Adaptive Circumvention Red Team¶

Adversarial team — instantiates Migration-Resistant Hazard Control

Plays the motivated adversary against a control to find how it will be evaded and which under-defended destination the blocked pressure will be pushed toward.

An Adaptive Circumvention Red Team is a group tasked with defeating a control the way a real, motivated adversary would — not to check that it meets a spec, but to discover how it will be routed around once it is live. Its distinguishing contribution in this archetype is that it models an adaptive opponent: it does not merely find a hole, it finds the next hole after the obvious one is closed, and it identifies the soft destination the blocked pressure will flow toward. Where a fault tree assumes fixed failure modes and a monitor watches the field after the fact, the red team is the one mechanism here that generates the reroute before deployment by actively trying to cause it — turning "the control passed testing" into "here is how it will be circumvented, and here is where the harm will land."

Example¶

A platform's trust-and-safety team stands up a red team before rolling out a filter that blocks a category of harmful posts. Rather than score the filter on a fixed test set, the team plays the motivated adversary. Within a day they slip the keyword filter with deliberate misspellings and look-alike characters; they move the same content into images and memes the text filter never inspects; and — the finding that matters most here — they migrate wholesale to the platform's least-moderated surface, private groups, where enforcement is thinnest. That last move is the point: the filter did not remove the behaviour, it taught it where the soft destination was. The red team's deliverable is a ranked list of circumvention routes and, at the top of it, the under-defended destination the content will flow to — precisely what a static test of the filter's accuracy would have certified as safe.

How it works¶

Adopt the adversary's objective, not the tester's checklist. The team is judged on whether it can still achieve the harmful goal, which surfaces reroutes a compliance test never prompts.
Attack the control and the map around it. It probes not just the barrier but where the blocked pressure goes, ranking candidate destinations by how weakly they are defended.
Iterate against adaptation. Because a real adversary learns, the team runs more than once, treating each closed hole as the setup for the next move.
Report routes and destinations, not pass/fail. The output is the set of circumvention paths and the soft target at the end of them, handed to whoever must close it.

Tuning parameters¶

Adversary model — how capable, resourced, and motivated the assumed opponent is. Set it too weak and the exercise blesses the control; too strong and every control looks hopeless.
Rules of engagement — what is in scope to attack. Narrow scope keeps the exercise safe but can fence off the very reroute that matters.
Independence — how separate the team is from the control's owners. Low independence yields a tame red team that steers around embarrassing findings.
Cadence — one-shot before launch or a standing capability. Adaptive threats erode a one-shot result; continuous probing tracks a moving target.
Disclosure protocol — how findings are handled and who is obliged to act. Findings with no owner become theatre.

When it helps, and when it misleads¶

Its strength is that it is the only mechanism here that models an adaptive opponent — it finds the circumvention route and the soft destination that static causal and fault-tree models, which assume fixed behaviour, declare impossible. It converts a hypothetical reroute into a demonstrated one, before the field pays for it.

Its failure mode is that a red team is bounded by its own creativity: what it does not think of, it implicitly certifies as safe, and its findings are existence proofs, never a clean bill of health. Its classic misuses are the tame team quietly steered away from the damaging finding, and the theatrical exercise run to bless a decision already made rather than to break it. The discipline is genuine independence, a real incentive to succeed at breaking the control, and a standing obligation to act on what is found — the same behavioural adaptation the team simulates is what risk homeostasis predicts real users will do once the control is live.^[1]

How it implements the components¶

adaptive_circumvention_monitor — the team's findings on how the control will be evaded over successive moves are what an ongoing circumvention watch is built from and calibrated against.
destination_vulnerability_map — by attacking as the adversary would, it reveals and ranks the under-defended destinations the hazard will be pushed toward.

It does not build the static causal or failure models it stress-tests — those are Causal Loop Diagram and Fault Tree Analysis — nor does it measure whether displacement actually occurred in the field, which is Before–After–Elsewhere Evaluation.

Instantiates: Migration-Resistant Hazard Control — the red team supplies the demonstrated reroutes and soft destinations the control must be hardened against.
Consumes: Fault Tree Analysis and Causal Loop Diagram — the transfer paths and loops it treats as hypotheses to break rather than to trust.
Sibling mechanisms: Fault Tree Analysis · Before–After–Elsewhere Evaluation · Causal Loop Diagram · Mass Balance · Hazard Analysis · Whole-System Impact Map · Agent-Based Experiment or Simulation · System-Wide Net-Risk Dashboard · Boundary Expansion Review · Cross-Boundary Hazard Ledger · Cross-Jurisdiction Incident Review · Intervention Displacement Stress Test · Migration Sentinel Network · Pressure-Absorption Redesign Workshop · Source-Reduction or Safe-Dissipation Plan

References¶

[1] Risk homeostasis (Gerald Wilde) is the hypothesis that people adjust their behaviour toward a target level of risk, partly offsetting a safety improvement by acting more boldly once it is in place — a behavioural version of the same "the pressure re-expresses itself" problem a circumvention red team probes for. ↩