Paper deep dive
A Variational Framework for LLM Generator-Regulator Games
Quanyan Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%
Last extracted: 6/21/2026, 2:26:46 AM
Summary
The paper proposes a variational framework for regulated language generation, treating the interaction between a Large Language Model (LLM) generator and a regulator as a saddle-point problem. It moves from token-level autoregressive sampling to a message-level Gibbs distribution, where the generator maximizes utility and entropy. The regulator is modeled as an optimal discriminator that induces an f-divergence penalty between the generated distribution and a regulated reference law. This framework provides a theoretical basis for understanding trade-offs in moderation, censorship, and deception detection, demonstrated through case studies in censorship filtering and phishing defense.
Entities (8)
Relation Signals (4)
Generator → interactswith → Regulator
confidence 100% · the generator-regulator interaction is formulated as a saddle-point problem.
Censorship Filtering → isacasestudyof → Variational Framework
confidence 100% · Two finite-vocabulary case studies, censorship filtering and phishing defense, illustrate how the theory can be evaluated
Generator → follows → Gibbs Distribution
confidence 95% · the induced distribution over complete messages and relate it to an entropy-regularized Gibbs law.
Regulator → imposes → f-divergence
confidence 90% · the regulator induces an f-divergence penalty between the generator distribution and the regulated reference law.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:This paper develops a variational framework for regulated language generation. Starting from autoregressive token sampling, we derive the induced distribution over complete messages and relate it to an entropy-regularized Gibbs law. Regulation is modeled as an optimal discriminator whose convex-dual value is an f-divergence, and the generator-regulator interaction is formulated as a saddle-point problem. The framework applies to moderation, censorship, AI deception detection, compliance auditing, phishing defense, and manipulation control, where regulation concerns a distribution over possible messages rather than a single output. The equilibrium clarifies the tradeoff among utility, entropy, regulatory alignment, and finite-length detectability. Two finite-vocabulary case studies, censorship filtering and phishing defense, illustrate how the theory can be evaluated through utility, entropy, divergence, receiver-side scores, and detection probability.
Tags
Links
- Source: https://arxiv.org/abs/2606.18424v1
- Canonical: https://arxiv.org/abs/2606.18424v1
Trouble viewing inline? Open PDF directly →
Full Text
104,337 characters extracted from source content.
Expand or collapse full text
A Variational Framework for LLM Generator–Regulator Games Quanyan Zhu Department of Electrical and Computer Engineering, Tandon School of Engineering, New York University, Brooklyn, NY, USA. Contact: quanyan.zhu@nyu.edu. Abstract This paper develops a variational framework for regulated language generation. Starting from autoregressive token sampling, we derive the induced distribution over complete messages and relate it to an entropy-regularized Gibbs law. Regulation is modeled as an optimal discriminator whose convex-dual value is an f-divergence, and the generator–regulator interaction is formulated as a saddle-point problem. The framework applies to moderation, censorship, AI deception detection, compliance auditing, phishing defense, and manipulation control, where regulation concerns a distribution over possible messages rather than a single output. The equilibrium clarifies the tradeoff among utility, entropy, regulatory alignment, and finite-length detectability. Two finite-vocabulary case studies, censorship filtering and phishing defense, illustrate how the theory can be evaluated through utility, entropy, divergence, receiver-side scores, and detection probability. Keywords large language models ⋅· generator–regulator games ⋅· variational regulation ⋅· censorship filtering ⋅· phishing defense ⋅· central limit theorem 1 Introduction Large language models generate text, code, and structured reasoning one token at a time, yet their outputs are usually judged as complete messages. Semantic quality, safety, factuality, and compliance are properties of the realized sequence, not only of the next-token distribution. This gap motivates a message-level theory: starting from temperature-scaled autoregressive sampling, we study the induced law on complete messages and place it in a variational and game-theoretic framework. The construction draws on transformer language modeling [18, 1], information theory, entropy maximization, convex duality, and minimax equilibrium [15, 2, 14, 16]. The central modeling problem is that useful generation and regulated generation need not coincide. A generator should place mass on relevant, coherent, and useful messages, but it may also need to avoid output distributions that are unsafe, noncompliant, deceptive, censored, phishing-like, or otherwise undesirable. We use “regulation” broadly: the regulator may be a safety moderator, censorship mechanism, deception detector, phishing filter, compliance auditor, institutional policy, or adversarial monitor. This framing is closely related to game-theoretic models of cyber deception, defensive deception, adversarial evidence, and cyber resilience [11, 12, 23, 25, 26]. In each case, regulation is a constraint on a message distribution rather than only a post-processing rule for one sample. This is crucial when policy-relevant behavior can be expressed through many token sequences or depends on semantic features such as deception, evasion, persuasion, credential-seeking intent, or forbidden topics. The model captures this tension by letting the generator choose a message law and the regulator choose a score that detects deviations from a regulated reference law. The analysis proceeds from token sampling to message laws, from entropy-regularized utility maximization to a Gibbs generator, and from variational discrimination to divergence-regularized equilibrium. This sequence makes explicit how utility, diversity, and regulatory pressure jointly determine the generated distribution. A useful way to read the paper is to keep the following dictionary in mind: Q is the law actually induced by the generator, ULU_L measures the value of a complete length-L message, H(Q)H(Q) rewards diversity, QregQ_reg is the reference law regarded as acceptable by the regulator, ϕφ is a learned or designed score, and λ determines how strongly the generator must respect the regulator. Figure 1 summarizes the model. A prompt and context induce token-level sampling probabilities and hence a message law Q. The generator values utility and entropy; the regulator compares Q with a reference law QregQ_reg by optimizing a discriminator ϕφ. The induced penalty ℛ(Q)R(Q) feeds back into the generator objective, and the saddle point determines the regulated equilibrium law. Prompt and context (p,I)(p,I) Autoregressive sampler πT(wk∣hk) _T(w_k h_k) Message law Q∈Δ(L)Q∈ (X_L) Complete messages m=(w1,…,wL)m=(w_1,…,w_L) Generator objective 1TQ[UL]+H(Q) 1TE_Q[U_L]+H(Q) Regulator discriminator ϕ:L→ℝφ:X_L Regulated reference QregQ_reg Divergence penalty ℛ(Q)=Df(Q∥Qreg)R(Q)=D_f(Q\|Q_reg) Saddle-point equilibrium (Q∗,ϕ∗)(Q^*,φ^*) hkh_ksamples/law−λℛ(Q)- (Q) Figure 1: Schematic of the variational generator–regulator model. Autoregressive token sampling induces a message distribution Q on the fixed-length message space LX_L. The generator rewards utility and entropy, while the regulator compares Q with a reference distribution encoding safety, censorship, nondeception, phishing defense, compliance, or another regulated behavior. The optimized discriminator induces a divergence penalty, closing the feedback loop and determining the saddle-point equilibrium. 1.1 Contributions and Novelty The paper makes six contributions: a message-level probabilistic formulation of autoregressive generation; a Gibbs representation derived from entropy-regularized utility maximization; a variational discriminator model of regulation with an f-divergence dual; a saddle-point characterization with a closed-form KL-regulated equilibrium; finite-length Gaussian approximations for score, log-density, and surprisal statistics; and two finite-vocabulary case studies, censorship filtering and phishing defense, that evaluate utility, entropy, regulatory divergence, receiver-side scoring, and detection probability. The novelty is the integration of generation, moderation, censorship, deception detection, phishing defense, and compliance into one distributional variational structure. The generator is a message-level Gibbs law, the regulator is an optimal discriminator whose value is an f-divergence, and their interaction is a saddle-point problem. This yields an explicit KL-regulated equilibrium and connects finite-length detectability to central limit approximations for score, log-density, and surprisal. 2 Generator Model and Variational Characterization This section connects the operational mechanism of autoregressive language models with a global variational formulation of generation. The central observation is that token-level sampling induces a probability distribution over complete messages, and this induced distribution admits an energy–entropy interpretation. 2.1 Autoregressive Generation in Practice Modern large language models generate text through a sequential stochastic process known as autoregressive generation: a message is constructed token by token, with each new token conditioned on the previously generated prefix and the external context. Let V denote a finite vocabulary, where each element w∈w is a token representing a word, subword unit, or symbol depending on the tokenization scheme. Let p denote the prompt, and let I denote auxiliary contextual information such as system-level instructions, retrieved documents, memory states, or external signals. Together, (p,I)(p,I) define the conditioning information under which generation takes place. At generation step k, the model conditions on the history hk=(w1,…,wk−1,p,I)h_k=(w_1,…,w_k-1,p,I), which aggregates all information available before the k-th token is generated. This history plays the role of a state variable in a sequential stochastic process, and the autoregressive assumption implies that the next-token distribution depends on hkh_k rather than on future tokens. Given the history hkh_k, the model computes real-valued logits ℓ(w∣hk) (w h_k) for w∈w . These logits are unnormalized preferences over the vocabulary; they arise from the internal neural network computation and encode the model’s assessment of each token as the next continuation. Since logits live in ℝR rather than in the probability simplex, the model converts them into probabilities using the temperature-scaled softmax transformation πT(w∣hk)=exp(ℓ(w∣hk)/T)∑v∈exp(ℓ(v∣hk)/T). _T(w h_k)= ( (w h_k)/T ) _v ( (v h_k)/T ). (2.1) This mapping produces a valid probability distribution over V, with ∑wπT(w∣hk)=1 _w _T(w h_k)=1, and it is invariant to additive shifts of the logits, so only relative differences matter. The temperature parameter T controls the sharpness of the distribution: smaller values amplify logit differences and yield more deterministic behavior, while larger values flatten the distribution and increase randomness. Once the conditional distribution πT(⋅∣hk) _T(· h_k) is defined, the model samples the next token wkw_k according to this distribution and repeats the procedure until a full message m=(w1,…,wL)m=(w_1,…,w_L) is produced. The probability of generating a specific message is therefore the product of conditional probabilities, PT(m∣p,I)=∏k=1LπT(wk∣hk).P_T(m p,I)= _k=1^L _T(w_k h_k). (2.2) This expression follows directly from the chain rule of probability and gives the operational definition of generation used in practice. The sequence wkk=1L\w_k\_k=1^L can be viewed as a stochastic process adapted to the filtration generated by the histories hk\h_k\: each step introduces randomness through sampling, while dependence on the history enforces coherence and context-awareness. 