Time‐critical decentralised situational awareness in emergencies: an adversarial biosecurity scenario

Introduction The main goal in a crisis in undoubtedly its effective and timely resolution. However, in the modern interconnected and complex world it is often the case that the parties involved for a crisis’ resolution have significantly different perceptions of the situation at hand. This can be for a number of reasons, pertinent to the nature of the crisis as well as to the responsive mechanisms in place to face it. In addition, this intricate systemic complexity renders large-scale, unprecedented threats increasingly likely (Taleb 2007). Biosecurity threats consist of a class of crises of massive impact where expert knowledge does not always coincide with the situational awareness of the officials in the first Abstract

lines of response. With past instances of dispatched weaponised agents against a naive population (Wein et al. 2003;Alibek 2008;Kaszeta 2020) up to recent examples of malevolent cybersecurity infiltration on essential infrastructure (The New York Times 2021), the imminence of biosecurity threats is increasingly becoming a tangible liability. Furthermore, statistical analysis on past adversarial events classified as terrorist attacks testifies to a likely periodical time horizon in which they can be anticipated (Clauset et al. 2013). More broadly, along with cybersecurity threats excessively large-scale ones being specified as increasingly recurring (Flyvbjerg 2020), it is imperative to have emergency and effective response mechanisms readily deployable.
In this context, momentum was gained after the US 9/11 attacks on biosecurity attacks with the seminal work of Wein, Craft and Kaplan in 2003 on a hypothetical Anthrax airbourne point delivery in an urban environment. This modelled various scenarios on the impact of the attack and the corresponding response mechanisms (Wein et al. 2003). Further, biosecurity topics have occupied instances of the vast epidemics literature inasmuch social behavioural implications are involved in mitigating adversarial biological attacks in the general population (Del Valle et al. 2005). Notwithstanding, the attention on the matter culminated with the multiagent model of Carley et al. published in 2006 and modelling a wide range of social and economic factors, which contribute to the spread and mitigation of maliciously introduced diseases in urban centres. The novelty of the work lay especially in the network and agent behavioural patterns availing themselves to the formulation of tracking and surveillance protocols by policy makers.
Within the time-criticality context, previous work has established methods and limitations of mobilisation mechanisms to unequivocally detect targets (Rutherford et al. 2013a, b). This would be the first step to activate a network of response mechanisms in a coordinated fashion against a globally distributed biosecurity threat, i.e. clarifying the mechanisms' situational awareness. Nevertheless, the mechanisms (essentially administrators), being human and systemic, are not infallible, are characterised by bounded rationality and often exhibit biases and delays in the realisation of a crisis, ranging from the individual to the collective level (Simon 1956;Kahneman 1971, 1974;Pescetelli et al. 2016;Rosenberg et al. 2016).
Aiming to tackle this situational awareness dilemma encumbering policy makers, with this work we aspire to provide a computational framework modelling the range of the corresponding perceived dangers on behalf of policy making organisations and their executive branches, as dynamical individual and collective cognitive processes. We assume that the organisations in question are spatially distributed in different urban settings but each one forms their own social network, not necessarily belonging in the same environment [akin to a multilayer representation (Kivelä et al. 2014;Strano et al. 2015)]. The behavioural insight of the work constitutes a first step towards preparing in a coordinated fashion for biological attacks but also more broadly for attacks or threats of an unexpected nature (Madnick 2020). Lastly, it is noteworthy that the cognitive problem we are tackling has recently drawn increased attention from the epidemics community (Granell et al. 2013(Granell et al. , 2014Agaba et al. 2017), signifying its importance across disciplines. Bassett et al. Appl Netw Sci (2021) 6:59 Methods For the purpose of our study we formulated an agent-based model of discrete time distributed over 18 cells representing urban metropolitan areas, from here onwards to be referred to as cities. The constraint was to choose urban agglomerations with a metropolitan population of at least 10 7 (Citypopulation 2021) but otherwise the selection was such as to introduce a small global urban ecosystem for illustrative purposes and accounts for the flexibility of the model (the list of cities can be found in Table 1 of the Appendix). The agents themselves represent policy-making organisations and affiliated branches with a vital role in the response to biosecurity threats. We assumed that the number of agents within each city was proportional to the population of the city and that the number of the total agents was 1000 (see Table 1 in the Appendix for an overview of the scaling factor's effect on the population). For this latter figure, to the extent of our knowledge, there does not exist any specific single dataset, tailored to explicitly substantiate it and as such remains an educated guess. As we will see in the following however, these agents-organisations form an information exchange network and can therefore be regarded under a transnational scope. In this sense and drawing from Vitali and Battiston's work on the global corporate network, we can expect to be at least in the right order of magnitude, assuming a 1:43 ratio of organisations encumbered with emergency responses to biological attacks against the 43,060 transnational corporations in the dataset of the aforementioned authors (Vitali and Battiston 2014). The agents do not act in isolation, rather form a network of information exchange on situational awareness of biologically related dangers for each and every one of the network's cities. Therefore, each agent (node of the network) has a situational awareness for 18 locations-cities. We do not take any agent mobility into account, ergo, the network is static. Simultaneously the agents make personal measurements within their own city (i.e. with the information locally available), which they then jointly assess with the available (social) information from their network. In this way a dynamical process takes place with which the agents make a final personal judgment for the current degree of danger in their own locale and in every other city. A minimal, invented example of three cities (New York City, Karachi and Shanghai) with their agent-agencies' social information network as well as a snapshot of the underlying processes is illustrated in Fig. 1, while in the inlet between the main figure and the colour code scale lies an abstraction of the upper.

