Paper deep dive
LLM Semantic Signaling Game and Mechanism Design: Systematic Blindness, Awareness Shaping, and Mindset Dynamics
Quanyan Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 7/9/2026, 9:06:52 AM
Summary
This paper introduces a semantic signaling game framework to model LLM-mediated strategic communication. It formalizes how senders use semantic controls to generate stochastic messages, which receivers evaluate through awareness-dependent scoring mechanisms. The framework addresses systematic blindness, derives statistical decision rules, characterizes game-theoretic equilibria, and proposes mechanism-design interventions to reshape receiver awareness and mitigate adversarial interactions like phishing.
Entities (8)
Relation Signals (7)
Receiver Awareness → determines → Perceived Linguistic Features
confidence 95% · Receiver awareness is modeled as a type that determines which linguistic features are perceived and used for inference
Large Language Models → mediates → Strategic Interactions
confidence 95% · LLMs increasingly mediate strategic interactions through natural language.
Semantic Control → induces → Stochastic Message
confidence 90% · a sender selects a semantic control, an LLM generates a stochastic message
Semantic Signaling Game → models → Sender-Receiver Communication
confidence 90% · This paper develops a semantic signaling game for LLM-mediated communication in which a sender selects a high-level semantic control, an LLM maps that control into a stochastic message, and a receiver evaluates the message through an awareness-dependent scoring rule.
Mechanism Design → reshapes → Receiver Awareness
confidence 90% · The paper further develops mechanism-design approaches that reshape receiver awareness
Phishing → demonstrates → Awareness Shaping Efficacy
confidence 85% · demonstrate how awareness shaping and guardrail costs reduce successful phishing attacks.
Numerical Experiments → validates → Gaussian Approximation
confidence 85% · Numerical experiments validate the Gaussian approximation
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language models (LLMs) increasingly mediate strategic interactions through natural language, making semantic control a critical element of communication and deception. This paper develops a semantic signaling game in which a sender selects a semantic control, an LLM generates a stochastic message, and a receiver evaluates the message using an awareness-dependent scoring mechanism. Receiver awareness is modeled as a type that determines which linguistic features are perceived and used for inference, providing a formal model of systematic blindness. The framework connects prompt-based control, statistical detection, and game-theoretic equilibrium analysis. Gaussian approximations of aggregate message scores enable likelihood-ratio decision rules, while Perfect Bayesian Nash equilibria characterize strategic behavior. The paper further develops mechanism-design approaches that reshape receiver awareness, penalize deceptive semantic controls, and modify receiver populations to induce benign pooling equilibria. Numerical experiments validate the Gaussian approximation, quantify awareness-ordering effects, analyze mindset dynamics under adaptive adversaries, and demonstrate how awareness shaping and guardrail costs reduce successful phishing attacks. The proposed framework provides a principled foundation for analyzing strategic language-mediated interactions in agentic AI systems and offers new tools for the design of robust and secure human-AI communication.
Tags
Links
- Source: https://arxiv.org/abs/2606.29113v1
- Canonical: https://arxiv.org/abs/2606.29113v1
Trouble viewing inline? Open PDF directly →
Full Text
97,557 characters extracted from source content.
Expand or collapse full text
LLM Semantic Signaling Game and Mechanism Design: Systematic Blindness, Awareness Shaping, and Mindset Dynamics Quanyan Zhu Department of Electrical and Computer Engineering New York University Tandon School of Engineering Brooklyn, NY 11201, USA qz494@nyu.edu Abstract Large language models (LLMs) increasingly mediate strategic interaction through natural language. This paper develops a semantic signaling game for LLM-mediated communication in which a sender selects a high-level semantic control, an LLM maps that control into a stochastic message, and a receiver evaluates the message through an awareness-dependent scoring rule. Receiver awareness is modeled as a type that determines which linguistic features are perceived, weighted, and used for inference. The framework connects prompt-based control, statistical detection, and game-theoretic equilibrium analysis. We establish Gaussian approximations for aggregate message scores, derive likelihood-ratio decision rules, and characterize Perfect Bayesian Nash equilibria and incentive-compatible control selection. We then study mechanism-design questions in which interventions reshape receiver awareness, penalize deceptive controls, or reweight populations to induce benign pooling. Numerical experiments validate the Gaussian approximation, show awareness-ordering effects, illustrate mindset dynamics, and quantify benign-pooling design levers in a phishing case study. The model explains systematic blindness as a feature-space limitation and provides a basis for analyzing mindset dynamics in AI-enabled phishing and other adversarial language-mediated systems. Keywords large language models ⋅· signaling games ⋅· mechanism design ⋅· receiver awareness ⋅· phishing detection 1 Introduction Large language models (LLMs) are increasingly deployed as interactive agents that communicate, reason, negotiate, and coordinate through natural language. These systems are no longer passive text generators: they participate in workflows, act on behalf of users, and interact with other human or artificial agents. As a result, language becomes both a medium of communication and a strategic control variable. A prompt, instruction, or conversational framing can shape not only the surface form of a generated message but also the receiver’s inference and subsequent action. This shift changes the modeling problem. Classical signaling games provide a natural starting point because they study communication under asymmetric information. A sender has a private type, chooses a signal, and a receiver interprets that signal before acting. However, standard signaling models usually represent messages as abstract symbols or low-dimensional numerical signals. They do not explicitly capture token-level language generation, semantic control, or heterogeneous perception of linguistic evidence. These limitations become especially important in LLM-mediated systems, where messages are stochastic, high-dimensional, and shaped by prompts. The central difficulty is that an LLM-generated message is neither a fixed action nor a fully controlled signal. It is a random token sequence drawn from a distribution induced by a semantic input. The sender can choose the high-level intent, framing, tone, or persuasive style of the message, but the realized output is generated by the language model. The receiver then observes the realized message through a limited representation: some features are salient, others are ignored, and the same message can lead to different scores for receivers with different awareness levels. A useful theory must therefore connect semantic control, stochastic generation, feature-based perception, and strategic incentives in one model. This difficulty is sharper because the receiver does not observe the sender’s semantic control directly. The receiver observes only the generated message and must infer intent from linguistic evidence that may be incomplete, noisy, or strategically chosen. A sender can therefore shape beliefs without deterministically choosing every token. Conversely, a receiver may respond rationally to the features it observes while still missing the evidence that would distinguish benign and malicious intent. The resulting interaction combines a stochastic communication channel with a game of asymmetric information. Phishing illustrates this need. Generative AI lowers the cost of creating personalized, fluent, and adaptive deceptive messages. A malicious sender may choose a semantic control that emphasizes urgency, authority, or routine administrative framing, while a receiver evaluates the message using only a limited set of cues. Some receivers notice credential requests, suspicious links, or urgency markers; others miss these features entirely. Thus, susceptibility is not simply a matter of preference or random noise. It can arise from systematic blindness: a receiver’s effective feature space may exclude cues that are statistically informative about deception. This paper develops a semantic signaling framework for this setting. We model an LLM as a stochastic channel from semantic controls to token sequences. The sender chooses a control based on its private type, and the receiver maps the generated message into an awareness-dependent score. This score is then used for belief updating and action selection. The formulation makes it possible to connect three levels of analysis: language generation, statistical detection, and equilibrium incentives. The model also clarifies the role of receiver awareness. Awareness is not treated as a scalar accuracy parameter alone. Instead, it determines which token-level or semantic features are available for scoring. A low-awareness receiver may fail to detect deception because the relevant features are not represented, not because the receiver applies a weak threshold to a correct statistic. This distinction matters for defense: training, warnings, interface design, and automated support can change the receiver’s representation rather than merely shifting a decision threshold. The distinction also changes how interventions should be modeled. A defense that only raises a threshold may reduce false acceptance, but it does not teach the receiver to perceive previously invisible evidence. A defense that expands the feature set changes the statistic itself. In an LLM-mediated environment, both effects matter because a strategic sender can adapt the semantic control to the receiver population. The paper therefore treats awareness, thresholds, and sender incentives as coupled objects rather than separate components. The paper then studies mechanism design for awareness shaping. In a defensive setting, one may seek interventions that make benign semantic controls attractive for all sender types, increase the cost of deceptive controls, or alter the receiver population so that deceptive controls are less likely to be accepted. These interventions can be interpreted as changes in detection thresholds, control costs, feature sets, or the