Robust Trust

Preserve the supplied title, complete author list, citation, and canonical URL when technically practicable.

> Machine-readable author manuscript.
> Authors: Piotr Dworczak; Alex Smolin.
> Canonical citation: Dworczak, Piotr, and Alex Smolin. “Robust Trust.” Working paper, 2026.
> Attribution and provenance: https://alexsmolin.com/corpus/PROVENANCE.txt


Robust Trust

# Robust Trust

**Authors:** Piotr Dworczak; Alex Smolin

**Manuscript date:** 2026-03-19

#### Abstract

An agent chooses an action based on her private information and a recommendation from an informed but potentially misaligned adviser. With a known probability, the adviser truthfully reports his signal; with the remaining probability, he can send any message. We characterize optimal robust decision rules that maximize the agent's worst-case expected payoff. Every optimal rule is equivalent to a trust-region policy in belief space: the adviser's reported beliefs are taken at face value if they fall within the trust region but are otherwise clipped to the trust region's boundary. We derive alignment thresholds above which advice is strictly valuable and fully characterize the solution in both binary-state and binary-action environments.

Keywords: robustness, information design, misalignment, human-AI interactions.
JEL Codes: C72, D81, D83

[^0]


Robust Trust

## 1 Introduction

Modern AI systems increasingly influence decisions with large and sometimes irreversible consequences, including autonomous driving, medical triage, hiring, and credit or security screening (see, e.g., Maslej et al. (2025)). Their appeal is straightforward: they can synthesize information at scale and provide recommendations that exceed unaided human performance in many tasks. The central risk is also well-recognized: when a system is opaque, complex, and trained or deployed under imperfect objectives, users may not be able to tell whether a recommendation is merely noisy, systematically biased, or actively harmful. The misalignment problem is a particularly serious concern in high-stakes environments, and its mitigation is key to ensuring the safe adoption of AI-aided decision making (see, e.g., Russell (2019)).

In this paper, we study how a decision-maker should use AI when the system may be misaligned. Taking the AI's information structure and an exogenous alignment probability as given, we characterize the optimal robust decision rule that maximizes the decision-maker's payoff under the assumption of worst-case AI behavior in case of misalignment.

Our model features an agent who chooses an action under uncertainty about the state of the world. The agent has access to a private signal reflecting her expertise or contextual information, but she can additionally rely on reports from an adviser. The adviser observes complementary information about the state and sends a message to the agent.

Crucially, the adviser is aligned and reports his information truthfully only with some known alignment probability. With the remaining probability, the adviser is misaligned and can send an arbitrary message. In practice, AI misalignment could take several distinct forms with ambiguous implications for the agent's decision (see, e.g., Amodei et al. (2016)). We therefore adopt a robust approach: we assume that the agent is not willing to make any assumptions about the behavior of the misaligned adviser and hence chooses a policy that maximizes her expected payoff guarantee across all possible forms of misalignment. In the model, this is conceptualized as the misaligned adviser attempting to minimize the agent's payoff. We emphasize, however, that the robust optimality criterion reflects the inability to rule out any output of the misaligned AI, rather than a direct concern that misaligned AI is actively adversarial.

Our main structural result shows that the optimal robust policy can be summarized by a single, interpretable object that we call the "trust region." The trust region is a connected set of reported beliefs about the state that the agent takes at face value. When the adviser's reported belief falls inside this region, the agent behaves as if the adviser were truthful: she combines the reported belief with her private information using Bayes' rule and chooses the corresponding Bayes-optimal action. When the reported belief lies outside the trust region, the agent replaces it with the "closest safe interpretation" (formalized by the notion of Bregman distance), which is a belief lying on the boundary of the trust region; she then behaves as if that belief had been reported. Operationally, this is an endogenous form of clipping: moderate recommendations are followed while extreme recommendations are discounted and converted into boundary recommendations that the agent is still willing to accept.

Intuitively, if the agent reacted sharply to extreme reports, the misaligned adviser could exploit that sensitivity to induce large losses. The robust policy responds by limiting how far any recommendation can push behavior. The trust region identifies exactly which recommendations are safe to act upon without additional skepticism, and the boundary mapping formalizes how skepticism should be applied outside that set. On one extreme, a trust region equal to the entire belief simplex corresponds to applying the Bayes-optimal response to all reports; on the other extreme, a trust region only containing the prior belief corresponds to ignoring the adviser's reports. Thus, the shape and size of the trust region yield a disciplined answer to a practical design question: when an AI system outputs highly confident or highly unusual recommendations, optimal robust use requires treating those outputs as "too informative to be trusted" and translating them into safer boundary inputs before acting.