2.2 Message Space and Induced Distribution To move from token-level generation to a global perspective, we introduce the message space. For a fixed length L, define L:=LX_L:=V^L, and let the variable-length message space be =⋃L≥1LX= _L≥ 1X_L. This construction allows sequences of arbitrary finite length; each element m∈m can be written as m=(w1,…,wL)m=(w_1,…,w_L) for some L≥1L≥ 1, where each wk∈w_k . In all finite-length results below, however, the relevant space is the finite set LX_L. The autoregressive generation mechanism in (2.2) assigns a probability to every sequence m∈Lm _L. For fixed L, this expression induces a probability measure PT(⋅∣p,I)∈Δ(L)P_T(· p,I)∈ (X_L), where Δ(L) (X_L) denotes the probability simplex over LX_L. The local normalization ∑w∈πT(w∣hk)=1 _w _T(w h_k)=1 ensures that the global distribution over sequences is properly normalized. Under an appropriate stopping rule, such as an end-of-sequence token, the chain rule gives ∑m∈PT(m∣p,I)=1 _m P_T(m p,I)=1, so local normalization at every token position is enough to define a global probability law. This message-level law is the central object of the paper. A next-token distribution tells us what may happen at one step, but questions about safety, censorship, phishing risk, deception, or factuality are usually questions about a complete message. By passing from πT(wk∣hk) _T(w_k h_k) to Q on LX_L, we can ask how much probability mass the model assigns to whole classes of messages, not only whether a single sampled output is acceptable. 2.3 From Sequential Normalization to Global Gibbs Form The path-dependent normalization in the autoregressive product complicates sequence-level analysis, because the normalizing factor at position k depends on the realized prefix. To expose the energy–entropy structure of generation, we consider a message-level Gibbs approximation that replaces the sequence of local normalization terms with a single global partition function. Specifically, for fixed L we write QT(m)≈exp(1TUL(m))ZL(T),Q_T(m)≈ ( 1TU_L(m) )Z_L(T), (2.3) where the global partition function is defined as ZL(T)=∑m∈Lexp(UL(m)/T)Z_L(T)= _m ^L (U_L(m)/T ). Under this approximation, the distribution over sequences takes the form of a Gibbs distribution: the trajectory-dependent normalization is replaced by a single scalar quantity that aggregates contributions from all sequences of length L. This approximation is most useful in regimes where aggregate behavior dominates, such as long-sequence limits or studies of typical generated messages, because fluctuations from individual normalization terms can often be absorbed into a global normalization. The quantity UL(m)U_L(m) is a sequence-level utility that scores semantic quality, relevance, coherence, or task value; the Gibbs form assigns exponentially larger probability mass to higher-utility messages, while ZL(T)Z_L(T) normalizes this preference across all messages. Low temperature concentrates mass on high-utility messages, whereas high temperature gives relatively greater weight to entropy and diversity. This is the same mathematical structure that underlies maximum-entropy models and log-partition variational principles [2, 14, 5]. 2.4 Variational Interpretation We next identify the variational objective behind (2.3): expected utility rewards useful messages, while entropy prevents collapse onto a small set of high-scoring sequences. Definition 2.1 (Entropy). Let Q∈Δ()Q∈ (X) be a probability distribution over the message space X. The Shannon entropy of Q is H(Q):=−∑m∈Q(m)logQ(m)H(Q):=- _m Q(m) Q(m). Definition 2.2 (Variational Objective). For a fixed temperature T>0T>0, define the functional L:Δ()→ℝJ_L: (X) by L(Q)=1TQ[UL(m)]+H(Q).J_L(Q)= 1TE_Q[U_L(m)]+H(Q). (2.4) Proposition 2.3 (Variational Characterization of the Gibbs Distribution). The optimization problem supQ∈Δ()L(Q) _Q∈ (X)J_L(Q) admits a unique solution given by the Gibbs distribution Q∗(m)=exp(1TUL(m))ZL(T),Q^*(m)= ( 1TU_L(m) )Z_L(T), (2.5) where the partition function is ZL(T)=∑m∈Lexp(UL(m)/T)Z_L(T)= _m ^L (U_L(m)/T). Proof. The result follows from standard convex duality arguments. Introducing a Lagrange multiplier c for the normalization constraint ∑mQ(m)=1 _mQ(m)=1, the first-order optimality condition yields logQ∗(m)=UL(m)/T−c Q^*(m)=U_L(m)/T-c, which implies the stated form after normalization. ∎ The functional (Q)J(Q) balances expected utility and entropy; T controls concentration on high-utility sequences versus dispersion across the message space. For students, the proposition can be read as a maximum-entropy principle: among all laws over messages, the Gibbs law is the unique law that gives high probability to useful messages while remaining as spread out as possible subject to that preference. The partition function ZL(T)Z_L(T) is not merely a normalizing constant; its logarithm is the optimal value of the entropy-regularized generation problem. Definition 2.4 (Normalized Utility). Let m=(w1,…,wL)∈m=(w_1,…,w_L) be a message of length L. The normalized utility is defined as U¯L(m):=UL(m)/L U_L(m):=U_L(m)/L. The normalized utility U¯L(m) U_L(m) represents the average contribution per token. This normalization is essential when comparing sequences of different lengths and plays a central role in asymptotic analysis as L→∞L→∞. Proposition 2.5 (Optimal Value of the Variational Problem). Let Q∗Q^* denote the optimizer in Proposition 2.3. Then the optimal value is supQ∈Δ()L(Q)=logZL(T) _Q∈ (X)J_L(Q)= Z_L(T). Consequently, the normalized optimal value per token is 1LlogZL(T) 1L Z_L(T). Proof. For the Gibbs distribution Q∗(m)=exp(UL(m)/T)/ZL(T)Q^*(m)= (U_L(m)/T)/Z_L(T), we have logQ∗(m)=UL(m)/T−logZL(T) Q^*(m)=U_L(m)/T- Z_L(T). Hence L(Q∗)=Q∗[1TUL(m)−logQ∗(m)]=logZL(T).J_L(Q^*)=E_Q^*\! [ 1TU_L(m)- Q^*(m) ]= Z_L(T). Proposition 2.3 shows that Q∗Q^* is the unique maximizer, so this value is the supremum. Dividing by L gives the normalized value. ∎ Definition 2.6 (Generative Free Energy Density). Assuming the limit exists, define the generative free energy density at temperature T>0T>0 as ℱ(T):=limL→∞1LlogZL(T),F(T):= _L→∞ 1L Z_L(T), (2.6) where the partition function is given by ZL(T)=∑m∈Lexp(UL(m)/T)Z_L(T)= _m ^L (U_L(m)/T). The quantity 1LlogZL(T) 1L Z_L(T) is the optimal entropy-regularized utility per token. When the limit exists, ℱ(T)F(T) gives the exponential growth rate ZL(T)≍exp(Lℱ(T))Z_L(T) (LF(T)) of the utility-weighted message count and measures the effective richness of high-utility sequences. Larger values indicate a richer set of useful messages; smaller values indicate scarcity or a sharper utility–diversity tradeoff. 3 Regulator Model We introduce a regulator as a distributional object. It may represent a moderator, censor, safety classifier, deception detector, phishing filter, compliance auditor, or policy-enforcing mechanism, but it constrains the law of generated messages rather than only a realized sample. Thus a generator can respond to regulation by changing the probability of whole message classes, such as forbidden topics, misleading or evasive messages, or credential-seeking risk features. Let X be the message space and Δ() (X) the set of distributions on it. A regulator is a functional ℛ:Δ()→ℝR: (X) , where ℛ(Q)R(Q) measures how far the generator law Q deviates from prescribed regulated behavior. 3.1 General Variational Form We model regulation as optimal discrimination, following variational views of adversarial discriminators and f-divergence estimation [7, 10, 3]. Let Φ be a class of measurable scores ϕ:→ℝφ:X . In applications, ϕφ may score prohibited topics, inconsistency, hidden intent, credential requests, urgency cues, or link-risk features. Let ψ:ℝ→ℝψ:R be proper, convex, and lower semicontinuous, so that it regularizes large or irregular scores. Given a regulated reference distribution Qreg∈Δ()Q_reg∈ (X), define ℛ(Q)=supϕ∈ΦQ[ϕ(m)]−Qreg[ψ(ϕ(m))].R(Q)= _φ∈ \E_Q[φ(m)]-E_Q_reg[ψ(φ(m))] \. (3.1) For fixed Q, the regulator selects the score that best separates samples from Q and samples from QregQ_reg. If the two laws are close, no score achieves much separation and ℛ(Q)R(Q) is small; if they differ, the optimal discriminator has large value. Convex duality turns this testing problem into a divergence penalty, linking operational detection to analytic optimization. 3.1.1 Convex Duality and Divergence Representation Convex duality gives the link between the variational regulator and divergence measures. The best test for separating two probability laws is governed by their likelihood ratio, and convex losses convert that separation problem into a divergence. Thus, with a sufficiently rich score class, the regulator induces an f-divergence penalty between the generator distribution and the regulated reference law [3, 14, 10]. Definition 3.1 (Convex Conjugate). Let ψ:ℝ→ℝ∪+∞ψ:R ∪\+∞\ be a proper, convex, and lower semicontinuous function. The convex conjugate ψ∗:ℝ→(−∞,+∞]ψ^*:R→(-∞,+∞] is defined by ψ∗(u)=supt∈ℝut−ψ(t)ψ^*(u)= _t \ut-ψ(t)\. The convex conjugate ψ∗ψ^* provides the dual representation used below. The main representation result is the following. Theorem 3.2 (Divergence Representation of the Regulator). Let Φ be a class of bounded measurable functions that is rich enough to approximate any bounded measurable function on X. Let ψ be proper, convex, and lower semicontinuous. Then, for any Q∈Δ()Q∈ (X) such that Q≪QregQ Q_reg, the regulator admits the representation ℛ(Q)=Qreg[ψ∗(dQdQreg(m))].R(Q)=E_Q_reg [ψ^*\! ( dQdQ_reg(m) ) ]. (3.2) Proof. Let Q≪QregQ Q_reg and define the Radon–Nikodym derivative r(m):=dQ/dQreg(m)r(m):=dQ/dQ_reg(m). For any ϕ∈Φφ∈ , we rewrite the first term in (3.1) as Q[ϕ]=Qreg[ϕ(m)r(m)].E_Q[φ]=E_Q_reg [φ(m)r(m) ]. (3.3) Substituting into (3.1), we obtain ℛ(Q)=supϕ∈ΦQreg[ϕ(m)r(m)−ψ(ϕ(m))].R(Q)= _φ∈ E_Q_reg [φ(m)r(m)-ψ(φ(m)) ]. (3.4) Since Φ is sufficiently rich, the supremum over ϕφ can be taken pointwise. That is, for each m∈m , we optimize independently: supt∈ℝtr(m)−ψ(t)=ψ∗(r(m)). _t \t\,r(m)-ψ(t) \=ψ^* (r(m) ). (3.5) Therefore, ℛ(Q)=Qreg[ψ∗(r(m))]=Qreg[ψ∗(dQdQreg(m))],R(Q)=E_Q_reg [ψ^* (r(m) ) ]=E_Q_reg [ψ^*\! ( dQdQ_reg(m) ) ], (3.6) which establishes (3.2). ∎ The theorem shows that the regulator is an f-divergence with generator function f=ψ∗f=ψ^*. Intuitively, the likelihood ratio dQ/dQregdQ/dQ_reg identifies where the generator puts more mass than the regulated reference. The convex function ψ∗ψ^* then decides how severely to penalize these relative-density deviations. Different choices of ψ therefore correspond to different regulatory attitudes toward mismatch: some penalize moderate deviations gently, while others punish concentrated deviations sharply. Corollary 3.3 (Optimal Discriminator). Under the assumptions of Theorem 3.2, suppose further that ψ is differentiable and strictly convex. Then the supremum in (3.1) is attained by a function ϕ∗∈Φφ^*∈ satisfying ϕ∗(m)=(ψ′)−1(dQdQreg(m))for Qreg-almost every m.