What happens to emergence when the environment starts fighting back? Craig Reynolds' boids showed that three local rules (separation, alignment and cohesion) could produce flocking of startling realism. But the boids moved through a passive world. Obstacles did not anticipate their trajectories, and nothing learned from their regularities. Most swarm robotics has quietly inherited this assumption. The environment is a set of constraints to satisfy, not an agent with intentions of its own. The collective problem is coordination, not competition.

Replace that passive environment with a second swarm and the problem changes character. The opposing collective observes, adapts and exploits. The regularities that make emergent behavior elegant become attack surfaces: predictable alignment, consistent spacing, stable consensus. A rule that produces graceful cohesion around obstacles may produce catastrophic clustering against an adversary that understands it. Robustness against nature and robustness against intelligence turn out to be different properties. The second is considerably harder to achieve.

Game theory offers the natural vocabulary: strategies, payoffs, information sets and equilibria. Yet classical game theory assumes a few players reasoning globally. Swarms comprise many agents acting on local information with bounded computation, and that tension defines the field. What follows examines three arenas where it plays out: pursuit and evasion, defensive formations, and strategic signaling. In each, the question is how equilibrium reasoning can be compiled into rules simple enough for individual robots to execute.

Pursuit-evasion is the oldest adversarial problem in robotics. Rufus Isaacs formalized it in the 1950s and 60s through differential games such as the homicidal chauffeur and the lion and man. The canonical solution technique is the Hamilton-Jacobi-Isaacs equation, a partial differential equation whose solution is a value function over the joint state space. Its zero level set separates states where capture is guaranteed from states where escape is possible. For two agents in the plane, this is tractable. For twenty, it is hopeless.

The difficulty is dimensional. The joint state grows linearly with agent count, but grid-based solutions of the HJI equation scale exponentially in that dimension. Swarm approaches therefore abandon the global value function in favor of geometric decompositions. The most elegant is Voronoi-based pursuit. The domain is partitioned by proximity, and each pursuer adjacent to the evader moves to shrink the area of the evader's Voronoi cell. With equal speeds in a bounded convex region, this decentralized policy provably guarantees capture.

What makes this a swarm strategy rather than a coordinated plan is that no pursuer computes the others' actions. Each follows the local gradient of a shared geometric quantity, and the collective outcome follows because that quantity decreases monotonically. The evader's cell behaves like a Lyapunov function for the entire game. For evaders, the analysis inverts, and whether to aggregate or disperse depends on capture mechanics. Against pursuers who must commit to individual targets, density produces confusion. Against area-denial pursuers, dispersal wins.

For many-on-many encounters, a second decomposition has proven effective. Researchers working on reach-avoid games, including Claire Tomlin's group, solve small subgames exactly, such as one pursuer against one evader or two against one. They then assemble a global strategy through bipartite matching. If a pursuer can guarantee capturing a particular evader in the pairwise game, that pairing becomes an edge in the matching graph. The resulting assignment sacrifices optimality but preserves soundness. Any capture the matching certifies is a capture that actually occurs.

The pattern across these methods is instructive. Optimal collective policies are rarely computed directly. Instead, they are assembled from local invariants such as cell areas, pairwise dominance regions and conservative assignments. These invariants guarantee the outcome without requiring any agent to understand the whole game. Equilibrium reasoning happens offline, in the analysis. Online, robots simply descend gradients. This is emergence with a proof attached, and it suggests that the bridge between game theory and swarms is often geometry.

Takeaway

In adversarial swarms, the global strategy is rarely computed. It is guaranteed by a local quantity that every agent can measure and that can only move in one direction.

Defense inverts the structure of pursuit. Rather than capturing a mobile target, defenders must prevent attackers from reaching a protected region or asset. The relevant formalisms include target-attacker-defender games and perimeter defense, where defenders often move along a boundary while attackers approach from outside. The defender's question is fundamentally minimax: which configuration maximizes the worst-case outcome against every possible attacker strategy? Expected performance against typical attacks is irrelevant if an intelligent opponent can find the configuration's weakness.

The central tool is the dominance region. For a given defender and speed ratio, one can compute the set of attacker positions from which that defender can guarantee interception before the attacker reaches the perimeter. Protection then becomes a covering problem. If the defenders' dominance regions together contain every possible attacker approach, the asset is safe regardless of what the attacker does. This is coverage control with game-theoretic cells replacing Euclidean ones, and the speed ratio warps their geometry substantially.

