The Oracle's Gambit: A Game-Theoretic Framework for Responsible AI Release
Christoph R. Landolt, Tobias Lorenz, Marta Kwiatkowska, Mario Fritz
cs.GT
2026-07-04
A Stackelberg game shows releasing new AI capability to both sides at once doesn't help defenders; a pre-release window can cut attack frequency by up to 41%.
Existing frontier-AI safety frameworks, including OpenAI's Preparedness Framework, Anthropic's Responsible Scaling Policy, and DeepMind's Frontier Safety Framework, answer a binary question: does a model clear the deployment threshold, yes or no. A model that passes gets released without further constraint. That binary misses something Anthropic already ran into with Claude Mythos Preview: the UK AI Security Institute found it was the first model to complete a simulated network intrusion end-to-end, and Mozilla used the same still-unreleased model to find and fix 271 Firefox vulnerabilities before public launch. Staggered release is already happening in practice, but no framework describes how to time it well.
The paper models the release decision as a bilevel, three-player Stackelberg game. At the top, the lab that trains the model commits to a release policy: a window length W. W=0 means public release, where the defender and adversary get the new model at the same time. A window greater than zero is a pre-release: the defender gets access first, and the adversary only catches up after W rounds. An infinite window, an embargo, withholds the model from both sides indefinitely. That policy sets the AI capability level available to each of the two followers below it: the defender and the adversary.
The lower level is a zero-sum stochastic game. The defender moves through the patch lifecycle: detect a flaw, build a patch, test it, ship it. The adversary moves through the cyber kill chain: detect a flaw, build an exploit, use it, or alternatively reverse-engineer a shipped patch back into an exploit. The asymmetry in pipeline length is the paper's central premise. A defender has to balance security, correctness and availability, so it tests before shipping; an adversary only needs one working exploit. Backward induction solves this lower game to a unique value, which the lab then uses to pick the window that maximizes its own payoff.
Calibrated on five real frontier-model transitions, from GPT-4o through Claude Opus 4.5, Opus 4.6, and Mythos Preview, the paper shows that releasing new capability to both sides at once does not help the defender. Under simultaneous public release, attack frequency climbs from 0.27 to 0.34 across the five generations while defender welfare barely moves, from -13.79 to -13.22. The authors call this a Red Queen's race: both sides get stronger, but the defender's relative position doesn't improve, because the pipeline-length gap never closes.
A pre-release changes that. With a capability gap of 0.10, defender welfare rises from -13.22 to -9.47 and attack frequency drops from 0.34 to 0.26. For the real Opus 4.6 to Mythos Preview transition, the model's optimal pre-release window is 24 rounds, roughly 168 days of exclusive defender access under the paper's calibration, raising welfare by 3.48 and cutting attack frequency from 0.34 to 0.27. Capability rates feeding the model come from an LLM-Delphi panel: five GPT-5.1-based expert personas scoring benchmark evidence from CyberGym, ExploitGym, BountyBench, Cybench, and others. Re-running the calibration under Monte Carlo sampling of that panel's uncertainty, a pre-release stays the optimal choice in 80 to 95 percent of draws.
| Transition | P(pre-release optimal) | Optimal window (rounds) | Attacks averted |
| GPT-4o → o4-mini | 87.3% | 25 [8,36] | 41% |
| o4-mini → Opus 4.5 | 85.3% | 19 [9,25] | 32% |
| Opus 4.5 → Opus 4.6 | 80.0% | 11 [2,15] | 14% |
| Opus 4.6 → Mythos Preview | 95.3% | 12 [9,15] | 23% |
This gives labs a lever that today's threshold-based frameworks don't model: not whether to release a dual-use model, but who gets it first and for how long. The result is a theoretical account of why programs like Anthropic's Project Glasswing, which gave selected partners early access to an unreleased model for vulnerability hunting, can beat both full public release and outright withholding. In this model, a pre-release raises defender welfare, lowers attack frequency, and costs less in delayed-release opportunity cost than an embargo. For models that clear deployment thresholds but still carry meaningful dual-use capability, the paper's suggestion is to treat the timing and sequencing of access as an optimization problem rather than a single pass or fail gate.
The authors flag three modeling choices that cut in the defender's favor. The game assumes the defender can fully observe the adversary's progress, which overstates real defensive capability. The adversary is modeled as a pure damage-maximizer with no operational cost, giving an upper bound on harm rather than a realistic estimate. And the game covers a single release cycle, not repeated releases or competition between multiple labs. The delay cost and defender action cost can't be grounded in public data, so the paper sweeps them rather than calibrating a single value. The 168-day window for Mythos Preview depends on where in that swept range the operating point is chosen, and the authors themselves note the round-to-wall-clock mapping is unvalidated against any specific rollout. Capability levels aren't measured directly either: they come from LLM personas scoring benchmark evidence, which carries its own systematic uncertainty.