HBEE: Human Behavioral Entropy Engine -- Pre-Registered Multi-Agent LLM Simulation of Peer-Suspicion-Based Detection Inversion
TLDR
An LLM-driven multi-agent simulation reveals that adaptive insider threats can achieve "detection inversion," receiving less peer suspicion than innocent agents.
Key contributions
- Developed HBEE, a pre-registered multi-agent LLM simulator for insider threat detection.
- Found "detection inversion": adaptive moles receive statistically lower peer suspicion than innocents.
- Adaptive OPSEC moles show no detectable shift in traditional User and Entity Behavior Analytics (UEBA) rank.
- Peer suspicion and UEBA detection signals decouple under adaptive adversary behavior.
Why it matters
This paper challenges fundamental assumptions in insider threat detection, demonstrating that adaptive adversaries can actively evade peer-suspicion systems. It highlights a critical need for new detection strategies that account for sophisticated, LLM-enabled adaptive threats, as current methods may be inverted.
Original Abstract
Insider threat detection assumes that an adaptive insider leaves behavioral residue distinguishing them from legitimate users. We test this assumption against an LLM-driven adaptive insider in a controlled multi-agent simulator. Our pre-registered five-condition study isolates defender mode (cascade vs. blind UEBA) crossed with adversary type (naive vs. adaptive OPSEC) plus a no-mole control, across 100 runs (95 valid after pre-committed exclusions). The primary finding is a detection inversion: at T_60, the adaptive mole's suspicion in-degree is statistically lower than a randomly selected innocent agent (Cliff's delta = -0.694, 95% BCa CI [-0.855, -0.519], Mann-Whitney p << 0.01). The pre-registered prediction was the opposite direction. A pre-registered equivalence test (H2) shows adaptive OPSEC produces no detectable shift in the mole's UEBA rank under either defender mode. The two detection signals (peer suspicion graph in-degree and per-agent UEBA rank) decouple under adaptive adversary behavior. We bound generalization explicitly: a pre-registered Gini calibration check (H4) returns FAIL, with HBEE pairwise message-exposure Gini (0.213) diverging from the SNAP Enron reference (0.730) by |Delta Gini| = 0.52, exceeding the equivalence bound by 5x. The paper makes a narrow but surprising claim: in a controlled environment where adaptive OPSEC is implementable as an LLM directive, peer-suspicion-cascade detection inverts. We release the simulator, pre-registration document, frozen scenarios, raw telemetry, and analysis pipeline under an open-source license.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.