effective composition of awareness types. The resulting model provides a language-based view of incentive design in agentic AI security. The case study focuses on AI-enabled phishing, but the modeling idea is broader. Many LLM-mediated interactions have the same structure: a strategic party uses language to shape another party’s belief or action, and the receiver responds through a bounded and context-dependent representation of the message. Examples include persuasion, automated customer support, moderation-sensitive communication, misinformation, and multi-agent coordination. In each case, semantic controls affect a distribution over messages, while receiver awareness determines which features of those messages enter the decision process. Contributions. The paper makes several contributions. First, it formulates an LLM semantic signaling game in which semantic controls induce stochastic token sequences and awareness-dependent score distributions. Second, it models receiver awareness as a type that governs token-level feature extraction, which enables a formal treatment of heterogeneous detection and systematic blindness. Third, it derives Gaussian approximations for aggregate message scores and uses them to obtain likelihood-ratio and threshold decision rules. Fourth, it characterizes Perfect Bayesian Nash equilibria and incentive-compatible control selection for direct generative mechanisms. Finally, it develops conditions for benign pooling, population shaping, and mindset dynamics, and supports these conditions with reproducible phishing experiments that validate the score approximation, compare receiver-awareness types, and quantify mechanism-design levers. Organization. Section 2 reviews related work. Section 3 introduces the semantic signaling model, including stochastic message generation and awareness-dependent scoring. Section 4 develops the equilibrium and incentive-compatibility analysis. Section 6 presents a numerical phishing case study. Section 7 concludes. 2 Related Work Signaling, cheap talk, and equilibrium refinements. The paper builds on classical models of signaling and strategic communication. Spence’s signaling model formalizes how costly signals can transmit information under asymmetric information [spence1973job]. Crawford and Sobel’s cheap-talk model studies strategic communication when messages are payoff-relevant but not directly binding [crawford1982strategic], and cheap-talk theory is surveyed in [farrell1996cheap]. Refinements and equilibrium selection in signaling games are developed in [cho1987signaling, banks1987equilibrium]. Deception and lying in games are surveyed and extended in [sobel2020lying]. Our framework keeps the asymmetric-information structure of these models but replaces abstract messages with LLM-generated token sequences controlled by semantic prompts. Information design and persuasion. The mechanism-design part of the paper is related to information design, Bayesian persuasion, and strategic disclosure. Bayesian persuasion shows how an informed or committed sender can shape receiver beliefs by choosing an information structure [kamenica2011bayesian]; broader unified treatments of information design appear in [bergemann2019information]. Work on overt persuasion and covert signaling in cyber settings further emphasizes that the value of communication depends on both information and observability [Li2023PriceTransparency]. In contrast with standard persuasion models, the present model does not assume that the sender directly selects a signal structure observed by a fully specified Bayesian receiver. Instead, the sender selects semantic controls that induce a distribution over natural-language messages, and receivers process those messages through awareness-dependent feature maps. Language, meaning, and conventions in games. Language has long been recognized as more than a neutral carrier of signals. Conventions give messages meaning in coordination problems [lewis1969convention], and evolutionary models show how meanings can emerge through repeated interaction [demichelis2008language]. Interactive epistemology studies how agents reason about knowledge and beliefs in games [aumann1999interactive]. These works motivate a view of language as a structured object with social and epistemic content. The LLM setting adds a new layer: meanings are implemented through probabilistic token generation, and the receiver’s awareness determines which parts of the linguistic object become decision-relevant. Generative language models and agentic systems. The technical basis for modern LLMs includes the transformer architecture [vaswani2017attention], few-shot language modeling [brown2020language], instruction-following through human feedback [ouyang2022training], and the broader foundation-model paradigm [bommasani2021opportunities]. Recent work studies LLMs as strategic or interactive agents in games and agentic workflows. Repeated-game behavior with LLM agents is examined in [akata2025playing], and broader connections between LLMs and games are surveyed in [gallotta2024llm_games]. Generative agents show how LLMs can support memory, planning, and social interaction in simulated environments [park2023generative], while agentic AI workflows and incentive-compatible teaming are studied in [yang2026agentic_ai]. Related work on LLM-based equilibrium reasoning and agentic AI security appears in [zhu2025llm_nash, zhu2025llm, zhu2025generative, zhu2025cybersecurity]. Our contribution is an explicit signaling-game model in which LLM generation appears as a stochastic channel governed by semantic control. Cyber deception, phishing, and cognitive security. Cybersecurity applications motivate the model because adversaries often communicate strategically under asymmetric information. Game-theoretic models of cyber deception and evidence-based signaling are developed in [Zhang2018HypothesisTestingGame, Pawlick2019LeakyDeception, Hu2024GameTheoreticNP]. Phishing and one-to-many deception are studied in [pawlick2017phishing], and social phishing demonstrates how contextual personalization can increase attack effectiveness [jagatic2007social]. Attention enhancement and cognitive defenses for phishing prevention are developed in [huang2022advert, huang2023cognitive]. Our work differs by modeling the linguistic channel directly: phishing is not only an action chosen by an attacker, but a distribution over generated messages shaped by semantic controls and filtered through receiver awareness. Statistical detection, awareness, and bounded rationality. The receiver’s decision problem is closely related to hypothesis testing, information theory, and misspecified inference. Classical information-theoretic tools are summarized in [cover1999elements], and misspecification in statistical inference is studied in [white1982maximum]. The martingale central limit theorem provides the probabilistic basis for the Gaussian score approximation used here [hall2014martingale]. The notions of systematic blindness and mindset dynamics connect these statistical ideas to bounded rationality [simon1957models]: decision quality depends not only on thresholds or priors, but also on which linguistic features are represented. 3 LLM Signaling Game with Semantic Control and Receiver Awareness We now formalize the semantic signaling model. The sender controls the high-level meaning of an LLM-generated message through a semantic input, while receivers interpret the realized token sequence through awareness-dependent detection systems. The model captures persuasion, screening, and deception effects that arise when receivers differ in the features they can perceive and score. The communication process follows the transformation pipeline θ→y→LLMm→ΨαSα→δαa,θ\; μ\;y\; LLM\;m\; _α\;S_α\; _α\;a, where θ denotes the sender’s hidden type, y is the semantic control selected by the sender, m is the generated message, SαS_α is the score assigned by a receiver with awareness level α, and a is the receiver’s action. 3.1 Sender Types and Semantic Control Let Θ be a finite set of sender types. The sender possesses a private type θ∈Θθ∈ , which is not directly observable by the receiver. The receiver begins the interaction with a prior belief ρ∈Δ(Θ)ρ∈ ( ), where Δ(Θ) ( ) denotes the set of probability distributions over Θ . The sender’s type θ encodes latent characteristics that influence the communication strategy. Depending on the application, θ may represent the sender’s intent (e.g., benign or adversarial), the reliability of the underlying information source, ideological position, or the presence of strategic manipulation. In adversarial environments, such as phishing or misinformation campaigns, the type space may distinguish between legitimate and malicious senders; for example, Θ=θlegit,θphish =\θ^legit,θ^phish\, where θlegitθ^legit represents a legitimate communicator and θphishθ^phish a malicious actor. A key feature of language-model-mediated communication is that the sender does not directly choose the realized message m∈VLm∈ V^L. Instead, the sender selects a semantic control that guides the generation process. We therefore introduce a control variable y∈y , where Y denotes the set of feasible semantic instructions. The variable y can be interpreted as a prompt, instruction, or high-level specification of the intended message. The semantic control y influences the distribution of generated messages by shaping linguistic attributes such as tone, framing, persuasive intensity, topical emphasis, and stylistic structure. In practice, y corresponds to a prompt engineering strategy used to steer the output of a language model. This interpretation is particularly natural in phishing settings. A malicious sender may select a control y that induces messages emphasizing urgency (e.g., “your account will be suspended within 24 hours”), authority (e.g., “this message is from the bank’s security department”), or required action (e.g., “verify your account immediately”). Thus, y determines a family of message distributions that amplify specific persuasive or deceptive cues. Because the sender’s type determines the intended semantic content, the sender’s strategy is a mapping from types to semantic controls. Definition 3.1 (Semantic policy). A sender (pure) strategy is a mapping μ:Θ→μ: that assigns a semantic control y=μ(θ)y=μ(θ) to each type θ∈Θθ∈ . Given a semantic control y, the language model induces a probability distribution over messages, denoted by ℙ(⋅∣y)P(· y) on VLV^L. Consequently, the sender does not control individual tokens directly; rather, the sender selects y to influence the induced distribution of messages and, through it, the statistical properties of the score SαS_α. This separation between type and message is central to the model. The private type θ determines the semantic intent y=μ(θ)y=μ(θ), while the language model maps y into a stochastic realization m∼ℙ(⋅∣y)m (· y). Thus, strategic control operates at the level of distributions rather than individual token realizations. 