-sensor configurations: Modern wearable devices incorporate multiple sensors (accelerometer, gyroscope, magnetometer, barometer) that provide complementary information. Attack effectiveness varies significantly depending on which sensors are perturbed. Kurniawan et al. demonstrated that adversarial attacks can succeed by compromising only one of three sensor devices in multi-modal systems. [...] #### 4.1.2. Multi-Agent Adversarial Policies Gleave et al. demonstrated that adversarial policies trained via self-play can defeat state-of-the-art RL agents with greater than 95% success in multi-agent MuJoCo environments. Critically, adversarial policies appear random to human observers but create naturally adversarial observations for victim agents—they exploit learned policy weaknesses rather than injecting artificial perturbations. Liu and Lai demonstrated mixed attack strategies effective without prior environment knowledge. Ma et al. extended adversarial policies to partial observability settings with SUB-PLAY, reducing superhuman-level Go AI winning rate to approximately 20% even when adversaries observe only partial game state.

• Multi-Tier Adversary - What do you think? : r/daggerheart - Reddit

  By using multi-tier enemies, you can mix them if needed. You can have a few apprentices, a disciples, a firepalm, etc.

• Temporal Analysis Framework for Intrusion Detection Systems: A Novel Taxonomy for Time-Aware Cybersecurity

  Within the tactic TA0009 - Collection , some techniques are observed, such as Adversary-in-the-Middle (T1557), Data from Information Repositories (T1213), Data from Network Shared Drive (T1039), and Automated Collection (T1119). In the first technique mentioned, adversaries attempt to position themselves between two or more networked devices, which could be detected since interfering with a flow can cause detectable intra-flow changes (T.1), as well as alterations in the traffic pattern or between windows that can be detected with (T.3). On the other hand, the collection of data from information repositories and shared units on the network could be detected since repeated or multiple accesses to repositories or shared resources can form a detectable pattern in a snapshot (S.2) or as a [...] To assess the practical relevance of the proposed temporal taxonomy, a conceptual analysis of selected techniques from the MITRE ATT&CK framework was conducted. Although the evaluation was not empirical, this exploratory exercise highlights how various adversarial techniques may manifest patterns that are detectable through temporal analysis, thus motivating further investigation. This analysis focused on techniques that exhibit a temporal footprint, whether through repetitive, sequential, or time-windowed network activity. Techniques lacking clear temporal characteristics were excluded to maintain focus on the taxonomy’s applicability. A summary of this section is presented in Tables 6 and 7. [...] in the latter, changes in packet size or header patterns can be detected if analyzed at the sequence level (T.2). On the other hand, adversaries can use an encryption algorithm to hide command and control traffic (Encrypted Channel, T1573), use backup channels as alternative means of communication (Fallback Channels, T1008), or use Multi-Stage Channels (T1104) for command and control, all of which could be detected if the flow has patterns that may reveal anomalous behavior (S.1 or T.1), if changes in communication channels are observed in the sequence to be analyzed (T.2 or T.3), or if a progressive escalation of C2 is observed in multiple windows (T.3), respectively. Other techniques such as Ingress Tool Transfer (T1105), whereby adversaries can transfer tools or other files from an

• Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports

  S2A: Construct a dataset of temporal relations: We define the task of predicting the temporal relations of adversary actions as the following. Let a CTI report RR may contain one or multiple techniques from all the ATT&CK techniques: T1,T2,…,TnT\_{1},T\_{2},...,T\_{n}. We then construct (n×n)(n\times n) pairs of techniques. If, in RR, we observe that the two techniques in the pair are executed with respect to time progression, then the pair has a temporal relation between them. Our task is to train a model that takes RR as an input and predicts one or more temporal relations among all possible pairs of techniques. The first three authors manually investigate all the reports from curated CTI report set for evaluation and identify temporal relations. After that, the authors resolve their [...] PC-8: Precursor to data-breach: We identify five patterns in this category, with ten occurrences in total. We report the temporal patterns in this category in Table XV. The table shows that adversaries collect information and then stage it in a centralized location through archiving before exfiltration (P116, P118, P120). On the other hand, adversaries look for browser-saved passwords, emails, and bookmarks at the same phase of attacks to collect sensitive information from the logged-in websites of the victim users (P117, P119). [...] PC-3: Profiling target system: We identify 32 patterns in this category, with 91 occurrences in total. We report the patterns in Table XI. The table shows that adversaries collect information related to operating systems, networks, software, and domain accounts at the same phase of time, usually after initial compromises (P46, P50, P54, P56, P59, P60, P62, P63, P65, P66, P68, P71, P73, P74, P75, P76). The identified information primarily aids the attacker in deciding the follow-on actions (P55, P57, P61, P64, P69, P70, P72, P77). The information is usually collected by running various shell commands and native APIs provided in the operating system, making it practically infeasible to detect and defend (P47, P48, P49, P51, P52, P53, P58, P67).

• Spatial–temporal intention representation with multi-agent ...

  This paper studies how to use local observation information to express complex adversary intentions and learn defense strategies in the multi-USV asset