AI
Stochastic Parrots and Deterministic Predators
The stochastic parrot term comes from a paper by Mary Bender and colleagues on the dangers of large language models. Probabilistic and unable to produce anything novel, it only regurgitates training data. Deterministic predators follow the opposite logic: repeatable processes, predictable responses. Put meat in front of a hungry carnivore, it acts. Adversarial work forces this trade-off constantly: gather more information about the environment or act on what you already know.
OODA Loops and the Speed of Adversarial Decision-Making
In adversarial settings, you’re not the only decision-maker. The defender gets a vote. Kuzma illustrated this with the OODA loop: observe, orient, decide, act. When an attacker acts, the defender’s loop resets entirely. SOC teams run event-to-alert latency anywhere from five minutes up. An attacker can be on 17 other systems and have compromised a dozen or more accounts before containment finishes.
Full vs Partial Observability: MDP and POMDP
A Markov Decision Process assumes complete environmental knowledge: state, allowed actions, transition probabilities, and a reward function. Google DeepMind’s Atari-playing AI is the textbook case. Screen pixels are the state, four buttons are the actions, the score is the reward. Real attack engagements skip that luxury. You don’t know what’s on the next subnet. That’s a Partially Observable Markov Decision Process (POMDP). A white-box assessment maps to an MDP; a black-box engagement is a POMDP.
Random Walks, Deterministic Policies, and Detectability
With four equally probable actions, you get a random walk. No different from a kid picking a block. A greedy deterministic policy picks the highest-quality action at every step. If you have admin credentials, run admin commands. Detectability is a separate risk factor Kuzma layered in. Each action sits on a scale of zero to one for how likely it triggers a defensive response. Worst case: lose your foothold. Worst worst case: agents from a federal agency at the door.
When Decision Trees Hit the State Space Wall
Decision trees are runbooks in code, and they’re auditable. When someone asks why you ran a command, you point at the chart. But they’re state machines with finite conditions. Real networks with hundreds of thousands of systems push the state space onto a curve computer scientists don’t like. There’s another risk: defenders with your CTI know your playbook. If your company playbook leaked, everyone knows your next move.
Subgraph Matching and the Kuzu Demo
Networks can be represented as graphs. Subgraph matching lets you define prerequisite patterns and scan a graph for instances. The technique has prior art in social network queries at billions of nodes and financial fraud detection. Kuzma and Odell built a property graph using Kuzu, an open-source embedded database from the University of Toronto that runs in-process and needs no server. A YAML-based DSL defines tool preconditions. Their recorded demo enumerated a Linux host across 14 tool usages, cracked a credential hash, and dumped a domain.
Notable Quotes
you’re not the only decision maker that matters in this. Bobby Kuzma · ▶ 3:49
I screw up his loop. Bobby Kuzma · ▶ 4:23
the next best step essentially. Michael Odell · ▶ 23:00
Key Takeaways
- Deterministic policies pick the highest-quality action at each step; random walks waste time and burn stealth.
- POMDP models handle real attack environments where you cannot know all system state in advance.
- Subgraph matching scales adversarial decision-making to networks with hundreds of thousands of systems.
About the Speaker(s)
Bobby Kuzma is a seasoned offensive security researcher with a long running interest in computational decision making. He runs the Offensive Cyber Operations team at ProCircular.
Michael Odell is a nerd who likes playing with computers.