3.2 LLM Message Generation Let V be a finite vocabulary. A message of length L∈ℕL is an element m=(w1,…,wL)∈VLm=(w_1,…,w_L)∈ V^L. We model the generation of a message as a stochastic process on the measurable space (VL,ℱ)(V^L,F), where ℱF is the σ-algebra generated by cylinder sets. The language model generates tokens sequentially via an autoregressive mechanism. Let Y denote the set of admissible semantic controls. For each y∈y , the model induces a sequence of stochastic kernels πy(⋅∣hk):Vk−1→Δ(V), _y(· h_k):V^k-1→ (V), where hk=(w1,…,wk−1)∈Vk−1h_k=(w_1,…,w_k-1)∈ V^k-1 denotes the history prior to stage k, and Δ(V) (V) denotes the set of probability measures on V. The quantity πy(w∣hk) _y(w h_k) represents the conditional probability of generating token w∈Vw∈ V given history hkh_k and control y. Let Wkk=1L\W_k\_k=1^L denote the generated token sequence on (Ω,,ℙy)( ,G,P_y). The process is adapted to the natural filtration Fk=σ(W1,…,Wk)F_k=σ(W_1,…,W_k), and its conditional law satisfies ℙy(Wk=w∣Fk−1)=πy(w∣W1,…,Wk−1),w∈V.P_y\! (W_k=w F_k-1 )= _y(w W_1,…,W_k-1), w∈ V. (3.1) Equation (3.1) specifies a controlled non-homogeneous Markov process whose transition probabilities are parametrized by y and depend on the full history. By the Ionescu–Tulcea theorem, the sequence of stochastic kernels πy(⋅∣hk)k=1L\ _y(· h_k)\_k=1^L uniquely induces a probability measure ℙyP_y on (VL,ℱ)(V^L,F). The probability of generating a message m=(w1,…,wL)m=(w_1,…,w_L) under control y is therefore given by ℙy(m)=∏k=1Lπy(wk∣w1,…,wk−1).P_y(m)= _k=1^L _y(w_k w_1,…,w_k-1). (3.2) Thus, each semantic control y induces a probability measure ℙy∈Δ(VL)P_y∈ (V^L) over the message space. The semantic control y acts as a parameter of the stochastic kernels and therefore determines the law of the entire process Wkk=1L\W_k\_k=1^L. In particular, y influences the distribution of any measurable functional of the generated message. Of central importance is the score Sα=Ψα(m)S_α= _α(m), which can be written as a function of the process Wkk=1L\W_k\_k=1^L. Consequently, the language model can be interpreted as a stochastic channel mapping the control variable y into a probability measure ℙyP_y on VLV^L, and hence into a distribution of scores SαS_α. The sender does not directly select a realization m∈VLm∈ V^L, but instead chooses y to control the induced measure ℙyP_y. 3.3 Receiver Awareness as Type Receivers differ in their ability to interpret and evaluate generated messages. Some are highly sensitive to linguistic patterns indicative of manipulation or risk, while others may fail to detect such signals. We formalize this heterogeneity by introducing an awareness type α∈α , which parametrizes the receiver’s information processing and detection capability. The variable α is interpreted as the private type of the receiver. It captures both cognitive and algorithmic characteristics that determine how a message is evaluated. For human receivers, α can encode prior experience, training, or familiarity with common attack patterns. For automated systems, α may represent the structure or sensitivity of a detection algorithm. To model population-level heterogeneity, we assume that the awareness type is drawn from a distribution F∈Δ()F∈ (A), and write α∼Fα F. The measure F characterizes the composition of the receiver population and determines the prevalence of different evaluation behaviors. Example 3.2 (Keyword-based phishing detection). A concrete and analytically tractable representation arises in the context of phishing detection. Consider receivers who evaluate messages by screening for the presence of suspicious keywords. Let Kα⊂VK_α⊂ V denote a set of alert tokens associated with awareness type α. Upon receiving a message m=(w1,…,wL)m=(w_1,…,w_L), the receiver inspects whether tokens from KαK_α appear in the message. Different awareness types correspond to different keyword sets, which reflect the receiver’s ability to recognize increasingly subtle and context-dependent indicators of malicious intent. A natural specification is to consider a nested family of sets Kα∈\K_α\_α such that higher awareness corresponds to a richer and more discriminative set of tokens. A low-awareness receiver αlow _low may rely only on the most explicit credential-related cues, Kαlow=“password”,“login”,“verify”,“PIN”,K_ _low=\``password′,\ ``login′,\ ``verify′,\ ``PIN′\, which capture direct attempts to solicit sensitive information. An intermediate-awareness receiver αmid _mid augments this set with operational, urgency, and security-related tokens, Kαmid=Kαlow∪“account”,“urgent”,“security”,“update”,“alert”,“suspended”,K_ _mid=K_ _low∪\``account′,\ ``urgent′,\ ``security′,\ ``update′,\ ``alert′,\ ``suspended′\, which capture common patterns used to induce time pressure and legitimacy. A highly aware receiver αhigh _high further expands the set to include more subtle transactional, behavioral, and interaction cues, Kαhigh=Kαmid∪ K_ _high=K_ _mid∪\ “transfer”,“wire”,“payment”,“confirm”, ``transfer′,\ ``wire′,\ ``payment′,\ ``confirm′, “click”,“link”,“reset”,“authentication”, ``click′,\ ``link′,\ ``reset′,\ ``authentication′, “invoice”,“bank”,“verify identity”. ``invoice′,\ ``bank′,\ ``verify identity′\. Thus, the family Kα\K_α\ satisfies a monotonicity property Kα1⊆Kα2K_ _1 K_ _2 whenever α1≤α2 _1≤ _2, reflecting that more aware receivers monitor a strictly richer set of linguistic signals, including both explicit and contextual indicators of phishing. Given a message m, a simple detection mechanism is the indicator ∃k≤L such that wk∈Kα,1\! \∃\,k≤ L such that w_k∈ K_α \, which triggers an alert whenever at least one suspicious token appears. More generally, the receiver may assign heterogeneous weights to tokens in KαK_α, leading to the additive scoring representation that will be introduced in Section 3.4. 3.4 Receiver Scoring Systems Each receiver evaluates incoming messages using an internal scoring mechanism. We represent this mechanism by a receiver-specific operator Ψα:VL→ℝ _α:V^L , which maps a message m∈VLm∈ V^L to a scalar signal Sα=Ψα(m)S_α= _α(m). The score SαS_α represents the receiver’s internal assessment of the message. Depending on the application, this signal may encode moderation risk, toxicity or safety indicators, ideological intensity, likelihood of phishing, or more generally a measure of credibility or trustworthiness. The mapping Ψα _α depends on the receiver’s awareness type α∈α . Thus, heterogeneity in awareness induces heterogeneity in scoring rules across the population. In particular, different receivers may emphasize different linguistic features when evaluating the same message, leading to heterogeneous score realizations for a fixed m∈VLm∈ V^L. A tractable representation of Ψα _α is obtained by decomposing the evaluation process at the token level. Definition 3.3 (Token scoring function). For each α∈α , let ψα:V→ℝ _α:V be a measurable function that assigns a score to each token. We assume that ψα _α is uniformly bounded, i.e., there exists a constant C>0C>0 such that |ψα(w)|≤C| _α(w)|≤ C for all w∈Vw∈ V and all α∈α . Given a message m=(w1,…,wL)m=(w_1,…,w_L), the induced score is Sα(m)=∑k=1Lψα(wk),S_α(m)= _k=1^L _α(w_k), (3.3) so that each token contributes an additive increment to the overall evaluation. Example 3.4 (Connection to keyword-based detection.). The token scoring representation generalizes the keyword-based detection mechanism introduced in the previous subsection. In particular, for a given awareness type α with keyword set Kα⊂VK_α⊂ V, a simple detection rule can be written as ψα(w)=w∈Kα, _α(w)=1\w∈ K_α\, in which case Sα(m)S_α(m) counts the number of suspicious tokens in the message. More generally, different tokens may be assigned heterogeneous weights, allowing for graded sensitivity to different linguistic cues. For example, a highly aware receiver αhigh _high may assign large weights to tokens such as “password”, “verify”, “account”, “urgent”, or “transfer”, while a less aware receiver αlow _low assigns smaller weights or ignores some of these tokens altogether. Consequently, for the same message m, one may have Sαhigh(m)≫Sαlow(m)S_ _high(m) S_ _low(m), indicating stronger detection capability. The function ψα _α can be interpreted as a feature extraction or filtering mechanism that maps linguistic inputs to risk-relevant signals. Receivers with higher awareness apply more sensitive filters that amplify suspicious patterns in the text, whereas receivers with lower awareness apply weaker filters and may fail to detect such patterns. This formulation captures heterogeneity in both human judgment and algorithmic classification systems within a unified mathematical framework. 3.5 Gaussian Approximation of Message Scores Recall from (3.3) that the token-level score is Xk,α=ψα(Wk)X_k,α= _α(W_k), where WkW_k denotes the token generated at stage k. The cumulative score is Sα,L=∑k=1LXk,α.S_α,L= _k=1^LX_k,α. Fix a semantic control y∈y and let (Ω,ℱ,ℙy)( ,F,P_y) denote the probability space induced by the language model under y. The token sequence Wkk=1L\W_k\_k=1^L is adapted to the natural filtration Fk=σ(W1,…,Wk)F_k=σ(W_1,…,W_k). Martingale decomposition. Define the predictable process mk,α:=y[Xk,α∣Fk−1]m_k,α:=E_y[X_k,α F_k-1] and the martingale difference sequence Yk,α:=Xk,α−mk,αY_k,α:=X_k,α-m_k,α. Then Yk,α,Fk\Y_k,α,F_k\ is a martingale difference sequence satisfying y[Yk,α∣Fk−1]=0E_y[Y_k,α F_k-1]=0. Consequently, the cumulative score admits the decomposition Sα,L=∑k=1Lmk,α+Mα,L,S_α,L= _k=1^Lm_k,α+M_α,L, (3.4) where Mα,L:=∑k=1LYk,αM_α,L:= _k=1^LY_k,α is a martingale. Predictable quadratic variation. Let σk,α2 _k,α^2 denote y[Yk,α2∣Fk−1]E_y[Y_k,α^2 F_k-1]. The predictable quadratic variation is ⟨Mα⟩L=∑k=1Lσk,α2. M_α _L= _k=1^L _k,α^2. (3.5) Regularity conditions. We impose the following conditions: (A1) Bounded increments: There exists C>0C>0 such that |ψα(w)|≤C| _α(w)|≤ C for all w∈Vw∈ V. (A2) Variance growth: ⟨Mα⟩L→∞ M_α _L→∞ in probability as L→∞L→∞. (A3) Conditional Lindeberg condition: For every ε>0 >0, 1⟨Mα⟩L∑k=1Ly[Yk,α2|Yk,α|>ε⟨Mα⟩L|Fk−1]→ 0. 