Agent network
For the connectivity of the network, which determines the strength of influence in the aforementioned dynamical process, we examined three of the prototype networks (empirical networks are beyond the scope of this work), namely the Erdős-Rényi (ER) (Erdős and Rényi 1960;Newman 2018), the small-world introduced by Watts and Strogatz (WS) (Newman 2018;Watts and Strogatz 1988) and the preferential attachment one generated by the Barabási-Albert (BA) model (Newman 2018;Barabási and Albert 1999). A constraint that we set for all three of the networks was that they have the same average edge density ρ over 100 realisations. Consequently and with 1000 nodes in each network this constraint narrowed the range of possibilities for different topologies to a single set of control parameters for each network, 1 so that �ρ� ≈ 1000 . We summarise the values for each case in the following: Crisis response agents-agencies (numbered) reside in each of the three urban landscapes New York City, Karachi and Shanghai forming a static, social communication network (dashed lines). In each city there is a level of true danger (TD) with values ranging from zero ("no danger") to one ("highest danger"). We match this numerical range with a colour code ranging from green to red respectively and select three arbitrary colour values from that range for illustrative purposes. Each agent makes their estimation for their own urban environment and all others in the system, which is delineated by the triplets corresponding to each of them. Inlet: An abstraction of the five agents' network, with their underlying colour being the true danger of the city in which they are located • ER connection probability: p ER = 2 × 10 −3 . • WS: nearest-neighbours k WS = 2 and rewiring probability p WS = 0.5. • BA: edges to attach from a new node to existing ones: k BA = 999 or k BA = 1 (single hub-topology and cliques respectively).
Note that for k BA = 1 we retrieve the same density as k BA = 999 . The difference lies in the topology. In the first case all nodes are connected to a single one, while in the latter several nodes share the property of being a hub, distributing (unevenly in general) the amount of attached nodes among each other.

Danger perceived by agents
Based on previous work demonstrating the distinction between personal and social components forming perceptions (Pescetelli et al.2016), we define two mechanisms dynamically determining an agent's perception of a given danger. In particular, these mechanisms are dependent either on the information available to the agent at hand or to the information conveyed through their network of acquaintances. Hence, we set the dynamical progression for each agent to be with PD i,t+1 denoting the perceived danger of an agent i at time t + 1 , f a vector function mapping a given true danger TD x,i,t+1 of city x where agent i resides at time t to a personal estimation (e.g. by measurement) for the true danger by the agent, and g a vector function mapping the perceived danger of agent i and that of every other agent j = i to an overall influence for the danger value exerted on agent i at time t. The boldface font marks a vector with components being the perceived danger values of the agent in question for every city. Thus for 18 cities in the system, every agent i has 18 perceptions of danger and consequently there are 18 corresponding values of the true danger for every time step t. Both PD as well as TD take values in [0, 1], hence assuming two extremes of a danger degree, where 0 stands for complete lack of danger and 1 for total danger (the maximum degree). A special note needs to be made for the time indices of the two terms in (1). The personal estimation term is happening at the time of updating the perceived danger (thus introducing time-criticality to the personal assessment task via the latest local information available), while the influence is coming from the exact previous time step due to a minimal time lag in communications and cognitive processing. Lastly, the "Mean" in (1) refers to the arithmetic average (coinciding with the median since we are referring to two arithmetic quantities). However, its purpose is to introduce a measure of coestimation of the personal estimation and influence quantities and can therefore assume in principle any other plausible form, introducing, for instance, bias. We will consider only an unbiased estimation here.