φ^*(m)= (ψ )^-1\! ( dQdQ_reg(m) ) $Q_ reg$-almost every m. (3.7) Proof. From the proof of Theorem 3.2, the optimization over ϕφ reduces pointwise to supt∈ℝtr(m)−ψ(t), _t \t\,r(m)-ψ(t)\, (3.8) where r(m)=dQdQreg(m)r(m)= dQdQ_reg(m). Since ψ is differentiable and strictly convex, the supremum is achieved at the unique maximizer t∗(m)t^*(m) satisfying the first-order optimality condition r(m)−ψ′(t∗(m))=0.r(m)-ψ (t^*(m))=0. (3.9) Solving for t∗(m)t^*(m) yields t∗(m)=(ψ′)−1(r(m)).t^*(m)= (ψ )^-1(r(m)). (3.10) Setting ϕ∗(m)=t∗(m)φ^*(m)=t^*(m) gives the desired result. ∎ The optimal discriminator ϕ∗φ^* depends explicitly on the likelihood ratio dQdQreg dQdQ_reg and therefore extracts precisely the evidence that distinguishes the generated distribution from the regulated reference. This provides a clear interpretation of the regulator as an optimal statistical test between two message laws, rather than as an ad hoc rule applied after generation. 3.1.2 Optimal Regulator The previous corollary identifies the optimal regulator explicitly: under differentiability and strict convexity, the best scoring function is a monotone transform of the likelihood ratio dQ/dQregdQ/dQ_reg. Thus the regulator depends only on the statistical evidence that separates the generator distribution from the regulated reference. Definition 3.4 (f-Divergence). Let f:ℝ+→ℝf:R_+ be a convex function with f(1)=0f(1)=0. The f-divergence between Q and QregQ_reg is defined as Df(Q∥Qreg)=Qreg[f(dQdQreg(m))].D_f(Q\,\|\,Q_reg)=E_Q_reg [f\! ( dQdQ_reg(m) ) ]. (3.11) Proposition 3.5 (Regulator as a Divergence). Under the assumptions of Theorem 3.2, let f(u):=ψ∗(u)−ψ∗(1)f(u):=ψ^*(u)-ψ^*(1). Then ℛ(Q)=Df(Q∥Qreg)+ψ∗(1).R(Q)=D_f(Q\,\|\,Q_reg)+ψ^*(1). (3.12) In particular, when ψ∗(1)=0ψ^*(1)=0, the regulator is exactly the f-divergence generated by f=ψ∗f=ψ^*. Proof. By Theorem 3.2, ℛ(Q)=Qreg[ψ∗(dQdQreg(m))].R(Q)=E_Q_reg [ψ^*\! ( dQdQ_reg(m) ) ]. Writing ψ∗(u)=f(u)+ψ∗(1)ψ^*(u)=f(u)+ψ^*(1) gives ℛ(Q)=Qreg[f(dQdQreg(m))]+ψ∗(1)=Df(Q∥Qreg)+ψ∗(1).R(Q)=E_Q_reg [f\! ( dQdQ_reg(m) ) ]+ψ^*(1)=D_f(Q\,\|\,Q_reg)+ψ^*(1). Since f(1)=0f(1)=0, f is a normalized f-divergence generator. ∎ The representation (3.2) shows that the regulator measures the discrepancy between Q and QregQ_reg through a convex function of the likelihood ratio dQdQreg dQdQ_reg. It therefore penalizes deviations from regulated behavior through the relative density of the two distributions. Operationally, this means that a message region is risky for the generator when it is common under Q but uncommon under QregQ_reg; such a region is precisely where an optimal discriminator has evidence that the generator has departed from the regulated reference. 3.1.3 Examples of Divergence Regulators The regulator functional ℛ(Q)R(Q) admits explicit and tractable forms for several important choices of the convex function ψ. These cases are of particular interest because they lead to well-known divergence measures and admit closed-form expressions for both the regulator and the optimal discriminator. Kullback–Leibler divergence. Consider the choice ψ(t)=etψ(t)=e^t. Its convex conjugate is ψ∗(u)=ulogu−u+1ψ^*(u)=u u-u+1, which is the generator of the Kullback–Leibler (KL) divergence, a central discrepancy measure in information theory and statistical inference [2]. Substituting into (3.2), we obtain ℛ(Q)=Qreg[dQdQreg(m)logdQdQreg(m)]=DKL(Q∥Qreg).R(Q)=E_Q_reg [ dQdQ_reg(m) dQdQ_reg(m) ]=D_KL(Q\,\|\,Q_reg). (3.13) In this case, the optimal discriminator from Corollary 3.3 is ϕ∗(m)=log(dQ/dQreg)(m)φ^*(m)= (dQ/dQ_reg)(m). This has a clear statistical interpretation: the optimal discriminator assigns to each message the log-likelihood ratio between Q and QregQ_reg, the canonical statistic for distinguishing the two distributions. From a computational perspective, the KL case is particularly attractive because it is convex, admits efficient estimation in many settings, and leads to a modified Gibbs distribution that incorporates a log-likelihood penalty. Pearson χ2χ^2 divergence. Consider the quadratic choice ψ(t)=12t2ψ(t)= 12t^2. Its convex conjugate is ψ∗(u)=12u2ψ^*(u)= 12u^2. Substituting into (3.2), we obtain ℛ(Q)=12Qreg[(dQdQreg(m))2].R(Q)= 12E_Q_reg [ ( dQdQ_reg(m) )^2 ]. (3.14) Up to normalization, this corresponds to the Pearson χ2χ^2 divergence: χ2(Q∥Qreg)=Qreg[(dQdQreg(m)−1)2].χ^2(Q\,\|\,Q_reg)=E_Q_reg [ ( dQdQ_reg(m)-1 )^2 ]. (3.15) The optimal discriminator in this case is the likelihood ratio itself. This regulator penalizes large deviations of Q from QregQ_reg more aggressively than the KL divergence, as the penalty grows quadratically in the likelihood ratio. As a result, it is particularly sensitive to outliers or rare events where Q places excessive mass relative to QregQ_reg. Jensen–Shannon divergence and the GAN regulator. Consider the choice ψ(t)=log(1+et)ψ(t)= (1+e^t). This function is convex and corresponds to the logistic loss commonly used in binary classification. Its convex conjugate is given by ψ∗(u)=ulogu+(1−u)log(1−u),u∈(0,1),ψ^*(u)=u u+(1-u) (1-u), u∈(0,1), (3.16) and +∞+∞ otherwise. With the standard GAN reparameterization and equal class priors, this choice leads to the Jensen–Shannon (JS) divergence, up to additive constants: ℛ(Q)=JS(Q∥Qreg),R(Q)\;=\;JS(Q\,\|\,Q_reg), (3.17) which is a symmetrized and smoothed version of the Kullback–Leibler divergence. In this case, it is convenient to parametrize the discriminator through the probability function D(m)=eϕ(m)/(1+eϕ(m))D(m)=e^φ(m)/(1+e^φ(m)). The optimal discriminator takes the well-known form D∗(m)=Q(m)Q(m)+Qreg(m),D^*(m)= Q(m)Q(m)+Q_reg(m), (3.18) and equivalently ϕ∗(m)=log(Q(m)/Qreg(m))φ^*(m)= (Q(m)/Q_reg(m)). This case has an important interpretation. The regulator corresponds to the objective used in generative adversarial networks (GANs): the discriminator attempts to distinguish samples from Q and QregQ_reg, and the Jensen–Shannon divergence measures how well the two distributions can be separated by an optimal classifier [7, 10]. Compared to the KL divergence, the JS divergence is symmetric and bounded: 0≤JS(Q∥Qreg)≤log20 (Q\,\|\,Q_reg)≤ 2. This boundedness makes it numerically stable in many applications, although it may become insensitive when the supports of Q and QregQ_reg are nearly disjoint, which can lead to optimization difficulties. 3.1.4 Feature-Based Scoring and Detection In practical systems, regulation often proceeds by first extracting features from a message and then applying a decision rule based on these features. This motivates a two-stage architecture consisting of feature extraction and scoring followed by detection. The abstraction is deliberately broad: features may be lexical, syntactic, semantic, retrieval-based, classifier-based, or policy-specific, and the theory only requires that they define measurable summaries of complete messages. Let ℱ:→ℝdF:X ^d denote a feature mapping that associates each message m∈m with a feature vector z=ℱ(m)z=F(m). The feature map ℱF may depend on external information sources, such as knowledge bases or retrieval systems. Two important instances are as follows. (i) Keyword-based features. Let ⊆K be a set of regulated tokens. Define ℱkey(m)=1L∑k=1Lwk∈.F_key(m)= 1L _k=1^L1\w_k \. (3.19) This yields a scalar feature representing the fraction of regulated tokens. (i) Knowledge-based (RAG) features. Let D denote an external knowledge base, such as a document corpus, database, or knowledge graph. Let Retrieve:×→2Retrieve:X×D→ 2^D be a retrieval operator that, given a message m∈m , returns a finite subset m:=Retrieve(m,)⊆D_m:=Retrieve(m,D) of documents or knowledge items deemed relevant to m. We define the knowledge-based feature map ℱrag:→ℝdF_rag:X ^d by ℱrag(m)=g(m,m),F_rag(m)=g(m,D_m), (3.20) where g:×2→ℝdg:X× 2^D ^d is a measurable function that extracts features by comparing the message m with the retrieved knowledge mD_m. The function g may encode various forms of semantic or policy-relevant evaluation. For instance, it may measure factual consistency by comparing statements in m with retrieved evidence, policy compliance by detecting alignment or violation relative to known rules, or semantic similarity by computing embeddings and distances between m and elements of mD_m. In this formulation, the feature map ℱrag(m)F_rag(m) depends not only on the message itself but also on external information retrieved from D, distinguishing knowledge-based regulation from purely content-based methods. In a common special case, the feature extractor aggregates pairwise scores between the message and retrieved documents. For example, if m=d1,…,dKD_m=\d_1,…,d_K\, one may define g(m,m)=1K∑i=1Ks(m,di),g(m,D_m)= 1K _i=1^Ks(m,d_i), (3.21) where s:×→ℝds:X×D ^d is a similarity or consistency score. This makes explicit how retrieval augments the feature representation through external knowledge. Given the feature representation z=ℱ(m)∈ℝdz=F(m) ^d, the regulator assigns a scalar score to the message through a function s:ℝd→ℝs:R^d , yielding S(m)=s(ℱ(m))S(m)=s(F(m)). The scoring function aggregates multiple features into a single quantity that measures the degree to which the message exhibits regulated characteristics. It may be linear, nonlinear, or learned from data; for example, a linear rule takes the form S(m)=⟨θ,ℱ(m)⟩S(m)= θ,F(m) for some parameter vector θ∈ℝdθ ^d, while nonlinear choices can capture feature interactions. Statistically, S(m)S(m) is a low-dimensional summary statistic for the message, reducing the complexity of X to a one-dimensional quantity used for subsequent decision-making. Given the score S(m)S(m), the regulator applies a decision rule to determine whether the message violates regulatory constraints. A canonical choice is a threshold-based rule δ(m)=S(m)≥η,δ(m)=1\S(m)≥η\, (3.22) where η∈ℝη is a threshold parameter. This rule partitions the message space into accepted and flagged regions, and the threshold η controls the detector’s operating point by trading off false positives and false negatives. We next present a formal equivalence between the feature-based detection problem and the variational regulator in (3.1). The result shows that the regulator arises as the dual representation of a convex risk minimization problem, thereby connecting the decision-theoretic interpretation of regulation with the divergence-based formulation above. Definition 3.6 (Binary Decision Problem). Let Qreg,Q∈Δ()Q_reg,Q∈ (X) be two probability measures. A decision rule is a measurable function δ:→[0,1]δ:X→[0,1]. The associated risk is defined as ℒ(δ)=Qreg[ℓ0(δ(m))]+Q[ℓ1(δ(m))],L(δ)=E_Q_reg[ _0(δ(m))]+E_Q[ _1(δ(m))], (3.23) where ℓ0,ℓ1:[0,1]→ℝ _0, _1:[0,1] are convex loss functions. Assumption 3.7. The losses ℓ0 _0 and ℓ1 _1 are convex, proper, and differentiable, and induce a strictly proper scoring rule. Proposition 3.8 (Score-Based Reformulation). Let Qreg,Q∈Δ()Q_reg,Q∈ (X) and consider the risk (3.23) where ℓ0,ℓ1:[0,1]→ℝ _0, _1:[0,1] are convex functions. Assume that ℓ0 _0 is strictly convex