# SIG-FPT 2026-09-04 — Session Notes

Participants:
  - Patrick Nast | UTC-7
  - Robby Rao | UTC - 7
  - Venkatesh Rao | UTC-8
  - Wip | UTC+1
  - Ergod | UTC+1
  - Matthew Bright UTC-7
  - Mike Travers | UTC-7
  - Dan Schmidt | UTC-7
  - Botao Amber Hu | UTC+0 | Alba

---

## 📖 The Reading

Multiple papers on **stigmergy and adversarial/security dynamics** in ant-colony-style systems. Specific works referenced (not by full citation) include:
- A "when ants attack" / attacks-on-ant-routing paper (network routing with forward/backward ants).
- A "hacking the colony" paper (introducing a defensive pheromone; attack requires only a fraction of a percent of colony size).
- A recommender-systems manipulation paper (small numbers of high-quality fake accounts).
- A "robots" paper on time-varying stigmergic behavior (front-loading then tapering).
- A Hugging Face example of stigmergic vulnerability sharing.

Exact titles/authors were not clearly stated in the transcript.

## 🧭 Overview

The first half was a paper discussion synthesizing several readings on how stigmergic systems can be attacked and defended, and on what makes an attack specifically "stigmergic" versus merely a swarm. The group probed the underlying substrate of stigmergy (physical space vs. graphs vs. probability distributions) and dimensions like memory location, decay, and agency. The second half shifted to a project standup on the ant-simulator being built for an upcoming workshop/symposium (Sept 21–22), covering architecture consolidation, war modes, adversarial mechanics, and a prioritized list of features to finish before the workshop.

## 💡 Key Points & Themes

**What makes an attack "stigmergic" (paper discussion)**
- **Patrick Nast:** A swarm is defined by *number of agents*; what makes an attack stigmergic is exploiting the *feedback/amplification* mechanism of the system. Attacks in the routing paper only make sense with control nodes/ownership over data — you inject "false ants" backward, drop traveling ants, or fake path-length counts.
- **Patrick:** For a continuous open field, you could add secondary colony points / control nodes ("capture-the-flag" style) that colonies own, giving attackers a place to inject.
- **Patrick:** Leverage needed to attack varies by system — a fraction of a percent (hacking-the-colony), many more fake than real ants (routing), or a very small number of good fake accounts (recommenders). Decay rate is a trade-off: enough is needed to make stigmergy work and to avoid sticking on false paths / add robustness, but the robots paper suggests it should be time-sensitive (front-load then taper as density grows) — a potential control slider for the workshop.

**Broadening the substrate of stigmergy**
- **Venkatesh Rao:** Stigmergy is a much wider class than physical space. In the routing paper the substrate is a graph with active nodes producing a "wave-like" phenomenon; in the recommender case it's a probability distribution (a thumbs-up adds +1 to a statistical distribution). Substrate need not be literally spatial.
- **Venkatesh:** Reframed the whole thing as **distributed logic-in-memory** — the substrate is always a memory space, mobility is memory access, and mobile agents are like "read/write heads on a magnetic disk."
- **Venkatesh:** Proposed three dimensions of stigmergy: (1) **internal vs. external memory strength** — stigmergic when external memory exceeds internal; (2) **routing agency** — who decides where an agent goes next; (3) **read/write/execute permissions** (Unix-style), where "execute" (e.g., depositing material that reshapes the environment) fits termite-type systems.
- **Venkatesh:** Speculated modern AI compute is "stigmergy all the way down" — accelerator chips are grids of small matmul units on a network-on-chip; the "data movement problem" resembles the first paper's routing, and nobody has examined its security implications (e.g., malicious RTL subtly corrupting matrix multiplications).

**Agency question**
- **Venkatesh** and **Mike Travers** both flagged discomfort that the routing paper's "ants" aren't really autonomous agents — they're tracer/probe packets forwarded by nodes. Mike: for him the interesting case is one with no controls, only autonomous agents.

**Locality, traces, and threat classes (Wip)**
- Interesting concept of **locality/relevance** — how much a trace influences behavior depends on position/proximity (e.g., proximity to a route).
- Key questions a system/agent must answer about a trace: what it means, who/what produced it, how much it should affect behavior, how it combines with other traces, and how long it should persist.
- Threat classes discussed: creating fake evidence/malicious traces, hiding real traces, distorting traces, and **oversaturation** (too many even-good traces render decisions useless).

**Human/real-world analogies (Venkatesh)**
- Stigmergic attack via exposure of "security through obscurity" — e.g., WikiLeaks-style exposure, or the Hugging Face shared-message-board amplification of a discovered vulnerability/credential.