Guarantees of this kind are clean for single attackers, and they weaken as attackers multiply. A coordinated attacking swarm can attempt saturation, arriving simultaneously at multiple points so that each defender faces more threats than it can intercept. The defense problem then becomes combinatorial, requiring defenders to be assigned to attackers under time constraints. Provable guarantees shift from no attacker succeeds to bounds on how many can leak through. These bounds typically depend on defender count, speed ratio and arrival geometry.

Determinism is itself a vulnerability. A formation that is both optimal and fixed is also predictable, and Stackelberg security games formalize why. The defender commits to a strategy, the attacker observes it, and the attacker best-responds. The optimal commitment is frequently a mixed strategy, meaning a probability distribution over configurations or patrol routes. This framework has guided real deployments in airport and infrastructure security. For swarms, it suggests randomized local rules whose overall configurations vary unpredictably while still guaranteeing coverage.

Here the tension with emergence becomes sharp. Formations arising from local rules are robust to agent loss but typically offer statistical rather than worst-case guarantees. Game-theoretically optimal formations offer worst-case guarantees but are brittle when an agent fails, since a single gap may be exactly what the attacker needs. Promising work bridges the two using control barrier functions. These encode coverage constraints as forward-invariant sets that local controllers preserve. The formation can then reorganize after losses without abandoning its proof.

Takeaway

A defense is only as strong as its worst configuration against its smartest opponent. That is why the most protective formation is often the one an adversary cannot predict.

Every swarm communicates, whether or not it intends to. Explicit messages can be intercepted, and behavior is also a signal. Because of alignment rules, the swarm's collective heading reveals its intent. Density gradients reveal where it values coverage, and response latencies reveal sensing range. An adversary observing motion is effectively decoding a message. This reframes swarm behavior as a problem of information revelation. It is best modeled by Bayesian games in which each side holds private information about its type, capability or objective.

When should a swarm reveal information? Sometimes revelation helps. Deterrence depends on credibly signaling strength, and signaling theory from Spence and Zahavi shows that credibility requires cost. A signal that weak swarms cannot afford to mimic separates the strong from the weak. Cheap talk is another matter. Crawford and Sobel showed that costless communication carries information only when interests are sufficiently aligned. In strictly zero-sum encounters, costless messages convey nothing in equilibrium, so adversarial information must travel through costly actions.

Deception follows the same logic. Decoys, feints and false formations work only because they cost the adversary something to investigate. Their value depends critically on the opponent's sophistication. Against a naive adversary that takes observations at face value, deception can produce large gains. Against a fully Bayesian adversary that knows the deceiver's strategy, deception collapses into a mixed equilibrium where signals are partially informative. Such opponents cannot be systematically fooled, but they can be forced to hedge, and hedging spreads their resources thin.

Swarms add distinctive structure. Deception can be distributed. A subset of agents can act as sacrificial decoys, accepting individual loss to improve the collective payoff, a tradeoff impossible for a single robot. Swarms are also vulnerable to deception from within. A few infiltrating agents can steer consensus and alignment protocols. Byzantine-resilient algorithms such as W-MSR defend against this by bounding how many adversarial neighbors each agent can tolerate. Internal communication improves coordination, but it also enlarges the surface an adversary can read or corrupt.

Taken together, these results suggest when deception improves collective outcomes. It pays when the adversary's observations are limited or its model of the swarm is wrong. It also pays when costs are asymmetric, with cheap decoys forcing expensive responses. It pays less against well-informed, well-resourced opponents. The most intriguing possibility is emergent deception. Each agent's local randomization means nothing on its own, but together it creates collective ambiguity. The swarm deceives without any single agent intending to.

Takeaway

Against a rational adversary, deception rarely creates false belief. What it reliably creates is uncertainty, and uncertainty is expensive for whoever must respond to it.

Across pursuit, defense and signaling, a common pattern appears. Equilibrium reasoning is too expensive for individual robots to perform online, so it must be performed in advance and compiled into local rules. Examples include gradients on Voronoi cells, invariant sets around perimeters, and randomized behaviors tuned to deny information.

This changes what it means to design emergent behavior. In cooperative settings, the question is whether local rules produce the desired pattern. In adversarial settings, the question is whether that pattern survives an opponent who understands the rules. Elegance is no longer sufficient. The emergent behavior must also be unexploitable, or exploitable only at a cost the adversary cannot afford.

Reynolds showed that simple rules could generate complex coordination. Adversarial swarms ask a harder question: can simple rules generate coordination that holds up when the environment itself is thinking? The emerging answer is yes, provided each local rule carries a guarantee about the collective quantity it protects.