Personal estimations
In the absence of data for the scope of our study, we simulate the personal measurement function f with draws from a number of plausible representational probability distributions, while the influence function g from established influence models. Firstly and for the personal estimation we set f to draw a random variable X from the triangular distribution, the Gaussian, the Laplacian and a power-law for every time step, parametrised by TD x,i,t (the locally available information) as follows: 1 Triangular: Tr(X; a, mode, b) = Tr(X; 0, TD x,i,t , 1) . As such the agent makes a personal estimation of the true danger for every city x with information about the true danger in their city of residence serving as the mode of the distribution. 2 Gaussian: |N (X; µ, σ )| = |N (X; TD x,i,t , 1)| . In this case, the agent's personal estimation for every city x is drawn from an absolute valued Gaussian, centered on the true danger of the agent's city of residence and with a scale parameter being the maximum possible fluctuation for the danger estimation they can have. If values are drawn beyond 1, then we assume that the agent made a far-fetched personal estimation of the danger and therefore uniformly, randomly assign to this estimation the extreme value of either 0 or 1. 3 Laplacian: |L(X; µ, b)| = |L(X; TD x,i,t , 1)| . The personal estimation in this instance is similar to the case of the Gaussian estimation in terms of the location and scale parameter of the distribution, as well as for the assigned values in case of draws beyond 1. The sole difference lies in the form of the distribution (pronounced center and fat tails). 4 Power-law: P(X; a) = P(X; TD x,i,t ) . For this case, the agent's personal estimate follows a power-law distribution of the form αX α−1 with α = TD x,i,t ∈ (0, 1] in the role of the exponent. In case of a zero value of the true danger, then the personal estimate is also set to zero. The rationale for the selection of the previously mentioned distributions is to examine a broad range of generative personal estimations of the danger degree via a single measurement (in the context of time-criticality), in a reference time and given only local information for an arbitrary population. The selection is by no means exclusive and its ultimate justification could come from some data proxy (e.g. by means of lexicographical analyses on social media platforms (Zhang et al. 2020;Aiello et al. 2020)].

Social influence
It is by now well understood that in a social environment, a personal view on a topic is not just based on personal estimations (e.g. via measurements) rather is weighed against the range of other views held on the same topic by the corresponding social network (Sherif et al. 1965). The phenomenon is called social judgment and is a major driver in the established literature of influence models (Flache et al. 2017).
In this context and in regard to the information exchange mechanism among the agents about the true danger in the various cities, we utilise three models from the social dynamics literature to represent the coupling in the danger estimation among agents in different cities. In particular, the one due to Friedkin and Johnson (F-J) accounting for assimilative social influence (consensus) (Flache et al. 2017;Friedkin and Johnsen1990), the one due to Deffuant and collaborators accounting for embracement of opinions with a selective bias (the emergence of fractions) (Flache et al. 2017;Deffuant et al. 2000), and the one due to Jager and Amblard (J-A) accounting for a repelling effect to persuasive views beyond a certain threshold (polarisation) (Flache et al. 2017;Jager and Amblard 2005). With an adjusted form of these models we formulate the g function in the dynamic perceived danger relation (1). The exact form of each model as utilised is as follows: 1. F-J: where 0 < µ ≤ 1 is the rate of opinion convergence (we chose µ = 0.5 ), D 1/2 the distance matrix with inverse entries for all non-zero elements and w i,j is a weight of opinion importance ascribed to an agent's network. We assume this weight to be subject to the constraint j w i,j = 1, ∀i . We generate the weights from a uniform random distribution in [0, 1) and normalise them. Note that the boldface (vector notation) applies to the weights as well, since each agent's perceived danger involves all the 18 cities in the simulation.