An implication of the characterization is that the optimal robust action rule used by the agent must be defensible as optimal for some coherent set of beliefs about the state of the world-the agent never benefits from distorted use of her own private information. An optimal robust rule simply restricts the set of Bayes-optimal action rules that the agent uses. A further consequence is that implementing the optimal trust region policy does not require commitment. Under mild technical assumptions, we prove a minimax theorem which
implies existence of a trust region equilibrium in the zero-sum game between the agent and the misaligned adviser. In a trust region equilibrium, the agent's policy and the misaligned adviser's strategy form a saddle point: after every on-path report, the agent's response is Bayes-optimal given the belief induced by the adviser's strategy, and the misaligned adviser's strategy minimizes the agent's expected payoff. Substantively, this means that robust optimal behavior provides the same payoff guarantee that the agent could obtain had she perfectly known the misaligned adviser's strategy. Practically, this result provides a certification tool: to verify that a proposed policy is optimal, it suffices to exhibit a corresponding adversarial reporting strategy that makes that policy a best response at every recommendation.


Robust Trust

We then ask when consulting a potentially misaligned adviser is worthwhile for the agent. We formalize this question by examining "minimal viable alignment", defined as the threshold alignment probability above which the agent can guarantee a strictly higher payoff than the one she could achieve by only relying on her own information. We derive sharp bounds on this threshold that depend only on the richness of the state space and the adviser's signal distribution. As long as information is useful to the agent, alignment probability exceeding half is sufficient for the agent to benefit from the presence of the adviser. This bound is tight in binary-state problems. In multidimensional settings, however, minimal viable alignment can be much lower-in some cases as low as the reciprocal of the number of states. Thus, when the state space is rich, AI advice can be robustly valuable even when alignment is very unlikely.

Our general characterization becomes particularly sharp when the state space is binary, so that the ground truth is whether a given statement is true or false. In this setting, an adviser's message can be summarized by the implied probability of the statement being true. The trust region is an interval containing the prior belief. Recommendations inside the interval are trusted and acted upon as reported. Recommendations outside the interval are mapped into the nearest endpoint. The misaligned adviser sends messages that push the induced belief to the endpoint that is most harmful for the agent. This structure delivers a sharp phase transition. If the alignment probability is below one half, the optimal interval collapses to the prior belief and the agent ignores the adviser. If the alignment probability is above one half and the agent's decision problem is sufficiently rich in the sense that every
piece of information is valuable, there is a unique trust interval. This interval expands monotonically with alignment, approaching full trust as the alignment probability approaches one. In addition, we show that the location of the trust region-whether it is skewed towards high or low beliefs-depends on the relative curvature of the agent's indirect utility function. That curvature can be interpreted as a measure of sensitivity of the agent's optimal action to information.

Our characterization also yields a closed-form solution when the agent's downstream choice is binary (e.g., to accept or reject an application) and the agent has no private information. In such problems, the optimal robust use of advice is generically all-or-nothing: either the trust region is the entire belief simplex or it collapses to the prior belief. Which regime obtains is determined by an alignment threshold that depends only on the relative value of the adviser's information across the two actions. In particular, if the alignment probability is below one half, the agent cannot robustly benefit from the presence of the adviser.

Finally, we examine environments where uncertainty concerns many possible states and actions. Here, the geometry of the trust region plays a major role: some directions of belief change are far more consequential than others because they trigger actions whose payoffs are highly sensitive to the true state. In a robust solution, the misaligned adviser chooses recommendations that are farthest from the truth within the trusted set in an incentive-based sense, again formalized by Bregman distance. In general, the trust region may have a complex shape, for example, it need not be convex. In symmetric environments, however, the trust region inherits the symmetry of incentives and information and can be tractably characterized.

The primary application of our framework is the AI alignment problem; in Section 4.1, we develop a parametric example to illustrate how recommendations from an AI system should be combined with human expertise in applications such as medical triage. However, our model is general, and could be applied in other contexts where the information source is not fully trusted. For example, our framework can be seen as a theory of behavioral belief updating, in which the decision-maker wants to ensure some degree of protection against potential misspecification; from this perspective, our main result provides a robust-optimality foundation for the phenomenon known as "extreme-belief aversion" (see Benjamin (2019) for a review of the experimental evidence and Whitmeyer (2026) for a related theoretical
framework). The assumption that the misaligned adviser attempts to minimize the agent's payoff could also be interpreted literally in some contexts, such as when messages exchanged between two allies can be intercepted and manipulated by an adversary.