1 M_α _L _k=1^LE_y\! [Y_k,α^21\|Y_k,α|> M_α _L\\, |\,F_k-1 ]\; P\;0. Condition (A3) is automatically satisfied under (A1) since the increments are uniformly bounded. Under conditions (A1)–(A3), a martingale central limit theorem (e.g., see [hall2014martingale]) implies Mα,L⟨Mα⟩L⇒N(0,1). M_α,L M_α _L\; \;N(0,1). (3.6) Asymptotic normality of the score. Let s¯α(y):=y[Sα,L] s_α(y):=E_y[S_α,L]. From (3.4), we have Sα,L=s¯α(y)+Mα,LS_α,L= s_α(y)+M_α,L. If, in addition, Vary(Sα,L)∼y[⟨Mα⟩L],Var_y(S_α,L) _y[ M_α _L], (3.7) then Sα,L−s¯α(y)Vary(Sα,L)⇒N(0,1). S_α,L- s_α(y) Var_y(S_α,L)\; \;N(0,1). (3.8) Proposition 3.5 (Gaussian approximation of message scores). Under conditions (A1)–(A3) and (3.7), the cumulative score Sα,LS_α,L satisfies Sα,L−s¯α(y)σα(y)⇒N(0,1), S_α,L- s_α(y) _α(y)\; \;N(0,1), (3.9) where s¯α(y)=y[Sα,L] s_α(y)=E_y[S_α,L] and σα2(y)=Vary(Sα,L) _α^2(y)=Var_y(S_α,L). Consequently, for sufficiently large L, Sα,L≈N(s¯α(y),σα2(y)).S_α,L≈ N\! ( s_α(y),\, _α^2(y) ). (3.10) Proposition 3.5 shows that the cumulative score induced by the language model behaves asymptotically as a Gaussian signal whose mean and variance depend on the semantic control y and the receiver type α. The sender, through the choice of y, controls the location of the distribution, while the stochastic nature of token generation determines its dispersion. This Gaussian structure forms the basis for the receiver’s inference problem and the equilibrium analysis developed in subsequent sections. 3.6 Receiver Beliefs, Utility, and Decision Rules After observing the generated message m through its score Sα=Ψα(m)S_α= _α(m), the receiver updates its belief about the sender’s type and selects an action. Let ρ∈Δ(Θ)ρ∈ ( ) denote the prior receiver and sender types. For a fixed semantic control y∈y and awareness level α, the posterior belief is given by Bayes’ rule: ρ(θ∣s,y,α)=ρ(θ)fα,θ(s∣y)∑θ′∈Θρ(θ′)fα,θ′(s∣y),ρ(θ s,y,α)= ρ(θ)\,f_α,θ(s y) _θ ∈ ρ(θ )\,f_α,θ (s y), (3.11) where s=Sαs=S_α and fα,θ(⋅∣y)f_α,θ(· y) denotes the density of the score under type θ. Under Proposition 3.5, the score satisfies the Gaussian approximation Sα,L∣(θ,y)≈N(s¯α,θ(y),σα,θ2(y)),S_α,L (θ,y)≈ N\! ( s_α,θ(y),\, _α,θ^2(y) ), (3.12) and hence the likelihood function is fα,θ(s∣y)=12πσα,θ2(y)exp(−(s−s¯α,θ(y))22σα,θ2(y)).f_α,θ(s y)= 1 2π _α,θ^2(y) \! (- (s- s_α,θ(y) )^22 _α,θ^2(y) ). (3.13) Let UR:A×Θ→ℝU_R:A× denote the receiver’s utility function. Given posterior beliefs (3.11), the expected utility of action a∈Aa∈ A is UR(a∣s,y,α)=∑θ∈Θρ(θ∣s,y,α)UR(a,θ).EU_R(a s,y,α)= _θ∈ ρ(θ s,y,α)\,U_R(a,θ). (3.14) The receiver’s strategy is a measurable mapping δα:ℝ→A _α:R→ A such that δα(s)∈argmaxa∈AUR(a∣s,y,α). _α(s)∈ _a∈ AEU_R(a s,y,α). (3.15) Consider A=allow,blockA=\allow,block\ and Θ=θlegit,θmal =\θ^legit,θ^mal\. Define the likelihood ratio Λ(s):=fα,θmal(s∣y)fα,θlegit(s∣y). (s):= f_α,θ^mal(s y)f_α,θ^legit(s y). (3.16) Using (3.11), the posterior odds ratio satisfies ρ(θmal∣s,y,α)ρ(θlegit∣s,y,α)=ρ(θmal)ρ(θlegit)⋅Λ(s). ρ(θ^mal s,y,α)ρ(θ^legit s,y,α)= ρ(θ^mal)ρ(θ^legit)· (s). (3.17) Proposition 3.6 (Threshold optimality of the receiver). Assume A=allow,blockA=\allow,block\ and that UR(allow,θlegit)>UR(block,θlegit)U_R(allow,θ^legit)>U_R(block,θ^legit) and UR(block,θmal)>UR(allow,θmal)U_R(block,θ^mal)>U_R(allow,θ^mal). Then, the optimal decision rule (3.15) is a likelihood-ratio test: there exists κ>0κ>0 such that δα(s)=block,Λ(s)>κ,allow,Λ(s)≤κ, _α(s)= casesblock,& (s)>κ,\\ allow,& (s)≤κ, cases (3.18) where κ=ρ(θlegit)ρ(θmal)⋅UR(allow,θlegit)−UR(block,θlegit)UR(block,θmal)−UR(allow,θmal).κ= ρ(θ^legit)ρ(θ^mal)· U_R(allow,θ^legit)-U_R(block,θ^legit)U_R(block,θ^mal)-U_R(allow,θ^mal). (3.19) Proof. The receiver prefers block over allow if and only if UR(block∣s,y,α)≥UR(allow∣s,y,α).EU_R(block s,y,α) _R(allow s,y,α). (3.20) Using (3.14), this is equivalent to ρ(θmal∣s,y,α)(UR(block,θmal)−UR(allow,θmal)) ρ(θ^mal s,y,α) (U_R(block,θ^mal)-U_R(allow,θ^mal) ) ≥ρ(θlegit∣s,y,α)(UR(allow,θlegit)−UR(block,θlegit)). ≥ρ(θ^legit s,y,α) (U_R(allow,θ^legit)-U_R(block,θ^legit) ). (3.21) Rearranging and applying (3.17) yields Λ(s)≥κ, (s)≥κ, which proves (3.18). ∎ Under (3.12), if σα,θmal2(y)=σα,θlegit2(y) _α,θ^mal^2(y)= _α,θ^legit^2(y), then logΛ(s) (s) is affine in s, and hence Λ(s) (s) is monotone. Thus there exists a threshold η(α)η(α) such that δα(s)=allow,s≤η(α),block,s>η(α). _α(s)= casesallow,&s≤η(α),\\ block,&s>η(α). cases (3.22) Under the Gaussian approximation, ℙ(Sα≤η(α)∣y)=Φ(η(α)−s¯α(y)σα(y)),P\! (S_α≤η(α) y )= \! ( η(α)- s_α(y) _α(y) ), (3.23) where Φ denotes the standard normal cumulative distribution function. 3.7 Sender Payoff and Audience Matching The sender’s payoff depends on its type and on which receivers accept the generated message. Because receivers differ in their awareness levels, the sender interacts with a heterogeneous population. Let θ∈Θθ∈ denote the sender’s type and α∈α the receiver’s awareness level. Let F∈Δ()F∈ (A) denote the population distribution of receiver types. Sender valuation. When a receiver of awareness level α∈α accepts a message generated under semantic control y∈y by a sender of type θ∈Θθ∈ , the sender obtains utility VS(θ,y,α),V_S(θ,y,α), (3.24) representing the type-dependent benefit of a successful interaction. To model heterogeneous targeting, let w(α)≥0w(α)≥ 0 (3.25) be a measurable weighting function over receiver types, capturing their relative importance. We adopt the structured specification VS(θ,y,α)=vθ(α)−Cθ(y),V_S(θ,y,α)=v_θ(α)-C_θ(y), (3.26) where vθ:→ℝ+v_θ:A _+ denotes the value of engaging a receiver of type α, and Cθ:→ℝ+C_θ:Y _+ represents the cost of implementing control y. The function vθ(α)v_θ(α) encodes targeting preferences and differs across types. For θbenθ^ben, it is typically increasing in α, reflecting higher value from more aware receivers. For θmalθ^mal, it is typically decreasing in α, reflecting a preference for less aware, more susceptible targets. The cost Cθ(y)C_θ(y) captures the effort or risk associated with shaping the signal distribution, including tradeoffs between persuasiveness and detectability. The product w(α)vθ(α)w(α)\,v_θ(α) defines the effective weight assigned to receivers of type α. Thus, the sender’s objective can be interpreted as weighting acceptance probabilities by an effective targeting measure over the population. Acceptance probability. From (3.22) and (3.23), a receiver with awareness level α accepts the message if Sα,L≤η(α)S_α,L≤η(α). Under the Gaussian approximation, the acceptance probability conditional on (θ,y)(θ,y) is ℙ(Sα,L≤η(α)∣θ,y,α)=Φ(η(α)−s¯α,θ(y)σα,θ(y)),P\! (S_α,L≤η(α) θ,y,α )= \! ( η(α)- s_α,θ(y) _α,θ(y) ), (3.27) where s¯α,θ(y)=[Sα,L∣θ,y,α],σα,θ2(y)=Var(Sα,L∣θ,y,α). s_α,θ(y)=E\! [S_α,L θ,y,α ], _α,θ^2(y)=Var\! (S_α,L θ,y,α ). Expected payoff. The sender’s expected payoff, conditional on type θ, is given by US(θ,y)=∫w(α)VS(θ,y,α)ℙ(Sα,L≤η(α)∣θ,y,α)F(α).U_S(θ,y)= _Aw(α)\,V_S(θ,y,α)\,P\! (S_α,L≤η(α) θ,y,α )\,dF(α). (3.28) Substituting (3.27) yields US(θ,y)=∫w(α)VS(θ,y,α)Φ(η(α)−s¯α,θ(y)σα,θ(y))F(α).U_S(θ,y)= _Aw(α)\,V_S(θ,y,α)\, \! ( η(α)- s_α,θ(y) _α,θ(y) )\,dF(α). (3.29) Sender optimization problem. The sender selects a semantic control y∈y to maximize expected payoff. An optimal control y∗y^* satisfies y∗∈argmaxy∈US(θ,y),y^*∈ _y U_S(θ,y), (3.30) for each θ∈Θθ∈ . We represent the sender’s behavior by a mapping μ:Θ→μ: , where μ(θ):=y∗μ(θ):=y^* (3.31) denotes the semantic control selected by a sender of type θ. The function μ(θ)μ(θ) is a control variable and should not be confused with the mean of the score distribution. Rather, it induces the distribution of scores through s¯α,θ(μ(θ))=[Sα,L∣θ,μ(θ),α], s_α,θ(μ(θ))=E\! [S_α,L θ,μ(θ),α ], (3.32) and similarly σα,θ(μ(θ)) _α,θ(μ(θ)) determines the dispersion. Equation (3.30) defines a type-dependent optimization problem in which the sender selects a control μ(θ)μ(θ) to shape the distribution of message scores. The functions s¯α,θ(μ(θ)) s_α,θ(μ(θ)) and σα,θ(μ(θ)) _α,θ(μ(θ)) determine, respectively, the location and dispersion of the score distribution perceived by receivers of type α. The sender uses μ(θ)μ(θ) to trade off acceptance across heterogeneous receiver types. The weighting function w(α)w(α) and valuation function VS(θ,μ(θ),α)V_S(θ,μ(θ),α) encode audience targeting preferences. In adversarial settings, such as phishing, a malicious sender θmalθ^mal selects μ(θ)μ(θ) to increase acceptance probability among less-aware receivers while avoiding more-aware ones. This induces a systematic shift of the score distribution toward regions below the thresholds η(α)η(α) for targeted audiences. Consequently, the sender’s problem can be interpreted as an audience matching problem: the control policy μ(θ)μ(θ) selects a signal distribution that maximizes expected payoff under heterogeneous inference and decision rules. 4 Perfect Bayesian Nash Equilibrium We now define the equilibrium of the signaling game induced by the controlled language generation model. A sender of type θ∈Θθ∈ selects a semantic control y∈y . Through the stochastic kernels (3.1), this induces a probability measure ℙyP_y on the message space VLV^L via (3.2), and hence a distribution over scores Sα=Ψα(m),S_α= _α(m), defined in (3.3). The receiver of awareness type α∈α observes the realization s∈ℝs of SαS_α and selects an action a∈Aa∈ A according to (3.15). Beliefs are updated using Bayes’ rule (3.11), with likelihood given by (3.13) under the Gaussian approximation (3.12). The sender’s payoff is given by (3.29). We represent the sender’s strategy by a measurable mapping μ:Θ→,μ: , as defined in (3.31). Definition 4.1 (Perfect Bayesian Nash Equilibrium). A Perfect Bayesian Nash Equilibrium (PBNE) consists of (i) a sender strategy μ∗:Θ→μ^*: , (i) a receiver decision rule δα∗:ℝ→A _α^*:R→ A for each α∈α , (i) and a belief system ρ∗(θ∣s,α)ρ^*(θ s,α), such that the following conditions hold. Sender optimality. For every θ∈Θθ∈ , the equilibrium control μ∗(θ)μ^*(θ) solves the sender’s problem (3.30), i.e., μ∗(θ)∈argmaxy∈US(θ,y),μ^*(θ)∈ _y U_S(θ,y), (4.1) where US(θ,y)U_S(θ,y) is given by (3.29). The optimization accounts for the induced score distribution through s¯α,θ(y) s_α,θ(y) and σα,θ(y) _α,θ(y) defined in (3.12). Receiver optimality. For each α∈α and s∈ℝs , the decision rule δα∗ _α^* satisfies δα∗(s)∈argmaxa∈A∑θ∈Θρ∗(θ∣s,α)UR(a,θ), _α^*(s)∈ _a∈ A _θ∈ ρ^*(θ s,α)\,U_R(a,θ), (4.2) where the posterior ρ∗(θ∣s,α)ρ^*(θ s,α) is given by (3.11) under the equilibrium strategy μ∗μ^*. Belief consistency. For all s in the support of the equilibrium score distribution, beliefs satisfy Bayes’ rule: ρ∗(θ∣s,α)=ρ(θ)fα,θ(s∣μ∗(θ))∑θ′∈Θρ(θ′)fα,θ′(s∣μ∗(θ′)),ρ^*(θ s,α)= ρ(θ)\,f_α,θ(s μ^*(θ)) _θ ∈ ρ(θ )\,f_α,θ (s μ^*(θ )), (4.3) where fα,θ(s∣y)f_α,θ(s y) is defined in (3.13). In equilibrium, the sender selects controls μ∗(θ)μ^*(θ) that shape the induced probability measure ℙμ∗(θ)P_μ^*(θ) on the messages and, consequently, the Gaussian score distribution (3.12). The receiver performs statistical inference based on s and responds optimally. Under Proposition 3.6, the receiver’s strategy reduces to a threshold rule (3.22). Hence, the equilibrium can be characterized as a fixed point between: (i) semantic control y=μ(θ)y=μ(θ), which determines the distribution of scores through (3.2) and (3.3), and (i) statistical detection, in which receivers apply likelihood-ratio tests based on (3.13). This fixed point captures the interaction between controlled language generation and heterogeneous inference across the receiver population. 