Deffuant:
with the weight function being The quantity ǫ (we choose ǫ = 0.2 ) is simply the tolerance up to which a danger estimation other than that of the agent in question (i) will influence them (in this case 0 < µ ≤ 0.5 and we select µ = 0.5 again). Beyond that tolerance they simply ignores different estimates. 3. J-A: This is as the Deffuant model but the weight function assumes the form Thus, the agent can be persuaded of the danger estimation of a peer up to a certain tolerance. Beyond that however, instead of ignoring the estimation of the other agent as in the Deffuant model the agent is thrown to the other side of the spectrum in respect to that estimation. For example, a moderately high estimation of danger by a peer will be in this case interpreted by the (influenced) agent as a moderately low danger. (2)

True danger progression
Finally, for the true danger degree value's evolution with time in a particular city we can use any arbitrary function to represent it. Indeed, following the example of Wein et al. on a point air-delivery of Anthrax (Wein et al. 2003) we have built in our model various functions with which the impact of danger can progress. This need not necessarily be decaying. Our purpose here is to unveil the interplay between the perceived danger, the social influence and the actual magnitude of a given danger so there is no reason to use anything overly elaborate or to exhaust all the possible underlying true danger progression possibilities in a sensitivity analysis. Therefore, we will assume two cases: firstly, one typical of an epidemic spread (SIR) of highly endemic conditions (Kermack and McKendrick 1927; Keeling and Rohani 2011) and secondly, a linearly decaying danger. Specifically, the second assumes that the true danger within a city decays (e.g. because the authorities intervened for its mitigation and the projected deaths or hospitalisations decrease) in a linear fashion with time down to a zero value at a specified point. The first merely identifies the danger with the normalised infectious class of the SIR model. These two approaches do not forbid the usage of any other function with which the true danger evolves, including periodic or increasing.

Results
The implementation of the simulation was executed in Python 3.8, in which the packages NetworkX 2.4 and NumPy 1.18.5 were employed. The simulation code as well as that to generate the graphs presented in this work can be found at https:// github. com/ Yperi dis/ Threa tPerc eption. The initial conditions for relation (1), i.e. the initial perceived dangers for each agent, were determined by a draw from a triangular distribution with extremities 0 and 1 and mode the initial danger of the agent's city of residence.

Citywide metrics
Although the simulation can probe at the individual level of an agent, for the evolution of danger and the associated processes we aggregate the agents over cities. In this way we can have an overview of all the danger processes at the scale of urban environments, while concurrently averaging the danger perceptions of individual outliers. Moreover, although the model enables us to predict the perceived danger for every city included in the simulation, for illustrative reasons we will focus on the collective perceptions of two arbitrarily chosen cities, Shanghai and Karachi, for one of the two (Shanghai). The initial danger in each is set to be T TD,in,Sh = 0.5 and T TD,in,Ka = 0.9 and the time at which the danger vanishes T TD,null,Sh = 80 and T TD,null,Ka = 90 for a total runtime of 100 time steps.
In Figs. 2 and 3 we present two cases of evolution of the true danger for Shanghai, one for the danger representing the normalised population of the infectious class of an SIR model and one for linear decay of the danger respectively. In the same graphs we overlay the aggregate danger perceptions of Shanghai's agents and those of Karachi for each of the two instances of the true danger progressions for the city of Shanghai. The results to the times where the MSE attained its minimum value. In both a and b the exact corresponding times are inscribed. The horizontal, blue line segments demarcate the true danger (SIR) of Shanghai for the referenced times. ER topology and F-J influence assumed examine each case of personal estimation (columns) and influence model (rows) as outlined in the section of methods. Each time-series was averaged over ten runs to lessen stochastic effects. We have also inscribed in every plot the mean squared error (MSE) of each time-series between the actual danger in Shanghai and the average perceived danger of its agents, i.e. that of the solid and dashed blue time-series lines.
The most striking result seems to be the minimal effect of the influence models on the perceived danger and hence of the network architecture (see Appendix for the formation of the perceived danger). Secondly and according to the MSE values, there is a ranking among the different personal estimation methods, with the power-law outperforming all of them. Second is the triangular distribution method, third the Laplace and the worst performance is exhibited by the Gaussian.

Individual agent metrics
We so far explored the collective perceived danger at the city level under a certain range of personal estimations and influence models. We would now wish to refer to the accuracy of individual agents within a single city, leading to their collective estimation of danger in it. One way of representing this accuracy is by distributing the perceived dangers of the agents around the true value for selected times, so as to estimate the maximum and minimum perceived danger deviations from the real value. The box plots of Figs. 4 and 5 do exactly this for the city of Shanghai, sticking to our example. We choose the F-J influence model and ER topology for the demonstration but the result is robust across any constant influence model and topology.
As the agents' perceptions are dynamical processes we can only study their dispersion around a mean and the true value at a snapshot. Two meaningful points in time to do this are when the MSE of the agents aggregated over Shanghai assume their maximum and minimum values. This is what is depicted in panels (a) and (b) of Figs. 4 and 5 respectively. Incidentally, one can notice the same ranking among the methods, regardless of the corresponding MSE value, as observed in the time-series of Figs. 2 and 3.