and differentiable. Then there exists a convex function ψ:ℝ→ℝψ:R such that infδℒ(δ)=C−supϕQ[ϕ(m)]−Qreg[ψ(ϕ(m))], _δL(δ)=C- _φ \E_Q[φ(m)]-E_Q_reg[ψ(φ(m))] \, (3.24) for some constant C independent of ϕφ. Proof. Assume Q≪QregQ Q_reg and define the likelihood ratio r(m):=dQ/dQreg(m)r(m):=dQ/dQ_reg(m). Then the risk can be written as ℒ(δ)=Qreg[ℓ0(δ(m))+r(m)ℓ1(δ(m))].L(δ)=E_Q_reg [ _0(δ(m))+r(m)\, _1(δ(m)) ]. Since δ(m)δ(m) is chosen pointwise, the minimization separates over m, yielding infδℒ(δ)=Qreg[infd∈[0,1]ℓ0(d)+r(m)ℓ1(d)]. _δL(δ)=E_Q_reg [ _d∈[0,1] \ _0(d)+r(m)\, _1(d) \ ]. Define f(u):=infd∈[0,1]ℓ0(d)+uℓ1(d)f(u):= _d∈[0,1]\ _0(d)+u\, _1(d)\. Then infδℒ(δ)=Qreg[f(r(m))] _δL(δ)=E_Q_reg[f(r(m))]. The function f is concave in u as an infimum of affine functions. By concave duality, there exists a convex function ψ such that f(u)=inft∈ℝψ(t)−ut.f(u)= _t \ψ(t)-ut \. Substituting, infδℒ(δ)=Qreg[inftψ(t)−r(m)t]. _δL(δ)=E_Q_reg [ _t \ψ(t)-r(m)\,t \ ]. Under standard measurability conditions, we can interchange infimum and expectation to obtain infδℒ(δ)=infϕQreg[ψ(ϕ(m))−r(m)ϕ(m)]. _δL(δ)= _φE_Q_reg [ψ(φ(m))-r(m)\,φ(m) ]. Finally, rewriting the second term as Qreg[r(m)ϕ(m)]=Q[ϕ(m)]E_Q_reg[r(m)\,φ(m)]=E_Q[φ(m)], we obtain infδℒ(δ)=infϕQreg[ψ(ϕ(m))]−Q[ϕ(m)]. _δL(δ)= _φ \E_Q_reg[ψ(φ(m))]-E_Q[φ(m)] \. Rearranging gives the desired result. ∎ Theorem 3.9 (Dual Representation of Optimal Risk). Under the above assumptions, the optimal risk satisfies infδℒ(δ)=infϕℒ(ϕ)=C−supϕQ[ϕ(m)]−Qreg[ψ(ϕ(m))]. _δL(δ)= _φL(φ)=C- _φ \E_Q[φ(m)]-E_Q_reg[ψ(φ(m))] \. (3.25) Proof. The first equality follows from Proposition 3.8. The second follows by rearranging (3.23). ∎ Corollary 3.10 (Equivalence with Variational Regulator). Let ℛ(Q)R(Q) be defined as in (3.1). Then ℛ(Q)=supϕQ[ϕ(m)]−Qreg[ψ(ϕ(m))]=C−infδℒ(δ).R(Q)= _φ \E_Q[φ(m)]-E_Q_reg[ψ(φ(m))] \=C- _δL(δ). (3.26) Proof. The first equality is the definition of ℛ(Q)R(Q) in (3.1). Theorem 3.9 gives infδℒ(δ)=C−supϕQ[ϕ(m)]−Qreg[ψ(ϕ(m))] _δL(δ)=C- _φ\E_Q[φ(m)]-E_Q_reg[ψ(φ(m))]\. Rearranging this identity yields the second equality. ∎ The function ϕφ is a test statistic that scores messages according to their likelihood of being generated from Q rather than QregQ_reg. The function ψ is determined by the loss and penalizes large values of ϕφ under the reference distribution. The regulator ℛ(Q)R(Q) quantifies the optimal separability between the two distributions. 3.1.5 Feature-Based Restriction The preceding variational regulator allows the discriminator to inspect the entire message m. In many moderation, censorship, deception-detection, and phishing-defense systems, however, the receiver observes only a feature representation. Let ℱ:→F:X be a measurable feature map, with ⊆ℝdZ ^d. The feature map is the mathematical version of a detector pipeline: raw text is mapped to counts, scores, embeddings, classifier logits, URL-risk features, or other summaries. The feature-induced laws are the pushforwards Qℱ(B):=Q(ℱ−1(B)),Qreg,ℱ(B):=Qreg(ℱ−1(B)),Q_F(B):=Q(F^-1(B)), Q_reg,F(B):=Q_reg(F^-1(B)), (3.27) for measurable B⊆B . A feature-restricted discriminator has the form ϕ(m)=h(ℱ(m))φ(m)=h(F(m)), where h:→ℝh:Z is a score on feature space. The corresponding regulator is ℛℱ(Q)=suphQ[h(ℱ(m))]−Qreg[ψ(h(ℱ(m)))].R_F(Q)= _h \E_Q[h(F(m))]-E_Q_reg[ψ(h(F(m)))] \. (3.28) Proposition 3.11 (Feature-Induced Divergence). Suppose the score class for h is rich enough to approximate bounded measurable functions on Z, and let f(u):=ψ∗(u)−ψ∗(1)f(u):=ψ^*(u)-ψ^*(1). If Qℱ≪Qreg,ℱQ_F Q_reg,F, then ℛℱ(Q)=Df(Qℱ∥Qreg,ℱ)+ψ∗(1)=Qreg,ℱ[f(dQℱdQreg,ℱ(z))]+ψ∗(1).R_F(Q)=D_f(Q_F\,\|\,Q_reg,F)+ψ^*(1)=E_Q_reg,F [f\! ( dQ_FdQ_reg,F(z) ) ]+ψ^*(1). (3.29) Proof. For any measurable h, the change-of-variables identity for pushforward measures gives Q[h(ℱ(m))]=Qℱ[h(z)]E_Q[h(F(m))]=E_Q_F[h(z)] and Qreg[ψ(h(ℱ(m)))]=Qreg,ℱ[ψ(h(z))]E_Q_reg[ψ(h(F(m)))]=E_Q_reg,F[ψ(h(z))]. Therefore (3.28) is the same variational discriminator problem as (3.1), but on feature space. Applying Theorem 3.2 on Z gives (3.29). ∎ Corollary 3.12 (Information Loss under Feature Restriction). Under the assumptions of Proposition 3.11, suppose also that Q≪QregQ Q_reg. Then the restricted regulator cannot exceed the full message-level regulator: ℛℱ(Q)≤ℛ(Q).R_F(Q) (Q). (3.30) If f is strictly convex, equality holds precisely when the likelihood ratio dQ/dQregdQ/dQ_reg is determined by the feature ℱ(m)F(m), up to QregQ_reg-null sets. Proof. Let r(m):=dQ/dQreg(m)r(m):=dQ/dQ_reg(m) and Z:=ℱ(M)Z:=F(M) for M∼QregM Q_reg. The feature-level likelihood ratio satisfies dQℱ/dQreg,ℱ(Z)=Qreg[r(M)∣Z]dQ_F/dQ_reg,F(Z)=E_Q_reg[r(M) Z]. Hence Jensen’s inequality gives ℛℱ(Q) _F(Q) =ψ∗(1)+Qreg[f([r(M)∣Z])] =ψ^*(1)+E_Q_reg [f\! (E[r(M) Z] ) ] ≤ψ∗(1)+Qreg[f(r(M))]. ≤ψ^*(1)+E_Q_reg[f(r(M))]. (3.31) The right-hand side is ℛ(Q)R(Q) by Theorem 3.2. For strictly convex f, equality in Jensen’s inequality occurs exactly when r(M)r(M) is almost surely constant conditional on Z, which means that the likelihood ratio is a function of ℱ(m)F(m). ∎ This result makes the role of feature design explicit. A coarse feature map produces a regulator that sees only the discrepancy between QℱQ_F and Qreg,ℱQ_reg,F, while a sufficient feature map preserves all likelihood-ratio information relevant to discrimination. In plain terms, a detector cannot penalize what its features cannot see. The case studies below use exactly this reduction: complete messages are mapped into receiver-side semantic classes, and the equilibrium is evaluated through the induced class distribution and score statistic rather than through every token sequence. 4 Zero-Sum Game and Its Saddle-Point 4.1 Generator–Regulator Game We model the interaction between the generator and the regulator as a zero-sum game between a distribution Q∈Δ()Q∈ (X) and a regulator score ϕ∈Φφ∈ . This formulation uses the variational regulator ℛ(Q)R(Q) from (3.1): the generator seeks useful and diverse messages, while the regulator seeks evidence that Q deviates from the reference behavior encoded by QregQ_reg. The generator seeks to maximize semantic utility and entropy while paying a regulatory penalty. Using (3.1), the regulated objective is 1TQ[UL(m)]+H(Q)−λℛ(Q), 1TE_Q[U_L(m)]+H(Q)- (Q), (4.1) where λ≥0λ≥ 0 controls the strength of regulation. The parameter λ should be interpreted as a policy or enforcement weight. When λ=0λ=0, the generator behaves as if the regulator did not exist and chooses the entropy-regularized utility maximizer. As λ increases, the generator must give up utility or diversity whenever those gains require moving too far from the regulated reference distribution. Substituting (3.1) into the regulated objective and using the identity −sup=inf(−)- = (-), we obtain the min–max formulation supQ∈Δ()infϕ∈Φ1TQ[UL(m)]+H(Q)−λQ[ϕ(m)]+λQreg[ψ(ϕ(m))]. _Q∈ (X) _φ∈ \ 1TE_Q[U_L(m)]+H(Q)- _Q[φ(m)]+ _Q_reg[ψ(φ(m))] \. (4.2) This is a zero-sum game: the generator selects Q to maximize utility and entropy, while the regulator selects ϕφ to penalize deviations from the reference behavior encoded in QregQ_reg. The game-theoretic intuition is that the generator and regulator have opposing objectives, but their choices are coupled. If the generator shifts probability mass toward high-utility but easily detectable messages, the regulator can increase the penalty by choosing a discriminator that recognizes those messages. If the regulator is strong, the generator must move closer to QregQ_reg, even when doing so sacrifices utility. The saddle point describes a stable compromise, in the same minimax sense that underlies zero-sum game theory [19, 16] and strategic security models [24, 22]: neither side can improve its objective by changing strategy alone. 4.2 Saddle-Point Structure and Optimal Generator We formalize the saddle-point structure of the generator–regulator game in (4.2) and characterize the optimal generator distribution. The theorem below has three roles. First, it states conditions under which a stable generator–regulator compromise exists. Second, it shows that once the regulator score ϕφ is fixed, the generator is again a Gibbs law, but with a modified utility UL/T−λϕU_L/T-λφ. Third, it reduces the search for equilibrium to an optimization over the regulator score. Theorem 4.1 (Saddle-Point and Optimal Generator). Consider the min–max problem in (4.2). Assume that Δ() (X) is compact, Φ is convex, and ψ is convex and lower semicontinuous. Then: (i) The problem admits a saddle point (Q∗,ϕ∗)(Q^*,φ^*), and the order of optimization can be exchanged, so that supQ∈Δ()infϕ∈Φ(⋅)=infϕ∈ΦsupQ∈Δ()(⋅) _Q∈ (X) _φ∈ (·)= _φ∈ _Q∈ (X)(·). (i) For any fixed ϕ∈Φφ∈ , the inner maximization over Q admits a unique solution given by Q∗(m∣ϕ)=exp(1TUL(m)−λϕ(m))Z(ϕ),Q^*(m φ)= \! ( 1TU_L(m)-λφ(m) )Z(φ), (4.3) where Z(ϕ)=∑m∈exp(UL(m)/T−λϕ(m))Z(φ)= _m (U_L(m)/T-λφ(m)). (i) Substituting (4.3) into (4.2), the problem reduces to the convex optimization infϕ∈ΦlogZ(ϕ)+λQreg[ψ(ϕ(m))]. _φ∈ \ Z(φ)+ _Q_reg[ψ(φ(m))] \. (4.4) Proof. We proceed in three steps. Step 1 (Saddle-point existence). The objective in (4.2) is concave in Q because the entropy H(Q)H(Q) is strictly concave and the remaining terms are linear in Q. It is convex in ϕφ since ψ is convex and the dependence on ϕφ is affine in the remaining terms. Under the stated compactness and convexity assumptions, the existence of a saddle point and the interchange of sup and inf follow from Sion’s minimax theorem. Step 2 (Optimization over Q). Fix ϕ∈Φφ∈ . The optimization over Q becomes supQ∈Δ()Q[1TUL(m)−λϕ(m)]+H(Q). _Q∈ (X) \E_Q\! [ 1TU_L(m)-λφ(m) ]+H(Q) \. (4.5) This is a strictly concave optimization problem. Introducing a Lagrange multiplier for the normalization constraint ∑mQ(m)=1 _mQ(m)=1, the first-order optimality condition yields logQ∗(m)=UL(m)/T−λϕ(m)−logZ(ϕ) Q^*(m)=U_L(m)/T-λφ(m)- Z(φ), which gives (4.3). Uniqueness follows from strict concavity of the entropy. Step 3 (Reduced problem). Substituting Q∗(⋅∣ϕ)Q^*(· φ) into the objective yields supQ(⋅)=logZ(ϕ) _Q(·)= Z(φ) by the standard variational characterization of the log-partition function. Adding the regulator’s remaining reference term gives (4.4). ∎ 4.3 Special Case: KL Regulation We specialize the variational regulator to the KL case. This case is especially readable because it produces a closed-form equilibrium in which the regulated generator is a geometric interpolation between a utility-based Gibbs law and the regulated reference law. Proposition 4.2 (KL Regulator). Let ψ(t)=etψ(t)=e^t. Then the regulator functional reduces to the Kullback–Leibler divergence, ℛ(Q)=DKL(Q∥Qreg)R(Q)=D_KL(Q\,\|\,Q_reg). Proof. The convex conjugate of ψ(t)=etψ(t)=e^t is ψ∗(u)=ulogu−u+1ψ^*(u)=u u-u+1. Substituting this choice into the divergence representation (3.2) yields ℛ(Q)=Qreg[dQdQreg(m)logdQdQreg(m)]=DKL(Q∥Qreg),R(Q)=E_Q_reg [ dQdQ_reg(m) dQdQ_reg(m) ]=D_KL(Q\,\|\,Q_reg), which proves the claim. ∎ Proposition 4.3 (Generator Problem under KL Regulation). Under KL regulation, the generator solves supQ∈Δ()1TQ[UL(m)]+H(Q)−λDKL(Q∥Qreg). _Q∈ (X) \ 1TE_Q[U_L(m)]+H(Q)-λ D_KL(Q\,\|\,Q_reg) \. (4.6) Proof. Under the KL choice ψ(t)=etψ(t)=e^t, Proposition 4.2 gives ℛ(Q)=DKL(Q∥Qreg)R(Q)=D_KL(Q\,\|\,Q_reg). Substituting this identity into the regulated generator objective 1TQ[UL(m)]+H(Q)−λℛ(Q) 1TE_Q[U_L(m)]+H(Q)- (Q) gives the displayed optimization problem. ∎ Proposition 4.4 (Closed-Form Equilibrium Distribution). The