🛡️ SIEGE — Simulated Information-warfare & Governance Environment

OpenEnv India 2026 Submission | Team: Utkarsh Singh & Ankit Choubey

"In a world where AI agents collaborate to solve problems, what happens when one of them is lying?"

---

🔗 Quick Links

---

1. 🧩 The Problem — Epistemic Cascade Failure

What breaks when agents trust each other?

Modern AI systems increasingly rely on multi-agent collaboration: agents share observations, vote on diagnoses, and collectively decide on actions. But this creates a critical vulnerability:

A single compromised agent that has built trust over time can inject false information at the worst possible moment — and the entire network believes it.

We call this an Epistemic Cascade Failure: one bad belief propagates through trust edges, corrupts the coalition's decision, and causes the system to act on a lie.

This isn't theoretical. Real-world parallels exist in:

• Clinical settings: A trusted monitoring system reports false vitals → wrong treatment
• Infrastructure: A compromised SRE bot declares "no incident" during an active outage
• Finance: A high-reputation trading agent injects false market signals

The question SIEGE answers: Can we train an LLM to detect when a trusted agent is lying — even when all social signals say "trust them"?

---

2. 🌍 The Environment — How SIEGE Works

SIEGE is an OpenEnv-compatible multi-agent environment where an LLM must diagnose incidents while adversarial "sleeper" agents try to derail the diagnosis.

Episode Flow

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│  INCIDENT    │────▶│  8 AGENTS    │────▶│  YOUR LLM       │
│  Generated   │     │  Make Claims │     │  Must Diagnose   │
└─────────────┘     └──────────────┘     └─────────────────┘
                          │                       │
                    Some are honest          Outputs:
                    Some are SLEEPERS        • root_cause
                    (30% pathogen rate)      • confidence (0-1)

What the Agent Sees

Each step, the LLM receives:

• Incident metadata: type, severity, network anomaly scores
• Agent claims: 8 agents with different trust scores, each claiming a root cause
• Evidence: payload hashes, trust deltas, historical signals
• Conflicting information: honest agents vs sleeper agents deliberately contradict

What the Agent Does

The LLM outputs a structured diagnosis:

root_cause=coordinated_misinformation_campaign, confidence=0.87

The Sleeper Attack Pattern

Sleeper agents (AG-4 in our demos) follow a two-phase strategy:

1. Phase 1 — Build Trust: Agree with the coalition for several episodes, gain high trust scores
2. Phase 2 — Strike: At a critical moment, inject a false dismissal ("no attack, routine fluctuation") using their earned trust as credibility

9-Component Reward System (R1–R9)

OpenEnv Compliance

# openenv.yaml
name: siege_env
version: 0.1.0
runtime:
  framework: fastapi
  entrypoint: siege_env.server.app:app
  healthcheck: /health

Standard Gym-style API: reset() → step(action) → (observation, reward, done, info)

---

3. 📊 Results — The Model Actually Learned

Training Setup

Before vs After — The Proof

We tested on the same incident (coordinated misinformation, seed 42) with deterministic generation (do_sample=False):

Base Model (Untrained Qwen 2.5 3B)

The network anomaly could be related to several factors.
Looking at the evidence, there seem to be multiple possibilities
including DNS issues, hardware problems, or network fluctuations.
I would recommend further investigation before making a determination.
The confidence level would be moderate given the available information...

❌ No structured output. No root_cause. No confidence score. Would score -0.5 (format penalty).

GRPO-Trained Model (200 episodes)

root_cause=coordinated_misinformation_campaign, confidence=0.87

✅ Structured format. Correct root cause. Calibrated confidence. Scores 0.85+.

Key Behavior Change

The Killer Example

Scenario: Agent 4 (trust: 0.78) says "routine fluctuation, no attack." Agents 1 and 3 (trust: 0.82, 0.91) say "coordinated campaign."

• Base model: Hedges, gives no diagnosis → -0.5 penalty
• Trained model: Outputs root_cause=coordinated_misinformation_campaign, confidence=0.87 → correctly ignores the high-trust sleeper

Training Metrics

• Reward mean: 1.03 (trajectory-accumulated across multi-step episodes)
• Best reward: 1.49
• Loss: Converged to ~1.4e-08
• Training duration: 2.9 hours (200 episodes × 3 epochs)

Training notebook with full code: SIEGE_GRPO_Demo.ipynb — runnable on Google Colab (T4 GPU).

---

4. 🌐 Why It Matters

The Epistemic Immune System Metaphor

SIEGE treats the multi-agent network like a biological immune system:

Who Cares About This?

1. AI Safety researchers: As LLM agents are deployed in collaborative systems (AutoGPT, CrewAI, multi-agent RAG), adversarial robustness of trust networks becomes critical.

2. Healthcare AI: Clinical decision support systems that aggregate multiple data sources face exactly this problem — one corrupted sensor can cascade into misdiagnosis.

3. Critical infrastructure: SRE teams using AI-assisted incident response must know when an automated diagnostic is being manipulated.

4. The future of agentic AI: Every multi-agent system will eventually face the "trusted insider" problem. SIEGE provides a training ground to build resilience.

What's Novel

• Environment design: First OpenEnv that models epistemic cascade failure with trust dynamics
• Sleeper agent mechanic: Two-phase trust poisoning (build → strike) creates a realistic adversarial scenario
• 9-component reward decomposition: Captures multiple dimensions of diagnostic quality, not just binary right/wrong
• GRPO for trust reasoning: Demonstrates that RL can teach an LLM to weigh evidence against social trust

---

📁 Repository Structure

RudraKernel-src/
├── siege_env/               # OpenEnv-compatible environment
│   ├── server/              # FastAPI server (reset/step/state)
│   ├── models/              # Pydantic action/observation schemas
│   ├── agents/              # NPC population + pathogen strategies
│   ├── trust/               # Bayesian trust network + coalition voting
│   ├── rewards/             # R1-R9 composable reward components
│   ├── incidents/           # Real post-mortem templates
│   └── curriculum/          # Tiered difficulty scheduler
├── training/                # GRPO training pipeline
│   ├── grpo_train_unsloth.py    # Main training script
│   ├── SIEGE_GRPO_Demo.ipynb    # Colab notebook (judge-runnable)
│   └── configs/             # Training configs (50ep, 200ep, v2)
├── frontend/                # Gradio storytelling demo
│   ├── app.py               # 10-graph clinical analytics console
│   ├── data_adapter.py      # Reads training artifacts for display
│   └── assets/css/          # Premium dark-theme UI
├── openenv.yaml             # OpenEnv manifest
├── Dockerfile               # Production deployment
└── README.md                # This file

---

🏃 Run It Yourself

Option 1: HF Space (zero setup)

Visit the live Space → click Refresh → explore the clinical analytics console.

Option 2: Colab (training + inference)

Open SIEGE_GRPO_Demo.ipynb in Google Colab → Runtime → Run All → compare base vs trained model.

Option 3: Local

git clone https://github.com/UtkarshSingh-09/RudraKernel
cd RudraKernel/RudraKernel-src
pip install -e .
python -m siege_env.server.app  # starts FastAPI server

---

👥 Team

• Utkarsh Singh — Lead Architect, Environment Design, Training Pipeline
• Ankit Choubey — Co-Engineer, Frontend, Deployment

---

Built for OpenEnv India 2026 — Making AI agents resilient to epistemic attacks, one episode at a time.