If a fake trap looks exactly like the real thing, how many false alarms can honest users put up with?

This explores whether there is a concrete false-alarm rate trusted users could live with when decoys are made to look exactly like real objects. The corpus gives no number. It does show why the budget can't be chosen independently of how convincing the decoy is, and that is the more useful thing to know.

The core result is a tradeoff. The closer decoys match genuine objects, the smaller the gap between how often legitimate agents use real objects and how often they trip a decoy alarm, and that gap is capped by a total-variation bound What cost does making decoys convincing impose on legitimate users?. Read plainly, that means a perfect decoy makes the false-alert rate equal to the legitimate-use rate. Every real use a trusted agent makes is then as likely to alarm as a decoy touch. So a false-alert budget of, say, 1% would cap legitimate use at about 1% of the interactions where the alarm can fire. That reading is mine, not a figure the note states. If your budget is tight, the decoys can't be perfectly indistinguishable, and any distinguishability you leave in is what your own agents lean on to tell them apart.

Why not just accept perfect indistinguishability and a generous budget? Because leftover differences leak to attackers. If decoys and real objects respond even slightly differently, enough quiet probes that trigger nothing can drive the attacker's classification error toward zero Can repeated quiet probes separate decoys from genuine objects?. Pooling makes it worse: agents who share observations can only get better at telling decoys apart, never worse, so you can't count on hiding decoys from a coordinated group Does sharing observations help coalitions detect decoys better?. The idealized setup assumes independent responses and known or learnable response laws, so it's a worst-case guide rather than a forecast.

The budget also interacts with speed. If probing a decoy can trigger containment, the attacker's problem becomes a race: collect enough observations before being removed, and a finite-sample bound puts a price on that in time How fast must a coalition gather observations before containment?. A stricter alarm trigger makes each probe costlier for the attacker, but it also raises the false-alert bill for your own users. The two sides of the budget are coupled.

Two neighbouring ideas hint at how to spend the budget better, though neither answers the question. One is the practice of comparing detectors at a matched false-positive rate. Cheap difference-of-means vectors and LLM monitors were compared that way, with the false-positive rate fixed first and detection measured second How do cheap vector detectors compare to expensive LLM monitors?. The other is treating a defence unit as a revisable episode of linked actions, with task authority and response history, rather than one isolated event Should defence units span multiple executions and agents?. That could in principle let a lone decoy touch by an authorized agent be judged in context. The corpus doesn't test this for decoys, so it's a direction, not a finding. In short, the corpus tells you the budget is a dial tied to decoy quality, but the number itself would have to come from measuring your own deployment.