4.1 Direct Revelation with Generative Types We consider a finite type space Θ==θ0,θ1,…,θK =Y=\ _0, _1,…, _K\, where each type θ∈Θθ∈ corresponds to a canonical semantic control (prompt). A sender of true type θ selects a reported control y∈Θy∈ , and a strategy is a mapping μ:Θ→Θμ: → . For each θ∈Θθ∈ , the semantic control induces a sequence of stochastic kernels πθ(⋅∣hk)k=1L\ _θ(· h_k)\_k=1^L as in (3.1), which uniquely define a probability measure ℙθ∈Δ(VL)P_θ∈ (V^L) via (3.2). Hence, each type θ determines a generative law over messages. With Θ= =Y, reporting y is equivalent to selecting the generative mechanism ℙyP_y. A sender of type θ who reports y induces the distribution ℙyP_y while retaining its intrinsic valuation vθ(⋅)v_θ(·). Example 4.2 (Phishing with generative types). Consider a phishing detection setting in which a sender communicates through an LLM. In a classical formulation, the type space is Θorig=legit,phish ^orig=\legit,phish\, which captures the sender’s intent, and the message (or semantic control) space origY^orig consists of prompts that can be used to generate messages. We assume that the legitimate type has a single baseline semantic control y0y_0 (truthful communication), while the phishing type has access to multiple semantic controls y1,y2,y3y_1,y_2,y_3. For instance, y1y_1 may correspond to an urgent credential request, y2y_2 to an invoice or payment scam, and y3y_3 to a security alert impersonation. In this representation, a sender of type θ∈Θorigθ∈ ^orig selects a prompt y∈origy ^orig, so the choice of y depends on θ but the type itself does not distinguish among different phishing strategies. In contrast, we construct a refined representation in which both the type space and the message space are given by a finite set of canonical semantic controls, Θ==θ0,θ1,θ2,θ3 =Y=\ _0, _1, _2, _3\. Each element θi _i corresponds to a prompt template, with θ0 _0 representing legitimate communication and θ1,θ2,θ3 _1, _2, _3 representing distinct phishing strategies such as credential requests, invoice scams, and security alerts. We identify each type θi _i with a prompt yiy_i, so that θi↔yi _i y_i. In this refined model, the heterogeneity of phishing behavior is incorporated directly into the type space, and reporting y∈y is equivalent to selecting a generative mechanism indexed by θi _i. Let =α1,…,αNA=\ _1,…, _N\ be the finite receiver type space with distribution F(αn)=pnF( _n)=p_n. Under the Gaussian approximation (3.12), the acceptance probability for receiver type αn _n is Pn(θ,y)=Φ(η(αn)−s¯αn,θ(y)σαn,θ(y)).P_n(θ,y)= \! ( η( _n)- s_ _n,θ(y) _ _n,θ(y) ). (4.4) The expected payoff of type θ under control y is US(θ,y)=∑n=1Npnw(αn)vθ(αn)Pn(θ,y).U_S(θ,y)= _n=1^Np_n\,w( _n)\,v_θ( _n)\,P_n(θ,y). (4.5) Define the weights w~θ,n:=pnw(αn)vθ(αn) w_θ,n:=p_n\,w( _n)\,v_θ( _n). Then US(θ,y)=∑n=1Nw~θ,nPn(θ,y),U_S(θ,y)= _n=1^N w_θ,n\,P_n(θ,y), (4.6) which exhibits US(θ,y)U_S(θ,y) as a weighted aggregation of acceptance probabilities. Define Ui,jS:=US(θi,θj)=∑n=1Nw~θi,nPn(θi,θj)U^S_i,j:=U_S( _i, _j)= _n=1^N w_ _i,n\,P_n( _i, _j). Then U∈ℝK×KU ^K× K is the payoff matrix, where row i encodes the preferences of type θi _i and column j corresponds to the generative distribution ℙθjP_ _j. Definition 4.3 (Direct revelation mechanism). A (direct) mechanism is a mapping μ:Θ→Θμ: → assigning a reported control to each type. Definition 4.4 (Incentive-Compatible Strategy). A strategy μ is incentive compatible if μ(θi)=θiμ( _i)= _i for all i∈1,…,Ki∈\1,…,K\. Definition 4.5 (Incentive compatibility). A strategy μ is incentive compatible if US(θi,μ(θi))≥US(θi,y),∀i∈1,…,K,y∈Θ.U_S( _i,μ( _i))≥ U_S( _i,y), ∀ i∈\1,…,K\,\;y∈ . (4.7) Proposition 4.6 (Matrix characterization of incentive compatibility). The strategy μ(θi)=θiμ( _i)= _i is incentive compatible if and only if Ui,iS≥Ui,jS,∀i,j∈1,…,K.U^S_i,i≥ U^S_i,j, ∀ i,j∈\1,…,K\. (4.8) Proposition 4.7 (Row-wise dominance condition). Incentive-Compatible separation holds if and only if Ui,iS=maxj∈1,…,KUi,jSU^S_i,i= _j∈\1,…,K\U^S_i,j for all i. Equivalently, for each type θi _i, the diagonal entry is a maximizer of the i-th row, i.e., θi∈argmaxjUi,jS _i∈ _jU^S_i,j. Proposition 4.8 (PBNE under row-wise dominance). Consider the direct revelation model with Θ==θ1,…,θK =Y=\ _1,…, _K\ and the payoff matrix of the sender U∈ℝK×KU ^K× K defined by Ui,jS=US(θi,y=θj)U^S_i,j=U_S( _i,y= _j). Suppose that the row-wise dominance condition holds, i.e. Ui,iS≥Ui,jSU^S_i,i≥ U^S_i,j for all i,ji,j. Then there exists a Perfect Bayesian Nash Equilibrium (PBNE) (μ∗,δα∗α∈,ρ∗)(μ^*,\ _α^*\_α ,ρ^*) with the following structure: (i) Sender strategy: The sender plays the incentive-compatible strategy μ∗(θi)=θiμ^*( _i)= _i for all i. (i) Beliefs: For every α∈α and observed score s∈ℝs , beliefs are updated via Bayes’ rule as ρ∗(θ∣s,α)=ρ(θ)fα,θ(s∣μ∗(θ))∑θ′∈Θρ(θ′)fα,θ′(s∣μ∗(θ′)).ρ^*(θ s,α)= ρ(θ)\,f_α,θ(s μ^*(θ)) _θ ∈ ρ(θ )\,f_α,θ (s μ^*(θ )). Under the Gaussian approximation, we have Sα∣(θ,μ∗(θ))≈(s¯α,θ(μ∗(θ)),σα,θ2(μ∗(θ)))S_α (θ,μ^*(θ)) ( s_α,θ(μ^*(θ)),σ^2_α,θ(μ^*(θ))), so fα,θ(⋅∣y)f_α,θ(· y) is given by (3.13). (i) Receiver strategy: For each α∈α , the receiver applies the threshold rule δα∗(s)=allow,s≤η(α),block,s>η(α), _α^*(s)= casesallow,&s≤η(α),\\ block,&s>η(α), cases which is optimal given the posterior ρ∗(⋅∣s,α)ρ^*(· s,α). Moreover, the equilibrium is separating in distribution: each type θi _i induces a distinct score distribution fα,θi(⋅∣θi)f_α, _i(· _i), so types are statistically identifiable though not perfectly revealed pointwise. Proof. With row-wise dominance, for each type θi _i, we have US(θi,θi)≥US(θi,θj)U_S( _i, _i)≥ U_S( _i, _j) for all j, so the incentive-compatible strategy μ∗(θi)=θiμ^*( _i)= _i is optimal. Given μ∗μ^*, each type θ induces a score distribution Sα∣(θ,μ∗(θ))∼fα,θ(⋅∣μ∗(θ))S_α (θ,μ^*(θ)) f_α,θ(· μ^*(θ)), which is approximately Gaussian. Hence, beliefs ρ∗(θ∣s,α)ρ^*(θ s,α) follow the Bayes rule, establishing belief consistency. Given these beliefs, the receiver solves a binary decision problem. By likelihood-ratio optimality, the optimal rule is a threshold rule in s, yielding δα∗ _α^*. Off-path beliefs do not affect incentives since incentive-compatible reporting is optimal under row-wise dominance. Therefore, (μ∗,δα∗,ρ∗)(μ^*,\ _α^*\,ρ^*) satisfies sequential rationality and belief consistency and thus constitutes a PBNE. ∎ 4.2 Awareness and Statistical Discrimination Definition 4.9 (Ordering of awareness types). For α,α′∈α,α , we say that α is more aware than α′α (denoted α⪰α′α α ) if, for all y∈y , s¯α,θmal(y)−s¯α,θlegit(y)≥s¯α′,θmal(y)−s¯α′,θlegit(y). s_α, _mal(y)- s_α, _legit(y)\;≥\; s_α , _mal(y)- s_α , _legit(y). If the inequality is strict for some y, we write α≻α′α α . Proposition 4.10 (Awareness, threshold monotonicity, and behavior). Consider the Gaussian score model Sα∣(θ,y)∼(s¯α,θ(y),σα2(y))S_α (θ,y) ( s_α,θ(y),σ^2_α(y)) and suppose A=allow,blockA=\allow,block\ with decision rule δα∗(s)=s>η(α) _α^*(s)=1\s>η(α)\. Let the awareness ordering α⪰α′α α be defined as in Definition 4.9, i.e., for all y, s¯α,θmal(y)−s¯α,θlegit(y)≥s¯α′,θmal(y)−s¯α′,θlegit(y). s_α, _mal(y)- s_α, _legit(y)\;≥\; s_α , _mal(y)- s_α , _legit(y). Then: (a) Likelihood-ratio monotonicity: For each α, the likelihood ratio Λα(s) _α(s) is increasing in s. Moreover, if α⪰α′α α , then the signal-to-noise ratio s¯α,θmal(y)−s¯α,θlegit(y)σα(y) s_α, _mal(y)- s_α, _legit(y) _α(y) is (weakly) larger, implying stronger statistical discrimination. (b) Threshold monotonicity: If α⪰α′α α , then η(α)≤η(α′)η(α)≤η(α ). Thus, more aware receivers apply (weakly) stricter thresholds. (c) Acceptance ordering: For any (θ,y)(θ,y), letting Pα(θ,y)=ℙ(Sα≤η(α)∣θ,y)P_α(θ,y)=P(S_α≤η(α) θ,y), we have Pα(θ,y)≤Pα′(θ,y)whenever α⪰α′.P_α(θ,y)≤ P_α (θ,y) α α . (d) Behavioral monotonicity: For any s∈ℝs , δα∗(s)≥δα′∗(s)whenever α⪰α′, _α^*(s)≥ _α ^*(s) α α , i.e., more aware receivers are (weakly) more likely to block. Proof. Under the Gaussian model with variance independent of θ, the log-likelihood ratio is affine in s: logΛα(s)=s¯α,θmal(y)−s¯α,θlegit(y)σα2(y)s+const. _α(s)= s_α, _mal(y)- s_α, _legit(y) _α^2(y)\,s+const. Hence Λα(s) _α(s) is increasing in s, and its slope is proportional to the separation of means, establishing (a). By optimality, the receiver applies a likelihood-ratio test, which reduces to a threshold rule in s. A larger separation between s¯α,θmal(y) s_α, _mal(y) and s¯α,θlegit(y) s_α, _legit(y) implies that smaller values of s suffice to detect the malicious type. Hence η(α)≤η(α′)η(α)≤η(α ) when α⪰α′α α , proving (b). Given η(α)≤η(α′)η(α)≤η(α ), we have s≤η(α)⊆s≤η(α′)\s≤η(α)\ \s≤η(α )\, which implies Pα(θ,y)≤Pα′(θ,y)P_α(θ,y)≤ P_α (θ,y), establishing (c). Finally, since δα∗(s)=s>η(α) _α^*(s)=1\s>η(α)\ and η(α)≤η(α′)η(α)≤η(α ), it follows that δα∗(s)≥δα′∗(s) _α^*(s)≥ _α ^*(s) for all s, proving (d). ∎ Proposition 4.11 (Keyword enrichment and strict awareness ordering). Suppose the scoring function is given by ψα(w)=w∈Kα _α(w)=1\w∈ K_α\ for a family of keyword sets Kα∈\K_α\_α , and let s¯α,θ(y)=∑k=1Lℙ(Wk∈Kα∣θ,y). s_α,θ(y)= _k=1^LP(W_k∈ K_α θ,y). Let ΔK:=Kα∖Kα′ K:=K_α K_α denote the additional keywords of α relative to α′α . Assume that for all y∈y , ℙ(Wk∈ΔK∣θmal,y)≥ℙ(Wk∈ΔK∣θlegit,y).P(W_k∈ K _mal,y)\;≥\;P(W_k∈ K _legit,y). Then: (i) Additive discrimination decomposition: s¯α,θ(y)=s¯α′,θ(y)+∑k=1Lℙ(Wk∈ΔK∣θ,y). s_α,θ(y)= s_α ,θ(y)+ _k=1^LP(W_k∈ K θ,y). (i) Weak awareness ordering: s¯α,θmal(y)−s¯α,θlegit(y)≥s¯α′,θmal(y)−s¯α′,θlegit(y), s_α, _mal(y)- s_α, _legit(y)\;≥\; s_α , _mal(y)- s_α , _legit(y), and hence α⪰α′α α . (i) Strict awareness (if informative expansion): If the inequality is strict for some y, then α≻α′α α . Consequently, awareness increases if and only if the additional features ΔK K contribute positively to type discrimination. In particular, keyword set inclusion Kα⊇Kα′K_α K_α improves awareness if and only if the newly added keywords are informative, i.e., more likely under θmal _mal than θlegit _legit. 