user: text: Write a concise one-sentence TLDR summary of the scientific paper content below.

Title: Domain-independent Plan Intervention When Users Unwittingly Facilitate Attacks

Paper content:
In competitive situations, agents may take actions to achieve their goals that unwittingly facilitate an opponent’s goals.
We
consider a domain where three agents operate: (1) a user (human), (2) an attacker (human or a software) agent and (3) an observer (a software) agent.
The user and the attacker compete to achieve different goals.
When there is a disparity in the domain knowledge the user and the attacker possess, the attacker may use the user’s unfamiliarity with the domain to
its advantage and further its own goal.
In this situation, the observer, whose goal is to support the user may need to intervene, and this intervention needs to occur online, on-time and be accurate.
We formalize the online plan intervention problem and propose a solution that uses a decision tree classifier to identify intervention points in situations where agents unwittingly facilitate an opponent’s goal.
We trained a classifier using domain-independent features extracted from the observer’s decision space to evaluate the “criticality” of the current state.
The trained model is then used in an online setting on IPC benchmarks to identify observations that warrant intervention.
Our contributions lay a foundation for further work in the area of deciding when to intervene.
When an agent is executing a plan to achieve some goal, it's progress may be challenged by unforeseen changes such as an unexpected modification to the environment or an adversary subverting the agent's goal.
In these situations, a passive observer intervening to help the agent reach it's intended goal will be beneficial.
Intervention is different from the typical plan recognition problem because we assume the observed agent pursues desirable goals while avoiding undesirable states.
Therefore, the observer must (1) monitor actions/state unobtrusively to predict trajectories of the observed agent (keyhole recognition) and (2) assist the observed agent to safely complete the intended task or block the current step if unsafe.
Consider a user checking email on a computer.
An attacker who wants to steal the user's password makes several approaches: sending an email with a link to a phishing website and sending a PDF file attachment embedded with a keylogger.
The user, despite being unaware of the attacker's plan, would like to complete the task of checking email safely and avoid the attacker's goal.
Through learning, our observer can recognize risky actions the user may execute in the environment and ensure safety.The decision of when to intervene must be made judicially.
Intervening too early may lead to wasted effort chasing down false positives, helpful warnings being ignored as a nuisances, or leaking information for the next attack.
Intervening too late may result in the undesirable state.
Further, we are interested in assisting a human user with different skill levels, who would benefit more from customized intervention.
To this end, we need to identify actions that warrant intervention over three different time horizons: (1) critical action, which if unchecked will definitely trigger the undesirable state, (2) mitigating action, which gives the user some time to react because the threat is not imminent and (3) preventing actions, which allows for long term planning to help the user avoid threats.
Based on the time horizon we are current in, we can then plan to correct course accordingly.
In this work we focus on identifying the first horizon.
Intervention is useful in both online settings, where undesirable states may arrive incrementally and in offline settings where observations are available prior to intervention.In this paper, we model online intervention in a competitive environment where three agents operate: (1) a user (human), (2) an attacker (human or a software) agent and (3) an observer (a software) agent who will intervene the user.
The observer passively monitors the user and the attacker competing to achieve different goals.
The attacker attempts (both actively and passively) to leverage the progress made by a user to achieve its own goal.
The attacker may mask domain knowledge available to the user to expand the attack vector and increase the likelihood of a successfull attack.
The user is pursuing a desirable goal while avoiding undesirable states.
Using domain-independant features, we train a decision tree classifier to help the observer decide whether to intervene.
A variation of the relaxed plan graph BID0 ) models the desirable, undesirable and neutral states that are reachable at different depths.
From the graph, we extract several domain independent features: risk, desirability, distances remaining to desirable goal and undesirable states and active landmarks percentage.We train a classifier to recognize an observation as a intervention point and evaluate the learned model on previously unseen observation traces to assess the accuracy.
Furthermore, the domain independent features used in the classifier offer a mechanism to explain why the intervention occurred.
In real-time, making the decision to intervene for each observation may be costly.
We examine how the observer can establish a wait time without compromising accuracy.The contributions of this paper include: (1) formalizing the online intervention problem as an intervention graph that extends the planning graph, (2) introducing domainindependent features that estimate the criticality of the current state to cause a known undesirable state, (3) presenting an approach that learns to classify an observation as intervention or not, (4) incorporating salient features that are better predictors of intervention to generate explanations, and (5) showing this approach works well with benchmarks.
We focus on two questions: (1) Using domain-independent features indicative of the likelihood to reach G u from current state, can the intervening agent correctly interrupt to prevent the user from reaching G u ?
and (2) If the user was not interrupted now, how can we establish a wait time until the intervention occurred before G u ?
To address the first question, we evaluated the performance of the learned model to predict intervention on previously unseen problems.The experiment suit consists of the two example domains from Section 2.
To this we added Navigator and Ferry domains from IPC benchmarks.
In Navigator domain, an agent simply moves from one point in grid to another goal destination.
In the Ferry domain, a single ferry moves cars between different locations.
To simulate intervention in active attacker case (the Block-Words domain), we chose word building problems.
The words user and the attacker want to build are different but they have some common letters (e.g., TAD/BAD).
The attacker is able to exploit the user's progress on stacking blocks to complete word the attacker wants to build.
In Easy-IPC and Navigator domains, we designated certain locations on the grid as traps.
The goal of the robot is to navigate to a specific point on the grid safely.
In the Ferry domain a port is compromised and a ferry carrying a car there results in an undesirable state.
The ferry's objective is to transport cars to specified locations without passing a compromised port.In addition to the trained data set, we also generated 3 separate instances of 20 problems each (total of 60) for the benchmark domains to produce testing data for the learned model.
The three instances contained intervention problems that were different the trained instances.
For example, number of blocks in the domain (block-words), size of grid (navigator, easy-ipc), accessible and inaccessible paths on the grid (navigator, easy-ipc), properties of artifacts in the grid (easy-ipc).
For each instance we generated 10 observation traces for each planning problem (i.e., 200 observation traces per instance).
We define true-positive as the classifier correctly predicting "Y".
True-negative is an instance where the classifier correctly predicts "N".
False-positives are instances where classifier incorrectly predicts an observation as an interrupt.
False-negatives are instances where the classifier incorrectly predicts the observation not as an interrupt.

assistant: text: We introduce a machine learning model that uses domain-independent features to estimate the criticality of the current state to cause a known undesirable state.