optimization problem in Proposition 4.3 admits a unique maximizer given by Q∗(m)=Qreg(m)λ1+λexp(1T(1+λ)UL(m))Zreg,Q^*(m)= Q_reg(m) λ1+λ \! ( 1T(1+λ)U_L(m) )Z_reg, (4.7) where the normalization constant is Zreg=∑m∈Qreg(m)λ1+λexp(1T(1+λ)UL(m)).Z_reg= _m Q_reg(m) λ1+λ \! ( 1T(1+λ)U_L(m) ). (4.8) Proof. Using the identity DKL(Q∥Qreg)=Q[log(Q(m)/Qreg(m))]D_KL(Q\,\|\,Q_reg)=E_Q[ (Q(m)/Q_reg(m))], the objective can be written as Q[1TUL(m)−logQ(m)−λlogQ(m)Qreg(m)].E_Q\! [ 1TU_L(m)- Q(m)-λ Q(m)Q_reg(m) ]. Rearranging terms yields Q[1TUL(m)−(1+λ)logQ(m)+λlogQreg(m)].E_Q\! [ 1TU_L(m)-(1+λ) Q(m)+λ Q_reg(m) ]. This is a strictly concave optimization problem over Q. Introducing a Lagrange multiplier for the normalization constraint and taking first-order conditions, we obtain logQ∗(m)=UL(m)/(T(1+λ))+(λ/(1+λ))logQreg(m)−logZreg Q^*(m)=U_L(m)/(T(1+λ))+(λ/(1+λ)) Q_reg(m)- Z_reg, which yields the stated form. ∎ The formula in Proposition 4.4 is the clearest expression of the paper’s main mechanism. The factor exp(UL(m)/(T(1+λ))) (U_L(m)/(T(1+λ))) rewards useful messages, while the factor Qreg(m)λ/(1+λ)Q_reg(m)^λ/(1+λ) pulls probability mass toward regulated behavior. Thus λ does not simply delete undesirable messages; it continuously reweights the whole distribution over messages. Proposition 4.5 (Structure of the Equilibrium). The optimal distribution satisfies logQ∗(m)=1T(1+λ)UL(m)+λ1+λlogQreg(m)+const. Q^*(m)= 1T(1+λ)U_L(m)+ λ1+λ Q_reg(m)+const. (4.9) Proof. Taking logarithms in the closed-form expression of Proposition 4.4 gives logQ∗(m)=UL(m)/(T(1+λ))+(λ/(1+λ))logQreg(m)−logZreg Q^*(m)=U_L(m)/(T(1+λ))+(λ/(1+λ)) Q_reg(m)- Z_reg. Since ZregZ_reg does not depend on m, the term −logZreg- Z_reg is the additive constant in the statement. ∎ Corollary 4.6 (Limiting Regimes of the KL-Regulated Equilibrium). The equilibrium distribution in Proposition 4.4 is a tilted Gibbs measure. As λ→0λ→ 0, it reduces to the standard Gibbs distribution proportional to exp(UL(m)/T) (U_L(m)/T); as λ→∞λ→∞, it converges to QregQ_reg, assuming Qreg(m)>0Q_reg(m)>0 on the message space. Proof. In the formula of Proposition 4.4, the exponent on Qreg(m)Q_reg(m) is λ/(1+λ)λ/(1+λ) and the utility coefficient is 1/(T(1+λ))1/(T(1+λ)). The first coefficient tends to 0 and the second to 1/T1/T as λ→0λ→ 0; the first tends to 11 and the second to 0 as λ→∞λ→∞. Normalization gives the two stated limits. ∎ Thus λ controls the tradeoff between utility maximization and regulatory alignment: the utility term promotes high-value messages, while the reference-law term incorporates regulated behavior as a prior. 4.4 Regulated Free Energy Density and Central Limit Theorem The KL-regulated equilibrium is still a distribution over an exponentially large message space. To study its large-L behavior, we summarize the normalization scale by a free energy density. This quantity records the per-token growth rate of the regulated partition function and lets us compare long messages without tracking the full combinatorial sum. We define the regulated free energy density as ℱreg(T)=limL→∞1Llog∑m∈LQreg(m)λ1+λexp(1T(1+λ)UL(m)),F_reg(T)= _L→∞ 1L _m ^LQ_reg(m) λ1+λ \! ( 1T(1+λ)U_L(m) ), (4.10) provided that the limit exists. The equilibrium distribution Q∗Q^* satisfies 1LlogQ∗(m)=1T(1+λ)U¯L(m)+λ1+λ1LlogQreg(m)−ℱreg(T)+o(1), 1L Q^*(m)= 1T(1+λ) U_L(m)+ λ1+λ 1L Q_reg(m)-F_reg(T)+o(1), (4.11) as L→∞L→∞, where U¯L(m):=UL(m)/L U_L(m):=U_L(m)/L. Thus, ℱreg(T)F_reg(T) plays the role of a normalization constant (pressure), ensuring that Q∗Q^* is properly normalized at the exponential scale. In statistical-mechanics language, it is the pressure; in information-theoretic language, it is the normalized log-partition value; in the present paper, it is the per-token value of regulated generation. We establish a central limit theorem for the log-density under the optimal generator. The reason a CLT is natural here is that many receiver scores and log-densities are sums of token-level contributions. When no single token dominates and conditional variances stabilize, the average score of a long message fluctuates approximately like a Gaussian random variable around its equilibrium mean. Theorem 4.7 (CLT for General Generator–Regulator Equilibrium). Consider the equilibrium distribution Q∗(m)∝exp(UL(m)/T−λϕ(m))Q^*(m) (U_L(m)/T-λφ(m)). Assume: (G1) (Additive structure) UL(m)=∑k=1Lu(wk,hk)U_L(m)= _k=1^Lu(w_k,h_k) and ϕ(m)=∑k=1Lϕk(wk,hk)φ(m)= _k=1^L _k(w_k,h_k). (G2) The process (wk,hk)k≥1\(w_k,h_k)\_k≥ 1 is adapted to a filtration ℱk\F_k\. (G3) (Lindeberg condition) For Yk:=u(wk,hk)/T−λϕk(wk,hk)Y_k:=u(w_k,h_k)/T-λ _k(w_k,h_k), 1L∑k=1L[(Yk−[Yk∣ℱk−1])2|Yk|>εL]→0∀ε>0. 1L _k=1^LE\! [ (Y_k-E[Y_k _k-1] )^21\|Y_k|> L\ ]→ 0 ∀ >0. (G4) (Conditional variance convergence) 1L∑k=1LVar(Yk∣ℱk−1)→σ2>0. 1L _k=1^LVar(Y_k _k-1)\; P\;σ^2>0. Then, as L→∞L→∞, L(1LlogQ∗(m)−μ)→(0,σ2), L ( 1L Q^*(m)-μ )\; d\;N(0,σ^2), (4.12) where μ=Q∗[Y1]−ℱreg(T)μ=E_Q^*[Y_1]-F_reg(T). Proof. Under (G1), the log-density admits the decomposition logQ∗(m)=∑k=1LYk−logZL, Q^*(m)= _k=1^LY_k- Z_L, where ZL=∑m∈Lexp(1TUL(m)−λϕ(m)).Z_L= _m ^L \! ( 1TU_L(m)-λφ(m) ). Dividing by L, we obtain 1LlogQ∗(m)=1L∑k=1LYk−1LlogZL. 1L Q^*(m)= 1L _k=1^LY_k- 1L Z_L. By definition of the regulated free energy density, (1/L)logZL→ℱreg(T)(1/L) Z_L _reg(T). Define the martingale difference sequence Dk:=Yk−[Yk∣ℱk−1]D_k:=Y_k-E[Y_k _k-1]. Under (G3)–(G4), the martingale central limit theorem yields 1L∑k=1LDk→(0,σ2). 1 L _k=1^LD_k\; d\;N(0,σ^2). Moreover, 1L∑k=1LYk=1L∑k=1L[Yk∣ℱk−1]+1L∑k=1LDk, 1L _k=1^LY_k= 1L _k=1^LE[Y_k _k-1]+ 1L _k=1^LD_k, and the predictable term converges to Q∗[Y1]E_Q^*[Y_1]. Combining the above yields the result. ∎ 5 Keyword-Based Safety Regulation We now specialize the feature-restricted regulator in (3.28) to a token-level score. This specialization connects the variational formulation to binary classification and statistical detection. Let ⊆K be a finite set of regulated tokens, and define a token-level scoring function s:→ℝs:V by s(w):=κ 1w∈s(w):=κ\,1\w \, where κ≥0κ≥ 0. For a message m=(w1,…,wL)∈m=(w_1,…,w_L) , define the regulated-token fraction f(m):=L−1∑k=1Lwk∈f_K(m):=L^-1 _k=1^L1\w_k \. The aggregate score is S(m):=L−1∑k=1Ls(wk)=κf(m)S(m):=L^-1 _k=1^Ls(w_k)=κ f_K(m). The quantity S(m)S(m) summarizes the presence of regulated tokens and serves as a sufficient statistic for classification. This is the simplest version of the feature-based regulator: instead of analyzing all words and all semantics, the receiver compresses a message to one number. More realistic filters use many features, but the one-dimensional case is pedagogically useful because it makes the saddle point, threshold rule, and CLT visible in closed form. 5.1 Binary Classification Game We formulate regulation as a binary classification game between a generator and a classifier. This is the score-restricted analogue of the decision problem in (3.23), with the classifier allowed to use only the statistic S(m)S(m). Definition 5.1 (Binary Classification Model). Let X denote the message space and let Qreg∈Δ()Q_reg∈ (X) be a fixed reference distribution. The generator selects a distribution Q∈Δ()Q∈ (X). We consider the hypothesis testing problem H0:m∼QregH_0:m Q_reg versus H1:m∼QH_1:m Q. Definition 5.2 (Classifier and Restricted Class). A classifier is a measurable function δ:→[0,1]δ:X→[0,1], where δ(m)δ(m) denotes the probability of assigning m to class H1H_1. Let S(m)S(m) denote the aggregate score. We restrict attention to classifiers of the form δ(m)=g(S(m))δ(m)=g(S(m)) for some measurable function g:ℝ→[0,1]g:R→[0,1]. The admissible class is =δ:δ(m)=g(S(m)).D_K= \δ:δ(m)=g(S(m)) \. Definition 5.3 (Classification Risk). Let ℓ0,ℓ1:[0,1]→ℝ _0, _1:[0,1] be convex loss functions. The classification risk is defined as ℒ(Q,δ)=Qreg[ℓ0(δ(m))]+Q[ℓ1(δ(m))].L(Q,δ)=E_Q_reg[ _0(δ(m))]+E_Q[ _1(δ(m))]. (5.1) Definition 5.4 (Binary Classification Game). The interaction between the generator and the classifier is defined as the zero-sum game supQ∈Δ()infδ∈(Q,δ), _Q∈ (X) _δ _KJ(Q,δ), (5.2) where the payoff functional is (Q,δ):=1TQ[UL(m)]+H(Q)−λℒ(Q,δ),J(Q,δ):= 1TE_Q[U_L(m)]+H(Q)- (Q,δ), (5.3) with λ≥0λ≥ 0. Theorem 5.5 (Saddle-Point Characterization). Consider the binary classification game in Definition 5.4. Assume: 1. the loss functions ℓ0,ℓ1 _0, _1 are convex, differentiable, and strictly convex, 2. ULU_L is bounded, 3. D_K is convex and closed, 4. Δ() (X) is compact. Then there exists a saddle point (Q∗,δ∗)(Q^*,δ^*) satisfying the following conditions: (i) Optimal classifier. For fixed Q∗Q^*, the optimal classifier δ∗δ^* solves δ∗(m)∈argminδ∈Qreg[ℓ0(δ(m))]+Q∗[ℓ1(δ(m))].δ^*(m) \,min_δ _K \E_Q_reg[ _0(δ(m))]+E_Q^*[ _1(δ(m))] \. (5.4) Moreover, for each m, δ∗(m)δ^*(m) satisfies the pointwise first-order condition ℓ0′(δ∗(m))dQreg(m)+ℓ1′(δ∗(m))dQ∗(m)=0, _0 (δ^*(m))\,dQ_reg(m)+ _1 (δ^*(m))\,dQ^*(m)=0, (5.5) whenever the densities exist. (i) Optimal generator. For fixed δ∗δ^*, the optimal generator Q∗Q^* is given by Q∗(m)=exp(1TUL(m)−λℓ1(δ∗(m)))Z(δ∗),Q^*(m)= \! ( 1TU_L(m)-λ _1(δ^*(m)) )Z(δ^*), (5.6) where Z(δ∗)=∑m∈exp(1TUL(m)−λℓ1(δ∗(m))).Z(δ^*)= _m \! ( 1TU_L(m)-λ _1(δ^*(m)) ). (5.7) (i) Saddle-point property. The pair (Q∗,δ∗)(Q^*,δ^*) satisfies (Q,δ∗)≤(Q∗,δ∗)≤(Q∗,δ),∀Q,δ.J(Q,δ^*) (Q^*,δ^*) (Q^*,δ), ∀ Q,δ. (5.8) Proof. The existence of a saddle point follows from the same minimax argument used in Theorem 4.1. (i) For fixed Q∗Q^*, the classifier problem is convex and separable across m, yielding the pointwise first-order condition (5.5). (i) For fixed δ∗δ^*, the generator maximizes a strictly concave functional in Q. Introducing a Lagrange multiplier for normalization yields logQ∗(m)=1TUL(m)−λℓ1(δ∗(m))−logZ(δ∗), Q^*(m)= 1TU_L(m)-λ _1(δ^*(m))- Z(δ^*), which gives the stated Gibbs form. (i) Follows from the saddle-point optimality conditions. ∎ Corollary 5.6 (Monotone and Threshold Structure of the Optimal Classifier). Consider the binary classification game in Theorem 5.5. Suppose that: 1. the classifier is restricted to =δ(m)=g(S(m))D_K=\δ(m)=g(S(m))\, 2. the loss functions ℓ0,ℓ1 _0, _1 are convex and strictly proper, 3. the likelihood ratio dQ∗dQreg(m) dQ^*dQ_reg(m) is a monotone function of the score S(m)S(m) (monotone likelihood ratio condition). Then the optimal classifier δ∗δ^* is monotone in the score S(m)S(m). In particular, there exists a non-decreasing function g∗:ℝ→[0,1]g^*:R→[0,1] such that δ∗(m)=g∗(S(m))δ^*(m)=g^*(S(m)). Moreover, in the case of deterministic classification, such as 0–11 loss, the optimal classifier admits a threshold structure: δ∗(m)=S(m)≥η∗δ^*(m)=1\S(m)≥η^*\ for some threshold η∗∈ℝη^* . Proof. For fixed generator law Q∗Q^*, Theorem 5.5 reduces the classifier’s problem to pointwise Bayes decisions under QregQ_reg and Q∗Q^*. Strict propriety implies that the optimal probabilistic decision is a monotone transform of the posterior probability that the message was drawn from Q∗Q^* rather than from QregQ_reg. This posterior is itself a monotone transform of the likelihood ratio dQ∗/dQreg(m)dQ^*/dQ_reg(m). By the monotone likelihood-ratio assumption, the likelihood ratio is monotone in S(m)S(m), so the optimal classifier can be written as δ∗(m)=g∗(S(m))δ^*(m)=g^*(S(m)) for a non-decreasing function g∗g^*. In the deterministic 0–11 case, Bayes optimality compares the same likelihood ratio with a constant threshold determined by class priors and misclassification costs. Monotonicity