4.3 Incentive Design for Universal Benign Semantics We study the incentive structure under which the equilibrium induces uniform benign behavior, i.e., μ(θ)=y0,∀θ∈Θ,μ(θ)=y_0,\ ∀θ∈ , so that all types, legitimate or malicious, select the same baseline semantic control y0∈y_0 . This corresponds to a pooling outcome in which no sender has an incentive to deviate to alternative semantic controls associated with phishing or manipulation. From (3.29), the sender’s expected payoff is US(θ,y)U_S(θ,y) for θ∈Θθ∈ and y∈y , defining a mapping US:Θ×→ℝU_S: ×Y . For finite sets Θ=θ1,…,θK =\ _1,…, _K\ and =y0,y1,…,yMY=\y_0,y_1,…,y_M\, define Ui,jS:=US(θi,yj)U^S_i,j:=U_S( _i,y_j), yielding a K×(M+1)K×(M+1) payoff array; in particular, Θ and Y need not coincide. The strategy μ(θ)=y0μ(θ)=y_0 is optimal for all types if and only if it solves (3.30) for every θ∈Θθ∈ , which is equivalent to the condition US(θ,y0)≥US(θ,y),∀θ∈Θ,∀y∈.U_S(θ,y_0)\;≥\;U_S(θ,y), ∀θ∈ ,\;∀ y . (4.9) In discrete notation, this becomes Ui,0S≥Ui,jS,∀i,j,U^S_i,0≥ U^S_i,j,\ ∀ i,j, i.e., the column corresponding to y0y_0 dominates all other columns row-wise. By (3.29) and (3.27), the payoff US(θ,y)U_S(θ,y) is driven by the acceptance probability ℙ(Sα,L≤η(α)∣θ,y,α),P\! (S_α,L≤η(α) θ,y,α ), which depends on the Gaussian parameters s¯α,θ(y) s_α,θ(y) and σα,θ(y) _α,θ(y) induced by the semantic control y. Hence, (4.9) requires that, for every type θ, the control y0y_0 yields a (weakly) higher expected payoff than any alternative y, thereby penalizing deviations through their impact on the induced score distribution and acceptance probabilities. Proposition 4.12 (Benign pooling equilibrium). Let US:Θ×→ℝU_S: ×Y be the sender payoff defined in (3.29). If the incentive condition (4.9) holds, then there exists a Perfect Bayesian Nash Equilibrium (μ∗,δα∗α∈,ρ∗)(μ^*,\ _α^*\_α ,ρ^*) such that μ∗(θ)=y0,∀θ∈Θ,μ^*(θ)=y_0, ∀θ∈ , where, for each α∈α , the receiver strategy δα∗ _α^* is a best response to the induced pooling distribution and is characterized by the threshold rule (3.22), and the belief system ρ∗ρ^* is consistent with Bayes’ rule wherever applicable. 4.3.1 Design Levers The condition (4.9) can be enforced by modifying the primitives entering (3.29). These interventions operate through the statistical properties of the signal, the cost structure faced by the sender, and the composition of the receiver population. Detection (statistical separation). Using (3.27), one can reduce acceptance probabilities under y≠y0y≠ y_0 by increasing the statistical separability between benign and malicious semantics. This can be interpreted as improving detection mechanisms such as spam filters or LLM-based classifiers, which increase the gap between s¯α,θmal(y) s_α, _mal(y) and s¯α,θlegit(y) s_α, _legit(y), or tightening the decision thresholds η(α)η(α). As a result, phishing messages are more likely to be rejected, lowering the payoff US(θ,y)U_S(θ,y) for y≠y0y≠ y_0. Cost shaping (adversarial friction). An alternative approach is to increase Cθ(y)C_θ(y) in (3.26) for y≠y0y≠ y_0, thereby directly penalizing malicious semantic controls. In practice, this corresponds to introducing guardrails or constraints in the generative process, such as content moderation, rate limiting, or filtering mechanisms that make it more difficult to produce phishing messages. These mechanisms increase the effort required for adversaries to evade detection, effectively raising the cost of malicious behavior and reducing the corresponding payoff. Population shaping (awareness and training). Finally, one can adjust the weighting function w(α)w(α) or the distribution F in (3.29) to place greater emphasis on high-awareness receivers. This corresponds to improving user awareness through training, education, or interface design, such as warning systems or explainable alerts. A more informed population reduces the acceptance probability of malicious messages across a wider range of receivers, thereby reinforcing detection and further diminishing the incentive to deviate from y0y_0. 4.3.2 Optimal population shaping under discrete receivers. Assume that the receiver population is discrete, with types α1,…,αN⊂\ _1,…, _N\ . The population distribution is given by F=∑n=1Npnδαn,pn≥0,∑n=1Npn=1,F= _n=1^Np_n\, _ _n, p_n≥ 0,\;\; _n=1^Np_n=1, where p=(p1,…,pN)∈ΔNp=(p_1,…,p_N)∈ ^N. Let F0F_0 denote a baseline distribution with weights p0=(p10,…,pN0)p^0=(p_1^0,…,p_N^0). Under this representation, the sender payoff (3.29) becomes US(θ,y)=∑n=1Npnw(αn)(vθ(αn)−Cθ(y))Pαn(θ,y),U_S(θ,y)= _n=1^Np_n\,w( _n) (v_θ( _n)-C_θ(y) )P_ _n(θ,y), where Pαn(θ,y)P_ _n(θ,y) is defined in (3.27). Definition 4.13 (Pooling feasibility under population shaping). Given a baseline distribution p0∈ΔNp^0∈ ^N, a distribution p∈ΔNp∈ ^N is said to be pooling-feasible if it satisfies ∑n=1NpnΔn(θ,y)≥0,∀θ∈Θ,∀y∈, _n=1^Np_n\, _n(θ,y)≥ 0, ∀θ∈ ,\;∀ y , (4.10) where Δn(θ,y):=w(αn)[(vθ(αn)−Cθ(y0))Pαn(θ,y0)−(vθ(αn)−Cθ(y))Pαn(θ,y)]. _n(θ,y):=w( _n) [ (v_θ( _n)-C_θ(y_0) )P_ _n(θ,y_0)- (v_θ( _n)-C_θ(y) )P_ _n(θ,y) ]. The quantity Δn(θ,y) _n(θ,y) represents the marginal incentive advantage of the benign control y0y_0 over a deviation y under receiver type αn _n. When Δn(θ,y)>0 _n(θ,y)>0, the deviation is disincentivized, whereas Δn(θ,y)<0 _n(θ,y)<0 indicates that it remains profitable. This yields a natural interpretation in terms of receiver awareness. High-awareness receivers induce low acceptance probabilities for malicious messages, leading to Δn(θ,y)>0 _n(θ,y)>0, while low-awareness receivers may satisfy Δn(θ,y)<0 _n(θ,y)<0 and thus create incentives for deviation. Problem 4.14 (Optimal population shaping). Given a baseline distribution p0∈ΔNp^0∈ ^N, the platform seeks to minimally perturb the population so as to enforce the benign pooling condition. This leads to the constrained optimization problem minp∈ΔN _p∈ ^N D(p∥p0) D(p\,\|\,p^0) (4.11) s.t. ∑n=1NpnΔn(θ,y)≥0,∀θ∈Θ,∀y∈, _n=1^Np_n\, _n(θ,y)≥ 0, ∀θ∈ ,\;∀ y , where Δn(θ,y) _n(θ,y) is defined in (4.10). A particularly important choice is the Kullback–Leibler divergence D(p∥p0)=∑n=1Npnlogpnpn0,D(p\|p^0)= _n=1^Np_n p_np_n^0, which yields the minimum-information or minimum-distortion adjustment of the population distribution required to eliminate profitable deviations. In this sense, the platform implements the smallest intervention (in an information-theoretic sense) that enforces incentive compatibility. Proposition 4.15 (Optimal population shaping under KL divergence). Consider problem (4.11) with D(p∥p0)=∑n=1Npnlogpnpn0,D(p\|p^0)= _n=1^Np_n p_np_n^0, where p0∈ΔNp^0∈ ^N satisfies pn0>0p_n^0>0 for all n. Suppose that the feasible set of (4.11) is nonempty. Then: (i) There exists a unique optimal solution p∗∈ΔNp^*∈ ^N. (i) There exist nonnegative multipliers λθ,y∗≥0:θ∈Θ,y∈\ _θ,y^*≥ 0:θ∈ ,y \, associated with the pooling constraints (4.10), such that p∗p^* admits the exponential tilting form pn∗=pn0exp(Λn∗)∑m=1Npm0exp(Λm∗),p_n^*= p_n^0 \! ( _n^* ) _m=1^Np_m^0 \! ( _m^* ), (4.12) where Λn∗=∑θ∈Θ∑y∈λθ,y∗Δn(θ,y). _n^*= _θ∈ _y _θ,y^*\, _n(θ,y). (i) (Semi-closed form dual characterization) The multiplier vector λ∗=(λθ,y∗)λ^*=( _θ,y^*) is the unique solution of the nonlinear system ∑n=1Npn0exp(Λn∗)Δn(θ,y)=0,∀(θ,y) such that λθ,y∗>0, _n=1^Np_n^0 \! ( _n^* )\, _n(θ,y)=0, ∀(θ,y) such that _θ,y^*>0, (4.13) and equivalently satisfies the normalized moment condition ∑n=1Npn∗Δn(θ,y)=0for all binding constraints. _n=1^Np_n^* _n(θ,y)=0 all binding constraints. (4.14) (iv) The multipliers λθ,y∗ _θ,y^* satisfy the complementary slackness conditions λθ,y∗(∑n=1Npn∗Δn(θ,y))=0,∀θ∈Θ,y∈. _θ,y^* ( _n=1^Np_n^* _n(θ,y) )=0, ∀θ∈ ,\;y . (v) The induced distribution F∗=∑n=1Npn∗δαnF^*= _n=1^Np_n^* _ _n satisfies the benign pooling condition (4.9). Consequently, there exists a Perfect Bayesian Nash Equilibrium (μ∗,δα∗α∈,ρ∗)(μ^*,\ _α^*\_α ,ρ^*) such that μ∗(θ)=y0,∀θ∈Θ.μ^*(θ)=y_0, ∀θ∈ . Proof. Since pn0>0p_n^0>0 for all n, the Kullback–Leibler divergence D(p∥p0)D(p\|p^0) is strictly convex on ΔN ^N. The feasible set is a nonempty, closed, and convex subset of the compact simplex ΔN ^N, hence a unique optimizer p∗p^* exists. Introduce Lagrange multipliers λθ,y≥0 _θ,y≥ 0 for each constraint ∑npnΔn(θ,y)≥0 _np_n _n(θ,y)≥ 0 and ν for the normalization constraint. The Lagrangian is ℒ(p,λ,ν)=∑n=1Npnlogpnpn0−∑θ,yλθ,y(∑n=1NpnΔn(θ,y))+ν(∑n=1Npn−1).L(p,λ,ν)= _n=1^Np_n p_np_n^0- _θ,y _θ,y ( _n=1^Np_n _n(θ,y) )+ν ( _n=1^Np_n-1 ). The first-order optimality condition yields logpn∗pn0+1=∑θ,yλθ,y∗Δn(θ,y)+ν∗,∀n. p_n^*p_n^0+1= _θ,y _θ,y^* _n(θ,y)+ν^*, ∀ n. Exponentiating and normalizing over n gives the exponential tilting form (4.12), where the normalization constant is Z(λ∗)=∑m=1Npm0exp(Λm∗),ν∗=1−logZ(λ∗).Z(λ^*)= _m=1^Np_m^0 \! ( _m^* ), ν^*=1- Z(λ^*). Substituting (4.12) into the constraint functions yields ∑n=1Npn∗Δn(θ,y)=∑n=1Npn0exp(Λn∗)Δn(θ,y)Z(λ∗). _n=1^Np_n^* _n(θ,y)= _n=1^Np_n^0 \! ( _n^* ) _n(θ,y)Z(λ^*). Hence, for each binding constraint, the numerator must vanish, which gives the system (4.13). Dividing by Z(λ∗)Z(λ^*) yields the equivalent normalized moment condition (4.14). This establishes the semi-closed form characterization of λ∗λ^*. Complementary slackness follows from the KKT conditions. The equilibrium implication follows from the feasibility of p∗p^* and the satisfaction of the benign pooling constraints. ∎ Under the optimal solution (4.12), the population is reweighted as pn∗∝pn0exp(Λn∗)p_n^* p_n^0 ( _n^*), where Λn∗=∑θ,yλθ,y∗Δn(θ,y) _n^*= _θ,y _θ,y^* _n(θ,y). Thus, receiver types that more strongly discourage deviations (i.e., with larger Δn(θ,y) _n(θ,y)) are amplified, while those that enable deviations are down-weighted, shifting the effective population toward more robust receivers. The quantity Δn(θ,y) _n(θ,y) can be improved through defensive mechanisms. Training increases user awareness, reducing acceptance of malicious messages and raising Δn(θ,y) _n(θ,y). Interface design, such as warnings or decision aids, lowers the acceptance probability Pαn(θ,y)P_ _n(θ,y) and thereby increases Δn(θ,y) _n(θ,y). Segmentation or filtering reduces the influence of receiver types with Δn(θ,y)<0 _n(θ,y)<0 by limiting their exposure. 5 Extensions 5.1 Two-sided scoring model We assume that, from the receiver’s perspective, the null hypothesis H0H_0 and the associated scoring rule are fixed across messages. In the baseline model, the receiver evaluates a message using a keyword-based scoring function that identifies suspicious content. In practice, receivers may maintain both (i) a list of suspicious keywords that trigger alerts and (i) a list of indicative keywords that signal legitimacy. In the current formulation, we focus only on the former: keywords that raise suspicion. The receiver generates an alert when the message contains a token from a predefined suspicious keyword set. Thus detection is driven by alert-triggering terms. An alternative behavioral model is that some receivers may also interpret the absence of expected legitimate keywords as evidence of deception. In such cases, both the presence of suspicious terms and the absence of credibility-inducing terms contribute to the detection decision. 