Discussion
We have presented the results of a purely computational spatially distributed agent-based model emulating cognitive formation processes in estimating a threat parameter of varying degree under time pressure (uncertainty), limited information and social influence. The context of the threat was of a biological nature and assuming its release in urban environments. The utility of the model lies in its capacity to provide behavioural insight for a broad range of intertwined individual estimation biases of agents based on local information and their drifts due to peer pressure from their underlying social network.
Although only alluded in the presentation so far, the model can be regarded as a multilayer network with its different layers representing the agent and the city networks, as well as the corresponding processes taking place on them (perceived and true dangers respectively). This alternative way of representation offers a summary overview of aggregate measures in an integrated framework and has a rich presence in the literature (Kivelä et al. 2014;Strano et al. 2015;De Domenico et al. 2013. It would be especially useful if the true danger processes of one city would be coupled to those of other cities. The model appears to be robust to the influence among its agents, meaning that across the different opinion dynamics' models and studied topologies the results remain largely unaltered for the presented accuracy. This is not an obvious finding and the explanation lies in a better understanding of the mechanism dictated by the governing equation (1). As witnessed in Figs. 2, 3, 5 and 4 the personal estimation of the agents appears to be the pivotal force driving the perceived danger, which is the first term of the dynamic relation (1). The second term, which is the social influence, serves as an interference on the measurement taking place at the time of the danger's perception. Thus, with a lag of one time step, the agents average their current personal estimation (a measurement for example) with the collective perceived danger of their network. This mechanism determines their final danger perception (see also the Appendix on the perceived danger perception). However, we expect that the initial, spatial agent opinion distribution, combined with non-standard [e.g. core-periphery (Rombach et al. 2014)] or empirical network architectures connecting agents of diverse, non-cancelling opinions at the city level and between different cities (when looking at aggregate measures) would reveal a more significant effect of the influence term.
Reducing the system size to a total of 50 agents with the given heterogeneities (see the city populations in Table 1 in the Appendix) did not introduce any significant effects on the influence term across different topologies and models. Hence the role of the influence is to provide a regression to the mean of the agents' perceived danger on the previous time step. Basically this implicates the effect of a lag in forming the perception of a danger on a given time. However, as the literature indicates (Flache et al. 2017), there are many ways to tune the opinion thresholds ǫ on the selective bias (Deffuant) and repelling (J-A) models, as well as the rates of convergence µ across all models so as to amplify the effect of the social interference to the personal estimation. The limits of these effects would be an interesting addition to the results so far, belonging to a sensitivity analysis.

Formation of perceived danger
As alluded to in the main text, the influence is posited to average the exaggerated personal estimation of the running time step in regard to the influence of the previous one. Due to the initialisation of influence and the dominance of the personal estimation term as per relation (1), the effect of influence (and thus the effect of the network) on the perceived danger formation of any agent is significantly different than the personal estimation only on the first time step. This effect is exhibited in Fig. 6 for an arbitrarily chosen topology (ER) and influence model (F-J), for illustrative purposes, for the city of Shanghai (case of linearly decaying underling real danger). The perceived danger (blue solid curve) results as an average of the personal estimations of all the agents of Shanghai for Shanghai (orange dashed curve) and of the average influence exerted on them by each of their social networks (green dashed-dotted curve) for all the combinations of different  6 The evolution curves of the perceived danger (solid blue) for Shanghai, averaged over all its agents, along with its component curves of personal estimations (dashed orange) and influence (dashed-dotted green) for the underlying danger being the normalised infectious class of an SIR model. The columns from left to right correspond to a different method of personal estimation. The topology is ER and the influence model the F-J. Averaged results over 10 realisations. The SIR infectious parameters are infectious transmission k = 1.5 and recovery time τ = 5 days/time steps ( R o = 7.5 for highly endemic conditions). The initial conditions are (S, I, R)| t=0 = (1 − I t=0 , I t=0 , 0) personal estimation methods. Equivalently said, the three curves represent the perceived danger as an average of the personal estimation and the influence on a "super agent" representing all the agents in the city of Shanghai. Given that the columns of the panels in Fig. 6 reflect a different personal estimation method, the trends draw similarities to those across the columns of the panels of Figs. 2 and 3, while providing an explanation for their particular form.