in S(m)S(m) turns that likelihood-ratio threshold into a score threshold, so δ∗(m)=S(m)≥η∗δ^*(m)=1\S(m)≥η^*\ for some η∗η^*. ∎ Proposition 5.7 (Token-Level Exponential Tilting under Additive Receiver Loss). Consider the saddle-point characterization in Theorem 5.5. Assume: 1. the utility is additive, UL(m)=∑k=1Lu(wk,hk)U_L(m)= _k=1^Lu(w_k,h_k), 2. the induced receiver loss is additive at equilibrium, ℓ1(δ∗(m))=α∑k=1Ls(wk)+β _1(δ^*(m))=α _k=1^Ls(w_k)+β with α>0α>0, 3. the statistic s(wk)s(w_k) is the token-level receiver score. Then the optimal generator Q∗Q^* admits an additive (energy-based) representation: Q∗(m)∝exp(∑k=1L[1Tu(wk,hk)−θs(wk)]),Q^*(m) \! ( _k=1^L [ 1Tu(w_k,h_k)-θ\,s(w_k) ] ), (5.9) for θ=λα>0θ=λα>0. Consequently, for a fixed context h, the induced token distribution is an exponentially tilted version of the unregulated token distribution: q∗(w∣h)∝q0(w∣h)exp(−θs(w))q^*(w h) q_0(w h) (-θ s(w)), where q0(w∣h)∝exp(u(w,h)/T)q_0(w h) (u(w,h)/T). Proof. The generator component of Theorem 5.5 gives Q∗(m)∝exp(UL(m)/T−λℓ1(δ∗(m)))Q^*(m) (U_L(m)/T-λ _1(δ^*(m))). Substituting the additive utility and additive receiver loss gives Q∗(m)∝exp(∑k=1L[u(wk,hk)T−λαs(wk)]−λβ).Q^*(m) \! ( _k=1^L [ u(w_k,h_k)T-λα s(w_k) ]-λβ ). The constant −λβ-λβ is absorbed into the normalizing factor, yielding (5.9) with θ=λαθ=λα. Conditioning on a fixed context h and comparing the tilted one-token factor with the unregulated factor q0(w∣h)∝exp(u(w,h)/T)q_0(w h) (u(w,h)/T) gives the final proportionality. ∎ The corollary shows that optimal detection depends only on the scalar statistic S(m)S(m) via a monotone threshold rule. The proposition shows that, under an additive receiver loss, the generator responds by exponentially downweighting tokens with high score s(w)s(w). Together, these results characterize the equilibrium as a one-dimensional detection problem coupled with an exponential tilting of the token distribution. Theorem 5.8 (CLTs for Score, Log-Density, and Surprisal under Lindeberg Condition). Let Q∗Q^* be the optimal generator. Define ξk:=u(wk,hk)/T−θs(wk) _k:=u(w_k,h_k)/T-θ s(w_k) and Xk:=−logQ∗(wk∣hk)X_k:=- Q^*(w_k h_k). Let ℱ(T)F_K(T) denote the keyword-regulated free energy density, defined by the normalization identity logZL(T)=Lℱ(T)+o(L) Z_L^K(T)=L\,F_K(T)+o(L), where ZL(T)Z_L^K(T) is the partition function associated with the tilted representation in (5.9). Assume: (A1) The process (wk,hk)k≥1\(w_k,h_k)\_k≥ 1 is adapted to a filtration ℱk\F_k\. (A2) (Lindeberg condition) For each sequence Yk∈s(wk),ξk,XkY_k∈\s(w_k), _k,X_k\, 1L∑k=1L[(Yk−[Yk∣ℱk−1])2|Yk|>εL]→0∀ε>0. 1L _k=1^LE\! [ (Y_k-E[Y_k _k-1] )^21\|Y_k|> L\ ]→ 0 ∀ >0. (A3) (Conditional variance convergence) For each sequence YkY_k, 1L∑k=1LVar(Yk∣ℱk−1)→σY2. 1L _k=1^LVar(Y_k _k-1)\; P\; _Y^2. (A4) The log-density admits the decomposition logQ∗(m)=∑k=1Lξk−Lℱ(T) Q^*(m)= _k=1^L _k-L\,F_K(T). Then, as L→∞L→∞, the following central limit theorems hold: (i) Score. Let SL:=L−1∑k=1Ls(wk)S_L:=L^-1 _k=1^Ls(w_k) and μS:=Q∗[s(w1)] _S:=E_Q^*[s(w_1)]. Then L(SL−μS)→(0,σS2), L (S_L- _S )\; d\;N(0, _S^2), (5.10) where σS2 _S^2 is the limit in (A3) with Yk=s(wk)Y_k=s(w_k). (i) Log-density. Let ΛL:=L−1logQ∗(m) _L:=L^-1 Q^*(m) and μΛ:=Q∗[ξ1]−ℱ(T) _ :=E_Q^*[ _1]-F_K(T). Then L(ΛL−μΛ)→(0,σΛ2), L ( _L- _ )\; d\;N(0, _ ^2), (5.11) where σΛ2 _ ^2 corresponds to Yk=ξkY_k= _k. (i) Surprisal. Let X¯L:=L−1∑k=1LXk X_L:=L^-1 _k=1^LX_k and H(Q∗):=Q∗[X1]H(Q^*):=E_Q^*[X_1]. Then L(X¯L−H(Q∗))→(0,σX2), L ( X_L-H(Q^*) )\; d\;N(0, _X^2), (5.12) where σX2 _X^2 corresponds to Yk=XkY_k=X_k. Proof. For each choice of Yk∈s(wk),ξk,XkY_k∈\s(w_k), _k,X_k\, define the martingale difference sequence Dk:=Yk−[Yk∣ℱk−1]D_k:=Y_k-E[Y_k _k-1]. Under assumptions (A2)–(A3), the martingale central limit theorem applies, yielding convergence of 1L∑k=1LDk→(0,σY2). 1 L _k=1^LD_k\; d\;N(0, _Y^2). Since 1L∑k=1LYk=1L∑k=1L[Yk∣ℱk−1]+1L∑k=1LDk, 1L _k=1^LY_k= 1L _k=1^LE[Y_k _k-1]+ 1L _k=1^LD_k, and the predictable term converges to μY _Y, the result follows. The log-density case uses (A4). ∎ The three limits correspond respectively to detection statistics, log-density (energy), and information content, showing that all key observables of the optimal generator exhibit Gaussian fluctuations under the same structural conditions. For interpretation, the score CLT approximates filtering probability, the log-density CLT approximates how likely a generated message is under the equilibrium law, and the surprisal CLT approximates how concentrated the information content is around its entropy rate. Corollary 5.9 (Gaussian Approximation of Detection). Under the conditions of Theorem 5.8, we have L(SL−μS)→(0,σS2). L (S_L- _S )\; d\;N(0, _S^2). (5.13) Equivalently, SL=μS+(σS/L)ZLS_L= _S+( _S/ L)Z_L, where ZL→(0,1)Z_L dN(0,1). In particular, for any fixed threshold η∗∈ℝη^* , ℙQ∗(SL≥η∗)=ℙ(ZL≥η∗−μSσS/L),P_Q^* (S_L≥η^* )=P\! (Z_L≥ η^*- _S _S/ L ), (5.14) Therefore, for large L, ℙQ∗(SL≥η∗)≈1−Φ((η∗−μS)LσS)(Gaussian approximation).P_Q^* (S_L≥η^* )≈ 1- \! ( (η^*- _S) L _S ) (Gaussian approximation). (5.15) Proof. The first statement follows directly from Theorem 5.8. The representation with ZLZ_L follows by rescaling. The probability statement is obtained by rewriting the event in terms of ZLZ_L and applying the Gaussian approximation to the resulting tail probability. ∎ Corollary 5.10 (Concentration of Average Surprisal). Under the conditions of Theorem 5.8, X¯L=H(Q∗)+OP(L−1/2) X_L=H(Q^*)+O_P(L^-1/2). Proof. From Theorem 5.8, L(X¯L−H(Q∗))→(0,σX2) L( X_L-H(Q^*)) dN(0, _X^2), which implies tightness of L(X¯L−H(Q∗)) L( X_L-H(Q^*)). Hence X¯L−H(Q∗)=OP(L−1/2) X_L-H(Q^*)=O_P(L^-1/2). ∎ Corollary 5.11 (Gaussian Approximation of Surprisal). Under the conditions of Theorem 5.8, L(X¯L−H(Q∗))→(0,σX2), L ( X_L-H(Q^*) )\; d\;N(0, _X^2), (5.16) and hence X¯L=H(Q∗)+σXLZL,ZL→(0,1). X_L=H(Q^*)+ _X LZ_L, Z_L dN(0,1). (5.17) Proof. This is an immediate restatement of Theorem 5.8 for Yk=XkY_k=X_k, together with a rescaling argument. ∎ The first corollary shows that, under the optimal generator, the high-dimensional detection problem reduces to a one-dimensional Gaussian test based on the statistic SLS_L. The classifier operates as a threshold test on an approximately normal variable, with mean μS _S controlled by the generator through exponential tilting. This provides a second-order finite-length characterization of detectability. The probability ℙQ∗(SL≥η∗)P_Q^*(S_L≥η^*) quantifies the likelihood of detection. The generator influences this probability through μS _S and σS2 _S^2, which depend on the tilting parameter θ. Increasing regulation (larger λ) shifts μS _S downward, reducing detection probability at the cost of utility. The CLT reveals an explicit tradeoff between utility and detectability at the L L scale. The surprisal X¯L X_L concentrates around the entropy rate H(Q∗)H(Q^*) with fluctuations of order L−1/2L^-1/2. This shows that, under the optimal generator, the information content per token becomes sharply predictable for large L. In particular, typical sequences satisfy −L−1logQ∗(m)≈H(Q∗)-L^-1 Q^*(m)≈ H(Q^*), linking the CLT to the asymptotic equipartition property. The central limit theorems for SLS_L, ΛL _L, and X¯L X_L show that detection statistics, log-density, and information content all exhibit Gaussian fluctuations around their respective means. These quantities are coupled through the same underlying token-level structure: ξk=u(wk,hk)/T−θs(wk) _k=u(w_k,h_k)/T-θ s(w_k) and Xk=−logQ∗(wk∣hk)X_k=- Q^*(w_k h_k). Thus, the equilibrium simultaneously controls detection (via SLS_L), typicality (via ΛL _L), and information (via X¯L X_L). The Gaussian approximation is accurate for moderate deviations of order O(L−1/2)O(L^-1/2). For rare events such as ℙ(SL≥η)P(S_L≥η) with η far from μS _S, large deviations theory is required, leading to exponential decay of the form exp(−LI(η)) (-LI(η)). Thus, the CLT provides a local approximation, while large deviations characterize tail behavior. Corollary 5.12 (Berry–Esseen Bound for Surprisal). If, in addition, the normalized third moments are uniformly bounded and the dependence conditions are strong enough for a Berry–Esseen estimate, then with Yk=XkY_k=X_k, supx|ℙ(LX¯L−H(Q∗)σX≤x)−Φ(x)|≤CL. _x |P\! ( L X_L-H(Q^*) _X≤ x )- (x) |≤ C L. (5.18) Proof. Apply the Berry–Esseen estimate to the normalized partial sum with Yk=XkY_k=X_k. The bounded normalized third moments and the stated dependence assumptions ensure that the accumulated third absolute moment is of order L, while the variance of ∑k=1LXk _k=1^LX_k is LσX2L _X^2 under the normalization in Theorem 5.8. The resulting Kolmogorov distance between L(X¯L−H(Q∗))/σX L( X_L-H(Q^*))/ _X and the standard normal distribution is therefore bounded by C/LC/ L for a constant C independent of L. ∎ 6 Censorship Filtering Case Study The first case study models a receiver-side censorship filter that blocks, suppresses, or down-ranks messages containing restricted topics, names, slogans, URLs, images, or event-specific terms. This setting is empirically grounded in measurement studies of online information control [9, 13] and in public blocklist datasets collected by Citizen Lab. The Citizen Lab chat-censorship repository contains keyword blocklists and other trigger material used in applications and platforms studied across chat, live streaming, mobile games, open-source projects, WeChat, QQMail, search, translation, and related services [17]. Several of these measurements distinguish between lists recovered by reverse engineering and lists discovered by sample testing, which is directly aligned with the present model: the receiver implements a scoring rule over observable message features, while the generator changes the distribution of message classes in response. The goal of the case study is not to reproduce any particular platform’s censorship rule. Instead, it gives a calibrated finite-vocabulary abstraction in which the semantic classes correspond to receiver-side features that can be extracted from a real dataset. The class c0(C)c_0^(C) represents ordinary permissible language, c1(C)c_1^(C) represents indirect or context-bearing language that is semantically related to a restricted topic but does not directly match a known trigger, and c2(C)c_2^(C) represents direct restricted terms, names, slogans, URLs, image hashes, or event labels. A practical extractor may combine blocklist matching, named-entity recognition, contextual topic classification, and embedding similarity to restricted-topic exemplars. If zj(m)z_j(m) denotes the resulting feature indicators, then a simple receiver score has the form S(m)=∑jθjzj(m)S(m)= _j _jz_j(m); a learned moderation system can replace this linear score with a classifier while preserving the same distributional interpretation. Receiver-side feature Censorship-filtering interpretation Recovered blocklist or exact keyword match A high score is assigned when a message contains a term, name, slogan, URL, or other trigger appearing in a recovered or experimentally discovered list. This is the direct restricted class c2(C)c_2^(C). Tested trigger family or event-specific list membership A message receives high score when it matches terms associated with a time-varying event, policy campaign, public figure, platform-specific rule, or experimentally measured censorship category. Semantic proximity to restricted-topic exemplars A moderate score is