5.2 Systematic Blindness and Information Loss We formalize the notion of systematic blindness as a structural limitation in the receiver’s perceptual representation, and characterize its implications for information loss and learning dynamics. Informative features. Let θ∈legit,malθ∈\legit,mal\ denote the sender type and define the set of informative features ℐ=w∈V:P(w∣θ=mal)>P(w∣θ=legit).I= \w∈ V:P(w θ=mal)>P(w θ=legit) \. These are the features that carry statistical evidence of malicious intent. Definition 5.1 (Systematic Blindness). A receiver α is said to exhibit systematic blindness if ℐ∖Kα≠∅.I K_α≠ . Equivalently, there exists a nonempty set of informative features ΔKα:=ℐ∖Kα K_α:=I K_α that are never observed by the receiver and therefore do not contribute to the score Sα(m)S_α(m). Systematic blindness is a structural property: the receiver does not misinterpret certain features; rather, these features are entirely absent from the receiver’s representation. Let V denote the token space and Kα⊆VK_α V the receiver’s accessible feature set. This induces a projection operator at the token level, πα:V→Kα∪∅, _α:V→ K_α∪\ \, which filters out features not contained in KαK_α. This projection extends componentwise to messages of length L, yielding Πα:VL→KαL,Πα(m)=(πα(w1),…,πα(wL)). _α:V^L→ K_α^L,\ _α(m)=( _α(w_1),…, _α(w_L)). The receiver therefore evaluates the score Sα(m)S_α(m) based on the projected message Πα(m) _α(m) rather than the original message m. Systematic blindness thus induces a loss of statistical information about the sender type, as components of the message that may be informative for discrimination are removed prior to evaluation. Definition 5.2 (Effective Information Set). The effective information available to receiver α is ℐα:=ℐ∩Kα.I_α:=I∩ K_α. Proposition 5.3 (Information Loss under Blindness). If α is systematically blind, then ℐα⊊ℐ,I_α , and the resulting score distribution satisfies s¯α(y)=∑k=1LP(Wk∈Kα∣y)<∑k=1LP(Wk∈ℐ∣y). s_α(y)= _k=1^LP(W_k∈ K_α y)< _k=1^LP(W_k y). Proof. Since ℐα=ℐ∩KαI_α=I∩ K_α and ℐ∖Kα≠∅I K_α≠ , we have ℐα⊊ℐI_α . The score aggregates only features in KαK_α, hence excludes contributions from ℐ∖KαI K_α, which are informative but unobserved. ∎ Information loss manifests as a degradation in statistical discriminability. In particular, the mean separation between malicious and legitimate signals decreases, μα,mal−μα,legit↓, _α,mal- _α,legit , which directly weakens the distinguishability of the two distributions. At the same time, the signal-to-noise ratio in the Gaussian approximation Sα≈(μα,σα2)S_α ( _α, _α^2) is reduced, as informative components of the signal are systematically excluded. As a consequence, the overlap between the score distributions increases, leading to a higher acceptance probability for malicious messages under the receiver’s decision rule. Remark 5.4 (Vocabulary-Induced Blindness). Systematic blindness can be interpreted as an epistemic limitation induced by the receiver’s vocabulary. A receiver of type α processes only tokens in its accessible feature set Kα⊂VK_α⊂ V. Consequently, the effective information set is ℐα=ℐ∩KαI_α=I∩ K_α, and any informative feature in ℐ∖KαI K_α is not merely misinterpreted but entirely unrepresented in the receiver’s perceptual model. This phenomenon reflects a structural constraint on knowledge: the receiver’s ability to infer the sender’s type is bounded by the expressive capacity of its feature space. In this sense, the vocabulary KαK_α defines the observable world of the receiver. Signals outside this space are epistemically inaccessible, regardless of their statistical informativeness. This corresponds to a form of representational incompleteness in statistical decision-making, where sufficient statistics are restricted by the class of models [cover1999elements]. This perspective is closely aligned with Wittgenstein’s insight that “the limits of my language mean the limits of my world” [wittgenstein1922tractatus]. Here, language, formalized as the set of features KαK_α, acts as a projection operator that determines which aspects of the message are observable and meaningful. In this sense, the receiver operates under a constrained σ-algebra of observables, inducing an endogenous information structure. Systematic blindness arises when the true informative structure of the environment exceeds this representational boundary. This phenomenon is closely related to bounded rationality [simon1957models], where decision-makers operate under limited cognitive and informational resources, and to model misspecification in statistical inference [white1982maximum], where the true data-generating process lies outside the assumed model class. Expanding KαK_α through learning, training, or representation enrichment enlarges the effective observable space, thus refining the induced information structure and reducing epistemic blindness. In this sense, learning can be interpreted as an expansion of the receiver’s measurable feature space, analogous to refining partitions in information theory or increasing the expressiveness of hypothesis classes in statistical learning. 5.3 Mindset Dynamics We model the evolution of the receiver’s mindset as a feature expansion process. At time t, the receiver α is characterized by a set of characteristics Kα(t)⊆VK_α(t) V, which determines the components of the message that are perceptible and contribute to the score Sα(m;t)=∑k=1Lwk∈Kα(t).S_α(m;t)= _k=1^L1\w_k∈ K_α(t)\. Definition 5.5 (Mindset Dynamics). The feature set evolves according to Kα(t+1)=Kα(t)∪ℒα(t),K_α(t+1)=K_α(t) _α(t), where ℒα(t)⊆VL_α(t) V denotes newly acquired features. The update set ℒα(t)L_α(t) captures the accumulation of experience and information, arising from exposure, feedback, or external signals. The update is cumulative, implying Kα(t)⊆Kα(t+1),K_α(t) K_α(t+1), so that the feature set grows monotonically over time. Consequently, the effective information set ℐα(t)=ℐ∩Kα(t)I_α(t)=I∩ K_α(t) also expands, increasing the portion of informative features that the receiver can exploit. Under the Gaussian approximation Sα(m;t)≈(μα(t),σα2(t)),S_α(m;t) ( _α(t), _α^2(t)), this expansion increases the mean separation between legitimate and malicious messages, thereby improving detection performance. In particular, if ℒα(t)∩ℐ≠∅L_α(t) ≠ infinitely often, then the blind region shrinks over time, and vanishes asymptotically if limt→∞Kα(t)⊇ℐ. _t→∞K_α(t) . This improvement is countered by strategic adaptation. Since the sender controls the distribution P(⋅∣y)P(· y), it can shift probability mass toward features outside the current Kα(t)K_α(t), preserving evasion. The resulting interaction forms a co-evolutionary dynamic Kα(t)↑⟺P(⋅∣yt) shifts outward,K_α(t) P(· y_t) shifts outward, in which learning expands the perceptual boundary while the sender continuously relocates signals beyond it. 6 Case Study and Numerical Experiments We now present a reproducible numerical case study that illustrates the main analytical results. The experiment is a controlled synthetic LLM-channel model: each semantic control induces a distribution over token-feature categories, and receiver awareness determines which features are scored. This construction is not intended to benchmark a particular deployed LLM. Its purpose is to isolate the mechanisms in Sections 3–4: Gaussian score approximation, threshold-based detection, awareness-dependent acceptance, mindset dynamics, and incentive design for benign pooling. The numerical data and figures are generated by run_case_study_experiments.py. 6.1 Experimental Setup The sender chooses one of three semantic controls, Y=y0,y1,y2=benign,aggressive,stealth.Y=\y_0,y_1,y_2\=\benign,aggressive,stealth\. The benign control represents routine administrative communication, the aggressive control represents an explicit phishing attempt with strong urgency and credential cues, and the stealth control represents a more subtle phishing message that reduces explicit alert terms while retaining enough action-oriented language to remain persuasive. Each generated message has length L=96L=96. At each token position, the controlled channel draws one of eight bounded feature categories: neutral text, legitimate-context cues, urgency, action requests, credential requests, links or attachments, authority impersonation, and contextual mismatch. These categories are a low-dimensional proxy for the token-level features in (3.3). The three controls differ only through their feature probabilities, so the experiment directly implements the controlled stochastic kernels in (3.2). The vocabulary used to instantiate these categories is seeded by a public phishing keyword list in the Hunting-Lists repository [cyb3rmik3_phishing_keywords_2023]. We group that list into semantic cue families, including urgency, account status, password and verification language, document-sharing language, invoice or payment references, message notifications, and service-request language. The list is used only to make the synthetic channel interpretable; it is not treated as an empirical distribution over real phishing emails. Figure 1 reports the feature probabilities used by the three controls. The benign control places most mass on neutral and legitimate-context tokens. The aggressive control places substantially more mass on urgency, action requests, credential requests, and links. The stealth control is intermediate: it suppresses the most explicit indicators relative to the aggressive control, but keeps enough action-oriented, authority-framed, and context-mismatch features to remain strategically useful. Figure 1: Feature-category probabilities induced by the three semantic controls. The stealth control reduces explicit phishing cues while retaining weaker authority, action, and mismatch cues. To make the controls concrete, the following quote blocks show representative messages generated by instantiating the feature categories with short phrase templates. These examples are not intended to benchmark a deployed LLM; they illustrate how the abstract semantic controls translate into messages with different observable cues. Benign. “The operations team has posted the monthly reimbursement reminder and service request summary in the employee portal. Please review the notice when convenient and submit any corrections through the standard service desk form. No immediate action is required if your record is already accurate; this note is only intended to keep the directory and reimbursement workflow current.” Salient cues: routine administrative context; low urgency; standard internal workflow; no credential request; no account-loss threat. Aggressive. “Action required: your payroll account is scheduled for suspension today because the verification record is incomplete. Open the secure payroll validation page and confirm your password and MFA code before the close of business to prevent loss of access to direct deposit and benefits. Failure to complete this step may delay your next payment.” Salient cues: high urgency; explicit credential request; link-based action; threat of account suspension and payment disruption. Stealth. “Hi, I am reconciling the team directory before tomorrow’s audit and noticed that a few contact records still need confirmation. When you have a moment, please review the internal request form and confirm whether the listed phone number, department, and backup contact are current. This will help the support team close the ticket before the audit packet is finalized.” Salient cues: mild urgency; audit-related authority framing; indirect action request; plausible business context; subtle mismatch in process. Receivers have awareness types =αnaive,αmid,αaware.A=\ _naive, _mid, _aware\. The scoring maps are nested. Naive receivers score only explicit cues such as urgency, credential requests, and links. Intermediate receivers also score action requests, authority framing, and weak contextual signals. Aware receivers score the full feature set, including subtle contextual mismatch. Thus higher awareness enriches the feature map Ψα _α, as in Proposition 4.11. For each semantic control and awareness type, we generate 1000010000 messages and compute the cumulative score Sα,L=∑k=1Lψα(Wk).S_α,L= _k=1^L _α(W_k). The receiver uses the Gaussian threshold rule in Proposition 3.6. For each α, the threshold is calibrated as ηα=12(μ^α,ben+μ^α,mal), _α= 12 ( μ_α,ben+ μ_α,mal ), where μ^α,ben μ_α,ben is the empirical mean under y0y_0, and μ^α,mal μ_α,mal is the average empirical mean under y1y_1 and y2y_2. A message is accepted when Sα,L≤ηαS_α,L≤ _α and blocked otherwise. 