Agency Problems and Adversarial Bilevel Optimization under Uncertainty and Cyber Threats
Thibaut Mastrolia, Haoze Yan
TL;DR
The paper tackles a continuous‑time principal–agent problem under cyber risk, where a holding company designs incentives for a subsidiary whose cybersecurity investment follows a stochastic SIR‑type contagion model. It treats model uncertainty and adversarial attacks via a robust, bilevel max–min framework, solving the agent’s problem with a 2BSDE with jumps and reformulating the principal’s problem as an integro‑HJBI equation; Perron’s method is extended to handle jumps and ambiguity, yielding a unique viscosity solution. The work provides a principled theoretical link between 2BSDEJs and dynamic principal–agent problems under volatility ambiguity, and applies the framework to a cyber risk management setting with a controlled SIR–price system and L‑hop jump structure, validated numerically with PINNs. Collectively, the approach offers a tractable, rigorous method to design optimal incentives for cyber defense under uncertainty, with potential applicability to other financially‑constrained, risk‑aware, adversarial settings.
Abstract
We study an agency problem between a holding company and its subsidiary, exposed to cyber threats that affect the overall value of the subsidiary. The holding company seeks to design an optimal incentive scheme to mitigate these losses. In response, the subsidiary selects an optimal cybersecurity investment strategy, modeled through a stochastic epidemiological SIR (Susceptible-Infected-Recovered) framework. The cyber threat landscape is captured through an L-hop risk framework with two primary sources of risk: (i) internal risk propagation via the contagion parameters in the SIR model, and (ii) external cyberattacks from a malicious external hacker. The uncertainty and adversarial nature of the hacking lead to consider a robust stochastic control approach that allows for increased volatility and ambiguity induced by cyber incidents. The agency problem is formulated as a max-min bilevel stochastic control problem with accidents. First, we derive the incentive compatibility condition by reducing the subsidiary's optimal response to the solution of a second-order backward stochastic differential equation with jumps. Next, we demonstrate that the principal's problem can be equivalently reformulated as an integro-partial Hamilton-Jacobi-Bellman-Isaacs (HJBI) equation. By extending the stochastic Perron's method to our setting, we show that the value function of the problem is the unique viscosity solution to the resulting integro-partial HJBI equation.