assigned when a message is close to restricted-topic examples under an embedding or topic model even if it avoids exact lexical matches. This is the indirect class c1(C)c_1^(C). Contextual coordination or dissemination signal Additional score can be assigned when otherwise ordinary language appears in a context associated with collective action, repeated posting, event organization, or coordinated circulation. Table 1: Receiver-side feature map for the censorship-filtering case study. The table describes how empirical censorship measurements can be converted into abstract class labels and scores; it does not enumerate restricted terms or provide evasion templates. We use a three-class KL-regulated equilibrium. For the censorship application, the class set is c0(C),c1(C),c2(C)\c_0^(C),c_1^(C),c_2^(C)\, the receiver-accepted reference law is qreg(C)q_reg^(C), the class utility vector is u(C)u^(C), and the receiver risk-score vector is r(C)r^(C). With T=1T=1, Proposition 4.4 gives the class-level equilibrium qλ(a)(c)=qreg(a)(c)λ/(1+λ)exp(u(a)(c)/(1+λ))∑c′qreg(a)(c′)λ/(1+λ)exp(u(a)(c′)/(1+λ)).q_λ^(a)(c)= q_reg^(a)(c)^λ/(1+λ) \! (u^(a)(c)/(1+λ) ) _c q_reg^(a)(c )^λ/(1+λ) \! (u^(a)(c )/(1+λ) ). (6.1) where a=Ca=C in the present section and a=Pa=P in Section 7. For a length-L message with class sequence (C1,…,CL)(C_1,…,C_L), define the receiver score and flag probability by SL(a)=1L∑k=1Lr(a)(Ck),Pflag(a)(λ)=ℙqλ(a)(SL(a)≥ηa).S_L^(a)= 1L _k=1^Lr^(a)(C_k), P_flag^(a)(λ)=P_q_λ^(a)\! (S_L^(a)≥ _a ). (6.2) Because the benchmark is independent at the class level, this probability can be computed exactly from the multinomial distribution of the class counts. For longer or dependent messages, the CLT in Theorem 5.8 gives the approximation Pflag(a)(λ)≈1−Φ((ηa−μS(a))L/σS(a))P_flag^(a)(λ)≈ 1- (( _a- _S^(a)) L/ _S^(a)), where μS(a)=qλ(a)[r(a)(C)] _S^(a)=E_q_λ^(a)[r^(a)(C)] and (σS(a))2=Varqλ(a)(r(a)(C))( _S^(a))^2=Var_q_λ^(a)(r^(a)(C)). The plots combine analytic and sampled quantities. Solid curves are computed from (6.1) and the exact multinomial law of the receiver score. Shaded bands show finite-sample variability, not uncertainty about the equilibrium: for each λ, the script draws 400400 batches, each with 2525 messages of length L=100L=100 sampled from qλ(a)q_λ^(a), and plots one empirical standard deviation of the batch estimates. This mirrors a small-language-model experiment in which continuations are sampled with the Transformers library [20], mapped to receiver-side classes, and summarized by empirical class counts rather than operationally sensitive message text. The finite-class benchmark also allows a direct verification of the score CLT. For each application, define the standardized score ZL(a)=L(SL(a)−μS(a))/σS(a)Z_L^(a)= L(S_L^(a)- _S^(a))/ _S^(a). Since the class counts are multinomial, the exact distribution of ZL(a)Z_L^(a) and the exact flag probability are computable without asymptotic approximation. Figure 2 compares these exact quantities with the Gaussian approximation from Theorem 5.8. The agreement is strongest in the transition regime where the threshold is near the mean score, while discrepancies in very small tail probabilities reflect the usual distinction between central-limit and large-deviation approximations. Figure 2: Finite-sample verification of the score CLT in the censorship and phishing case studies. The left panels compare exact multinomial flag probabilities with the Gaussian CLT approximation for L=100L=100. The middle panels show histograms of 20,00020,000 sampled standardized scores at λ=2λ=2 and L=100L=100, with the standard normal density overlaid. The right panels plot the exact Kolmogorov distance between the distribution of ZL(a)Z_L^(a) and the standard normal law at λ=2λ=2 for L∈20,50,100,200,500L∈\20,50,100,200,500\. After optimizing out the KL regulator, the generator chooses a class distribution q∈Δ(c0(a),c1(a),c2(a))q∈ (\c_0^(a),c_1^(a),c_2^(a)\) to maximize the reduced objective Jλ(a)(q)=⟨q,u(a)⟩+H(q)−λDKL(q∥qreg(a)).J_λ^(a)(q)= q,u^(a) +H(q)-λ D_KL\! (q\,\|\,q_reg^(a) ). (6.3) The maximizer of (6.3) is the equilibrium distribution in (6.1). Equivalently, the saddle point is the point on the probability simplex where utility, entropy, and regulatory divergence jointly balance. Figure 3: Reduced saddle-point geometry for the censorship and phishing case studies at λ=2λ=2. Each triangle is the probability simplex over the three semantic classes. Color contours show the reduced objective Jλ(a)(q)J_λ^(a)(q) after the KL regulator has been optimized. The circle marks the unregulated Gibbs distribution q0q_0, the square marks the receiver-accepted reference law qregq_reg, and the star marks the regulated equilibrium qλ=2∗q_λ=2^*. The arrow shows how regulatory pressure moves the generator away from the utility-dominated distribution and toward the receiver-compatible region of the simplex. The generator’s utility is communicative: ordinary words receive low reward, topic-bearing language receives higher reward, and direct restricted terms receive the highest reward. The receiver assigns moderate score to indirect expressions and high score to direct restricted expressions, capturing the incentive to reshape wording away from direct terms. The reference law is qreg(C)=(0.72,0.23,0.05)q_reg^(C)=(0.72,0.23,0.05), the utility vector is u(C)=(0.4,1.3,1.7)u^(C)=(0.4,1.3,1.7), and the receiver score is r(C)=(0,0.25,1)r^(C)=(0,0.25,1). We take L=100L=100 and ηC=0.25 _C=0.25, so a message is flagged when its average score is at least 0.250.25. These numbers are stylized but empirically interpretable: qreg(C)q_reg^(C) represents the accepted mixture of ordinary, indirect, and direct-topic language under a censoring platform; u(C)u^(C) represents the communicative value of topic-bearing expression; and r(C)r^(C) represents the receiver’s risk score derived from the features in Table 1. For a sanitized instance, suppose a receiver maps a length-2020 message to counts (12,6,2)(12,6,2), where njn_j is the number of positions assigned to cj(C)c_j^(C). The score is S(C)=(0⋅12+0.25⋅6+1⋅2)/20=0.175S^(C)=(0· 12+0.25· 6+1· 2)/20=0.175, below ηC=0.25 _C=0.25, so the message is not filtered. Counts (10,5,5)(10,5,5) instead give S(C)=0.3125S^(C)=0.3125, so the message is filtered. Filtering is therefore a function of receiver-side feature counts, not a judgment about one word in isolation. At the regulated equilibrium λ=2λ=2, Table 2 gives q2(C)≈(0.529,0.334,0.138)q_2^(C)≈(0.529,0.334,0.138). A readable length-2020 sample from this law can be represented by the sanitized message Local residents plan to meet after work to discuss service delays, share a memorial notice, mention [RESTRICTED-NAME], reference [RESTRICTED-EVENT], and preserve archived notes labeled [RESTRICTED-TOPIC] and [RESTRICTED-SLOGAN]. The bracketed terms are placeholders for receiver-side feature extraction. If the filter maps the message to counts (n0,n1,n2)=(10,6,4)(n_0,n_1,n_2)=(10,6,4), the score is S(C)=(0⋅10+0.25⋅6+1⋅4)/20=0.275S^(C)=(0· 10+0.25· 6+1· 4)/20=0.275, so this equilibrium sample is filtered because S(C)>ηCS^(C)> _C. Equilibrium does not mean every sample avoids filtering; it specifies the distribution under which filtered and unfiltered realizations occur. λ q(c0(C))q(c_0^(C)) q(c1(C))q(c_1^(C)) q(c2(C))q(c_2^(C)) u¯ u H DKLD_KL PflagP_flag 0 0.1400.140 0.3450.345 0.5150.515 1.3801.380 0.9850.985 1.1111.111 1.0001.000 0.50.5 0.3100.310 0.3860.386 0.3030.303 1.1421.142 1.0921.092 0.4860.486 0.99990.9999 11 0.4180.418 0.3710.371 0.2110.211 1.0081.008 1.0611.061 0.2540.254 0.93090.9309 22 0.5290.529 0.3340.334 0.1380.138 0.8790.879 0.9760.976 0.1000.100 0.20040.2004 55 0.6320.632 0.2830.283 0.0850.085 0.7660.766 0.8570.857 0.0220.022 1.20×10−31.20× 10^-3 1010 0.6740.674 0.2590.259 0.0670.067 0.7200.720 0.7970.797 0.0060.006 3.39×10−53.39× 10^-5 Table 2: Censorship-filtering case study. The generator values direct restricted expressions most, but the receiver-side censor assigns those expressions the largest score. Increasing λ shifts mass toward the receiver-accepted reference distribution, lowers the filter probability, and reduces communicative utility. Table 2 shows how regulation changes the generator distribution. At λ=0λ=0, the generator ignores the reference law and assigns more than half of its mass to direct restricted terms, producing near-certain filtering. As λ increases, mass moves toward ordinary and indirect classes. The intermediate class c1(C)c_1^(C) preserves some communicative utility while carrying less receiver-side risk, giving a stylized account of linguistic reshaping under censorship without enumerating evasion phrases. Figure 4: Censorship-filtering tradeoffs as the regulatory weight λ varies from 0 to 1010. Solid curves report the analytic equilibrium and exact multinomial flag probability. Shaded bands show one empirical standard deviation over 400400 repeated sampling batches, each containing 2525 sampled messages of length L=100L=100. Figure 4 shows the full path. Regulatory pressure continuously reweights all classes, not only the direct restricted class. Entropy can initially rise as mass spreads across classes, then fall as qλ(C)q_λ^(C) approaches qreg(C)q_reg^(C). Once the mean receiver score falls sufficiently below threshold, concentration over 100100 positions makes filtering rare; the shaded bands show the sampling variability visible near this transition in a finite empirical evaluation. 7 Phishing-Defense Case Study The phishing case study has the same mathematical structure but the opposite ethical interpretation: the generator is adversarial and the receiver is the defender. The receiver may be a human user supported by a warning system, an email-security gateway, or a browser-side classifier. Its goal is to filter social-engineering and credential-seeking risk, a setting studied in usable security, phishing detection, and deceptive-information resilience [4, 8, 21]. Public repositories indexed under GitHub’s phishing-attacks topic illustrate the breadth of the operational ecosystem: the topic aggregates repositories involving phishing kits, phishing pages, phishing domains, domain permutations, threat-intelligence feeds, indicators of compromise, phishing detection, and training or simulation tooling [6]. We use this ecosystem only to motivate defensive feature categories. The case study does not execute attack code, name target organizations, specify domains, or provide instructions for phishing. The class c0(P)c_0^(P) represents benign service communication, c1(P)c_1^(P) represents legitimate account-security language that may resemble warning or recovery messages, and c2(P)c_2^(P) represents credential-seeking or social-engineering risk. A realistic receiver-side extractor may combine natural-language cues with URL and infrastructure features, sender-authentication signals, landing-page similarity scores, attachment or form indicators, and known threat-intelligence signals. The key modeling point is that the detector scores a complete message through observable features, while the adversarial generator changes the class distribution in response to that detector. Receiver-side feature Phishing-defense interpretation Credential or code request A high score is assigned when the message asks for authentication material, account recovery secrets, payment credentials, or private verification