6.2 Gaussian Score Approximation The first experiment tests Proposition 3.5. We focus on the stealth control under the aware receiver because this is the hardest detection case: explicit phishing cues are muted, while subtle features remain visible only to high-awareness receivers. Across 1000010000 simulated messages, the score has empirical mean 34.4134.41 and variance 26.0226.02. After standardization, the skewness is 0.100.10, the excess kurtosis is −0.04-0.04, and the Kolmogorov distance from the standard normal CDF is 0.0160.016. Figure 2: Gaussian approximation for the normalized cumulative score under the stealth semantic control and aware receiver. The close match between the empirical histogram and the standard normal density supports the CLT approximation in Proposition 3.5. Figure 2 shows that the standardized score is close to Gaussian. This supports the use of the normal approximation in (3.12) and justifies the closed-form acceptance probability in (3.23). 6.3 Threshold Detection and Awareness Ordering Table 1 reports the empirical score means, standard deviations, thresholds, and acceptance probabilities for each semantic control and awareness type. The benign control is accepted with probability one in the simulation, while the aggressive phishing control is rejected for all awareness levels. The stealth control is the strategically interesting case: it is accepted by naive receivers with probability 0.5410.541, by intermediate receivers with probability 0.2970.297, and by aware receivers with probability 0.1570.157. Table 1: Estimated score statistics and empirical acceptance probabilities. Control Awareness Mean SD ηα _α Accept Benign Naive 3.33 1.52 18.64 1.000 Benign Intermediate 5.97 2.16 24.74 1.000 Benign Aware 7.85 2.76 29.25 1.000 Aggressive Naive 49.54 4.87 18.64 0.000 Aggressive Intermediate 59.91 5.03 24.74 0.000 Aggressive Aware 66.91 5.47 29.25 0.000 Stealth Naive 18.36 3.60 18.64 0.541 Stealth Intermediate 27.10 4.24 24.74 0.297 Stealth Aware 34.41 5.10 29.25 0.157 The Gaussian approximation also predicts acceptance probabilities accurately in this experiment. Across all control-awareness pairs, the maximum absolute gap between empirical acceptance and the Gaussian prediction is 0.0100.010, and the mean absolute gap is 0.0020.002. Figure 3: Empirical acceptance probabilities versus Gaussian approximations for all semantic-control and awareness-type pairs. Points near the diagonal indicate that the closed-form approximation in (3.23) tracks the Monte Carlo estimates. Figure 4: Empirical acceptance probability across semantic controls and awareness types. Stealth phishing selectively evades lower-awareness receivers, while increased awareness reduces acceptance, illustrating the behavioral ordering in Proposition 4.10. Figure 4 visualizes the same effect. The result illustrates how semantic control changes the score distribution and how awareness reshapes the receiver’s decision rule. Aggressive phishing is easy to detect because it shifts the score far above the threshold. Stealth phishing instead moves the score close to the naive threshold while remaining more visible to richer feature maps. Thus the experiment supports the acceptance-ordering part of Proposition 4.10: higher awareness decreases the acceptance probability of malicious semantic controls. 6.4 Mindset Dynamics and Adaptive Evasion We next instantiate the mindset dynamics model in Section 5.3. The receiver begins with an explicit cue vocabulary consisting of urgency, credential requests, and links. Across successive learning stages, the receiver adds action requests, authority framing, and contextual mismatch to its feature set Kα(t)K_α(t). Thus the effective informative-feature coverage |Kα(t)∩ℐ|/|ℐ||K_α(t) |/|I| grows monotonically, as in the update rule for ℒα(t)L_α(t). We compare two sender responses. In the fixed-stealth condition, the sender keeps the stealth semantic control unchanged while the receiver learns. In the adaptive-stealth condition, the sender reallocates probability mass away from newly learned cues and toward cues that are still outside the current feature set. This creates the co-evolutionary pattern described in Section 5.3: receiver learning expands the perceptual boundary, while the sender attempts to move persuasive evidence beyond it. Figure 5: Mindset dynamics under feature learning and sender adaptation. Fixed stealth becomes easier to detect as Kα(t)K_α(t) expands. Adaptive stealth preserves evasion while informative cues remain outside the receiver’s feature set, but loses this advantage as coverage becomes complete. Figure 5 shows that learning alone reduces the acceptance probability of the fixed stealth control from 0.5720.572 at the initial feature set to 0.1530.153 when all modeled informative categories are represented. Adaptive stealth delays this improvement: its acceptance probability reaches 0.9600.960 while blind regions remain, but falls to 0.2090.209 once the receiver’s feature coverage is complete. This experiment supports the interpretation of mindset dynamics as a moving-boundary problem rather than a static threshold adjustment. 6.5 Mechanism Design and Benign Pooling The final experiment illustrates the benign-pooling incentive condition from Section 4. We compute the malicious sender’s payoff from each semantic control using the Gaussian acceptance model in (3.28). Let q∈[0,1]q∈[0,1] denote the share of aware receivers in the population. The remaining mass 1−q1-q is split between naive and intermediate receivers in the same proportion as the baseline population. For each q, define the deviation gain Δ(q,τ)=maxy∈y1,y2US(θmal,y;τ)−US(θmal,y0;0), (q,τ)= _y∈\y_1,y_2\U_S(θ^mal,y;τ)-U_S(θ^mal,y_0;0), where τ is an added cost applied to nonbenign controls. A negative value of Δ(q,τ) (q,τ) means that the malicious type has no profitable deviation from the benign control, so the row-wise incentive condition for benign pooling is satisfied for that type. Figure 6: Deviation gain for the malicious sender as the aware share of the receiver population increases. The zero line marks the boundary of the benign-pooling incentive condition. Awareness shaping and guardrail costs both reduce profitable deviations. Figure 6 shows that awareness shaping alone can eliminate profitable malicious deviations once the aware share reaches approximately 0.480.48. With an added guardrail cost of τ=0.10τ=0.10, the critical aware share falls to approximately 0.180.18. At the baseline population, the deviation gain is 0.160.16 without the guardrail and 0.060.06 with the guardrail. These results illustrate the design levers in Section 4: detection enrichment lowers malicious acceptance probabilities, cost shaping penalizes deceptive controls, and population shaping changes the effective receiver distribution in the sender’s payoff. 6.6 Discussion The numerical experiments support the paper’s theoretical claims in a single controlled setting. First, cumulative message scores behave approximately normally, making the Gaussian detection formulas operational. Second, semantic controls change acceptance probabilities by shifting the induced score distribution. Third, receiver awareness is not merely a lower threshold; it is a richer feature representation that makes stealthy manipulation more visible. Fourth, mindset dynamics show how learning reduces fixed stealth evasion while adaptive senders can temporarily exploit blind regions. Finally, the mechanism-design experiment shows how awareness shaping and adversarial friction can convert a profitable deceptive deviation into a benign-pooling outcome. 7 Conclusion This paper developed a semantic signaling game for LLM-mediated strategic communication. The model treats prompts and other high-level instructions as semantic controls, the LLM as a stochastic language channel, and receiver awareness as a type-dependent scoring system. This structure connects token-level message generation with statistical decision rules and equilibrium behavior. The analysis shows how aggregate linguistic scores admit Gaussian approximations, how receivers use likelihood-ratio thresholds, and how sender incentives depend on the induced score distributions across heterogeneous awareness types. The equilibrium results characterize when type-consistent semantic controls are incentive compatible, while the mechanism-design analysis identifies conditions for benign pooling and population shaping. The numerical study complements the theory by showing that the Gaussian approximation tracks simulated score distributions, that greater awareness reduces acceptance of stealth attacks, that adaptive senders can exploit temporary blind regions during mindset evolution, and that population and penalty interventions can restore benign pooling. The framework also clarifies the role of systematic blindness. A receiver may fail not because evidence is absent from the message, but because informative features are absent from the receiver’s effective representation. Awareness shaping and mindset dynamics can therefore be viewed as mechanisms for expanding the receiver’s measurable feature space. Future work can extend the model to richer multi-turn interactions, adaptive prompting, empirical estimation of score distributions from real LLM outputs, and mechanism design for teams of human and artificial receivers. References