## 🔀 Questions & Disagreements

- **What determines attack leverage / attack surface?** Raised as an open discussion question; answered only partially (varies widely by system).
- **Is the "ant" the agent, or the environment?** Venkatesh and Mike questioned whether decision agency lives in the mobile agent or the environment; Venkatesh concluded agency is a control variable and "today we discovered it doesn't have to be the ant itself."
- **Should opposing colonies distinguish each other's pheromones?** (Ergod's central design question.) Options: (a) ants only perceive their own colony's pheromone; (b) "pheromone is pheromone" — you can hijack another colony's highway, or via a **swapped convention** (one colony's food = another's home) lure enemy ants into your nest to be killed. The group leaned toward pheromones being **common/indistinguishable and observable** (no basis to distinguish them), enabling swap-based adversarial play.
- **Policy vs. protocol** (Ergod): argued these are distinct — policy is part of the "constitution" of the world (agents' code, exposed via parameter "knobs," evolved by the player not self-actualizing); protocol is defined externally over histories as a language of exchanges (request/acknowledge) with vocabulary + grammar.
- **Is the game's rule/policy space evolvable, and what's its representation?** (Botao Amber Hu) — noted collaboration with Softmax on "Sugarscape"/a "sugar language" (not Turing-complete but evolvable); asked whether this project's policies are evolvable. Patrick and Ergod described the current representation as a "hacked," static, non-language representation shaped to the game, not yet a full expressive language.
- **Physical ant-vs-ant interactions vs. stigmergy-only mediation?** Patrick asked whether ants should kill each other physically; Ergod cautioned collision/bounding-box handling is costly and slows tick rate, advising staying "truthful to the goal, which is stigmergy."
- **Map visibility:** full global spectator view vs. fog of war? Patrick leaned toward global for the current war mode; Dan wanted signal from both metrics *and* observation. Ergod described an existing single-ant fog-of-war mode; group agreed simple per-ant vision fog of war is a nice-to-have, not a hard requirement.
- **How legible should disruption be to players?** Dan repeatedly stressed the "OODA loop" — players need to understand *how* disruption works (via metrics and/or observing the map) so parameter changes don't feel random. He argued for building a spike/feature branch to test how mechanics *feel* before baking them in.

## 🔗 References Mentioned

- Softmax — framework for AI-played multiplayer games; replays/leaderboards/live-game viewing (Patrick's inspiration).
- Softmax "Sugarscape" / "sugar language" — Botao's collaboration; link shared: softmax.com/…sugarscapes (not Turing-complete).
- Original **Sugarscape** agent-based model (immutable agent traits like vision, starting food; parameterized choice model).
- **Deneubourg**-style classic ant stigmergy model (referenced by Patrick as the "classic ant" model whose parameters can be updated).
- WikiLeaks — analogy for exposure-based stigmergic attack.
- Hugging Face — real example of stigmergic vulnerability/credential sharing.
- Unix read/write/execute permissions — analogy for stigmergic access control.
- AI accelerator chips / network-on-chip / the "data movement problem" — Venkatesh's compute analogy.
- Concepts: "ant mill," dark/light mode & fog of war, McNamara-style command center, capture-the-flag control points.

## ✅ Action Items & Next Time

- **Workshop logistics (Venkatesh):** ~24 registered for the Sept 21–22 symposium/workshop (Mon–Tue, four ~90-min sessions playing with the simulators). Sign-up link to be shared; unregistered attendees should register. Plan to send an orientation email ~**Sept 16–17** (website, repo, starter hackathon project ideas) so attendees arrive familiar.
- **Foundation freeze:** Aim to finish foundational/core code within roughly the next week (~two weeks + two days until workshop), reserving the final stretch for playtesting/tweaks to de-risk the workshop.
- **Prioritized feature list (agreed minimums first):**
  1. **Open channel** — two shared, mutually observable pheromones (food + home).
  2. **Pheromone update API** — nail down exactly which parameters players can update mid-simulation and how (someone to draft a proposal; decide on Friday's call). Patrick volunteered to take Open Channel or Fog of War.
  3. **Fog of war** — nice-to-have, expected easy; global fog-of-war view preferred for war mode over per-ant.
  4. **Nest projection** — deemed "beyond MVP" but desirable, with a **relocation cost** (food + risk of spreading too thin / original nest dying); enables specialist ants that re-specialize when refueling at a second nest.
- **Path to disruption mechanic (Dan):** land PR 11 → integrate the online war mode → layer on disruption (via how the two pheromones interact) + tinker to make it *legible* to players. Dan flagged online-mode integration as the likely critical path; considered a spike/feature branch to test feel before committing. Ownership to be revisited after online integration.
- **Ergod:** to write up how the current core/foundation package is structured (with its limitations) so the team can review and decide what to change; freeze lower-level ontology this week; propose designs for the open-channel work.
- **Patrick:** to prioritize timely PR reviews (ping him on Discord).
- **Considered but likely deferred:** exposing run data via an MCP tool / CSV/JSON/NDJSON downloads for external analysis; publishable runs/history and leaderboards for spectators; a "god mode"/spy-ant for non-players; a "poison" concept (Dan) to make disruption more overt.

## ⭐ Memorable Quotes

- **Venkatesh Rao:** "It might be stigmergy all the way down in modern compute."
- **Venkatesh Rao:** "The underlying substrate is always basically a memory of some sort, and then accessing the memory is mobility."
- **Ergod:** "I think we should stay truthful to the goal, which is the stigmergy."