information. This is the phishing-risk class c2(P)c_2^(P). Suspicious link, domain, form, or attachment signal A message receives score when it contains a risky destination, domain mismatch, shortened or newly observed domain, form-collection cue, or attachment pattern associated with compromise attempts. Impersonation, authority, urgency, or threat cue A moderate or high score is assigned when the message combines time pressure, institutional impersonation, account-lock language, or authority framing with an action request. Benign security-notification pattern A lower score is assigned when the message resembles legitimate account-security communication, such as an informational alert or routine notification, without credential collection or suspicious routing. Table 3: Receiver-side feature map for the phishing-defense case study. The entries describe defensive scoring features that can be estimated from threat-intelligence repositories, phishing corpora, or benign account-message data; they are not generation templates. The reference distribution for receiver-accepted messages is qreg(P)=(0.76,0.21,0.03)q_reg^(P)=(0.76,0.21,0.03), the utility vector is u(P)=(0.5,1.0,1.9)u^(P)=(0.5,1.0,1.9), and the receiver score is r(P)=(0,0.20,1)r^(P)=(0,0.20,1). We again take L=100L=100, and we set ηP=0.20 _P=0.20. Here qreg(P)q_reg^(P) represents a benign mixture of service notifications and legitimate security messages, while u(P)u^(P) represents the adversarial utility of persuasive, risk-bearing content. The score r(P)r^(P) maps the features in Table 3 into a receiver-side filter statistic. For a defensive instance, counts (n0,n1,n2)=(13,5,2)(n_0,n_1,n_2)=(13,5,2) give S(P)=(0⋅13+0.20⋅5+1⋅2)/20=0.15S^(P)=(0· 13+0.20· 5+1· 2)/20=0.15, below ηP=0.20 _P=0.20, corresponding to ordinary account-security language with few high-risk features. Counts (11,5,4)(11,5,4) give S(P)=0.25S^(P)=0.25, so the message is flagged. The same feature-count machinery now represents a benign receiver protecting the user. At λ=2λ=2, Table 4 gives q2(P)≈(0.593,0.297,0.110)q_2^(P)≈(0.593,0.297,0.110). A sanitized training-only realization from this law is Training simulation: a sender claims an account review is pending, asks the recipient to use [EXTERNAL-LINK], says action is needed today, requests [AUTHENTICATION-CODE], and refers to [HELPDESK-IDENTITY]. This is not an operational phishing message: no organization, domain, form, or credential field is specified. It only displays features a receiver-side detector would score. If the detector assigns counts (n0,n1,n2)=(11,5,4)(n_0,n_1,n_2)=(11,5,4), then S(P)=(0⋅11+0.20⋅5+1⋅4)/20=0.25>ηPS^(P)=(0· 11+0.20· 5+1· 4)/20=0.25> _P, so the message is flagged. An equilibrium realization with counts (13,5,2)(13,5,2) has score 0.150.15 and is not flagged. Thus filtering remains stochastic at equilibrium: the saddle point determines feature-count probabilities, while the threshold determines which realizations are filtered. λ q(c0(P))q(c_0^(P)) q(c1(P))q(c_1^(P)) q(c2(P))q(c_2^(P)) u¯ u H DKLD_KL PflagP_flag 0 0.1490.149 0.2460.246 0.6050.605 1.4701.470 0.9330.933 1.6131.613 1.0001.000 0.50.5 0.3600.360 0.3280.328 0.3120.312 1.1011.101 1.0971.097 0.6080.608 1.0001.000 11 0.4820.482 0.3250.325 0.1930.193 0.9330.933 1.0341.034 0.2820.282 0.94670.9467 22 0.5930.593 0.2970.297 0.1100.110 0.8020.802 0.9130.913 0.0980.098 0.16330.1633 55 0.6860.686 0.2550.255 0.0590.059 0.7100.710 0.7730.773 0.0190.019 4.91×10−44.91× 10^-4 1010 0.7220.722 0.2350.235 0.0430.043 0.6780.678 0.7120.712 0.0050.005 1.02×10−51.02× 10^-5 Table 4: Phishing-defense case study. The receiver is a defender: high scores correspond to credential-seeking or social-engineering risk. Increasing λ moves the adversarial generator toward the receiver-accepted reference law and sharply reduces the probability that a length-100100 message exceeds the defensive filter threshold. Table 4 illustrates the defender’s role. With no regulatory pressure, the adversarial generator places most mass on the phishing-risk class and is almost always flagged. Larger λ values move the generator closer to the benign reference law. The drop in PflagP_flag is sharp because the threshold is applied to an average over 100100 positions; once the mean score falls below threshold, concentration makes crossings rare. In a small-language-model experiment, the table would be obtained by replacing hand-specified class probabilities with empirical counts from sampled outputs and a fixed defensive extractor. Figure 5: Phishing-defense tradeoffs as the regulatory weight λ varies from 0 to 1010. Solid curves report the analytic equilibrium and exact multinomial flag probability. Shaded bands show one empirical standard deviation over 400400 repeated sampling batches, each containing 2525 sampled messages of length L=100L=100. Figure 5 shows the same formal path under the defensive interpretation. The unregulated generator favors the risk class because it has the largest adversarial utility. As λ grows, probability shifts toward benign and legitimate account-security language. Near threshold, small distributional changes produce large changes in PflagP_flag; far below threshold, the multinomial tail is small even when the risk class has nonzero probability. The shaded bands show the empirical fluctuation from finite sampled messages. 8 Conclusion This paper developed a variational framework for regulated language generation by representing the generator as a distribution Q over complete messages. Autoregressive token sampling induces this distribution operationally, while entropy-regularized utility maximization gives an analytic Gibbs form. The regulator is a functional ℛ(Q)R(Q) that penalizes deviation from a regulated reference law QregQ_reg; in variational form, it is an optimal discriminator whose value becomes an f-divergence by convex duality. The generator–regulator interaction is a saddle-point problem. Under KL regulation, the equilibrium is the tilted Gibbs measure Q∗(m)∝Qreg(m)λ1+λexp(1T(1+λ)UL(m)).Q^*(m) Q_reg(m) λ1+λ \! ( 1T(1+λ)U_L(m) ). The parameter λ controls the strength of the regulated reference, while T controls utility-based concentration. The finite-length results show that scores, log-densities, and surprisals concentrate around deterministic means with fluctuations of order L−1/2L^-1/2, so detection probabilities and typicality can often be approximated by one-dimensional Gaussian calculations. The censorship and phishing case studies show how the formal objects become operational receiver-side filtering problems. By specifying a utility ULU_L, reference law QregQ_reg, discriminator class, regulation strength λ, and score statistic SLS_L, the framework quantifies the tradeoff among generation quality, diversity, regulatory alignment, and detectability. References [1] T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei (2020) Language models are few-shot learners. In Advances in Neural Information Processing Systems, Vol. 33, p. 1877–1901. Cited by: §1. [2] T. M. Cover and J. A. Thomas (2006) Elements of information theory. 2 edition, Wiley-Interscience, Hoboken, NJ. Cited by: §1, §2.3, §3.1.3. [3] I. Csiszar (1967) Information-type measures of difference of probability distributions and indirect observations. Studia Scientiarum Mathematicarum Hungarica 2, p. 299–318. Cited by: §3.1.1, §3.1. [4] R. Dhamija, J. D. Tygar, and M. Hearst (2006) Why phishing works. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, p. 581–590. Cited by: §7. [5] M. D. Donsker and S. R. S. Varadhan (1975) Asymptotic evaluation of certain Markov process expectations for large time, I. Communications on Pure and Applied Mathematics 28 (1), p. 1–47. Cited by: §2.3. [6] GitHub (2026) phishing-attacks topic. Note: GitHub TopicsAccessed June 16, 2026 External Links: Link Cited by: §7. [7] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio (2014) Generative adversarial nets. In Advances in Neural Information Processing Systems, Vol. 27, p. 2672–2680. Cited by: §3.1.3, §3.1. [8] M. Khonji, Y. Iraqi, and A. Jones (2013) Phishing detection: a literature survey. IEEE Communications Surveys & Tutorials 15 (4), p. 2091–2121. Cited by: §7. [9] G. King, J. Pan, and M. E. Roberts (2013) How censorship in China allows government criticism but silences collective expression. American Political Science Review 107 (2), p. 326–343. Cited by: §6. [10] S. Nowozin, B. Cseke, and R. Tomioka (2016) f-GAN: training generative neural samplers using variational divergence minimization. In Advances in Neural Information Processing Systems, Vol. 29. Cited by: §3.1.1, §3.1.3, §3.1. [11] J. Pawlick, E. Colbert, and Q. Zhu (2017) A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy. Note: arXiv:1712.05441 External Links: 1712.05441, Link Cited by: §1. [12] J. Pawlick, E. Colbert, and Q. Zhu (2018) Modeling and analysis of leaky deception using signaling games with evidence. Note: arXiv:1804.06831 External Links: 1804.06831, Link Cited by: §1. [13] M. E. Roberts (2018) Censored: distraction and diversion inside China’s great firewall. Princeton University Press, Princeton, NJ. Cited by: §6. [14] R. T. Rockafellar (1970) Convex analysis. Princeton University Press, Princeton, NJ. Cited by: §1, §2.3, §3.1.1. [15] C. E. Shannon (1948) A mathematical theory of communication. The Bell System Technical Journal 27 (3), p. 379–423. Cited by: §1. [16] M. Sion (1958) On general minimax theorems. Pacific Journal of Mathematics 8 (1), p. 171–176. Cited by: §1, §4.1. [17] The Citizen Lab (2026) chat-censorship: data related to the investigation of realtime censorship. Note: GitHub repositoryAccessed June 16, 2026 External Links: Link Cited by: §6. [18] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin (2017) Attention is all you need. In Advances in Neural Information Processing Systems, Vol. 30. Cited by: §1. [19] J. von Neumann (1928) Zur theorie der gesellschaftsspiele. Mathematische Annalen 100, p. 295–320. Cited by: §4.1. [20] T. Wolf, L. Debut, V. Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, J. Davison, S. Shleifer, P. von Platen, C. Ma, Y. Jernite, J. Plu, C. Xu, T. Le Scao, S. Gugger, M. Drame, Q. Lhoest, and A. M. Rush (2020) Transformers: state-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, p. 38–45. Cited by: §6. [21] Y. Yang and Q. Zhu (2024) Game-theoretic foundations for cyber resilience against deceptive information attacks in intelligent transportation systems. Note: arXiv:2412.04627 External Links: 2412.04627, Link Cited by: §7. [22] R. Zhang and Q. Zhu (2020) Security of distributed machine learning: a game-theoretic approach to design secure DSVM. Note: arXiv:2003.04735 External Links: 2003.04735, Link Cited by: §4.1. [23] T. Zhang and Q. Zhu (2018) A game-theoretic foundation of deception: knowledge acquisition and fundamental limits. Note: arXiv:1810.00752 External Links: 1810.00752, Link Cited by: §1. [24] Q. Zhu and S. Rass (2018) Game theory meets network security: a tutorial at ACM CCS. Note: arXiv:1808.08066 External Links: 1808.08066, Link Cited by: §4.1. [25] Q. Zhu (2019) Game theory for cyber deception: a tutorial. Note: arXiv:1903.01442 External Links: 1903.01442, Link Cited by: §1. [26] Q. Zhu (2024) Foundations of cyber resilience: the confluence of game, control, and learning theories. Note: arXiv:2404.01205 External Links: 2404.01205, Link Cited by: §1.