Robust Trust

### 1.1 Literature review

Our model is closely related to two foundational models in information economics: the cheap talk model (Crawford and Sobel (1982)) and the Bayesian-persuasion model (Kamenica and Gentzkow (2011)). Relative to the cheap-talk model, our framework effectively assumes that the Sender maximizes the Receiver's utility with some probability $\alpha$ and minimizes the Receiver's utility with the complementary probability $1-\alpha .{ }^{1}$ Our characterization of trust region equilibria shows that equilibrium behavior is very different from that arising in the more standard constant-bias case; in particular, information transmission is perfect for intermediate beliefs of the Sender but completely blocked for extreme beliefs. Relative to the Bayesian-persuasion model, due to the minimax theorem which we prove in our setting, our framework is equivalent to the case in which the Sender tries to minimize the Receiver's payoff but is committed to revealing his signal truthfully with probability $\alpha$. One of our contributions is to provide a characterization of threshold levels of $\alpha$ above which the adversarial Sender cannot prevent the Receiver from learning some information.

More recently, several papers in information economics have studied models in which the Sender is truthful-or committed to an information structure-with some probability, but may otherwise send fake or manipulated messages. To the best of our knowledge, this literature did not consider the case that is central to our AI-alignment motivation: a misaligned Sender who is adversarial and seeks to minimize the Receiver's payoff. Instead, the misaligned Sender is modeled as having known and often state-independent preferences. Lipnowski, Ravid, and Shishkin (2022) and Min (2021) study settings in which the Sender is committed to an information structure with some probability and sends a cheap-talk message otherwise. Glazer, Herrera, and Perry (2020) and Lahr and Winkelmann (2019) analyze communication games where some senders are truthful and others have state-independent preferences, such as

[^1]pushing the Receiver's beliefs upward. Alonso and Padró i Miquel (2025) model competitive capture of public opinion by assuming that informative signals about a binary state may be manipulated (i.e., replaced by an arbitrary message) by two opposed "interested parties," one of which wants the induced beliefs to be as high as possible and the other one as low as possible. They characterize a communication equilibrium in which citizens correctly update beliefs given the equilibrium strategies of the interested parties. Interestingly, the structure of their communication equilibria shares similarities with our trust region equilibria in the special case of a binary state: messages in some intermediate interval are interpreted at face value, while messages outside of that interval induce beliefs at the endpoints of the interval.

Our modeling of uncertainty about the behavior of the adviser is inspired by the classical Hurwicz criterion, also known as the alpha-max-min approach (Hurwicz (1951)), under which the decision-maker maximizes a weighted sum of her best-case and worst-case payoffs. We interpret $\alpha$ as the probability of alignment. A similar criterion has recently been applied in the context of information design by Dworczak and Pavan (2022).

The version of our model in which the agent does not have private information is related to the delegation literature in that the agent effectively chooses which decisions to delegate to an informed adviser. Within that literature, the closest paper is Frankel (2014) who adopts a worst-case approach with respect to the adviser's preferences, assumed to lie in a known set. More recently, Alonso, Gan, and Hu (2026) show optimality of convex delegation sets under max-min preferences when the principal only knows the agent's preferred action in every state, but not the exact shape of the agent's quasi-concave utility function. Our setting differs both in primitives and in methods: we require robustness to the adviser's behavior in case of misalignment and the resulting optimization problem has a different structure.

Regarding the AI alignment problem, a few approaches have recently been proposed in the microeconomic theory literature. Chen, Ghersengorin, and Petersen (2024) develop a model of screening for alignment in an environment in which the decision-maker can simulate the task and impose imperfect recall on AI, obscuring whether the task is real or part of a test. ${ }^{2}$ Closer to our approach, Fudenberg and Liang (2025) assume that the AI system is aligned with some known probability and that it performs adversarially in case of misalignment.

[^2]Unlike us, Fudenberg and Liang (2025) assume that the decision-maker can impose the true unconditional distribution of optimal actions but faces non-Bayesian uncertainty about the correlation of the optimal action with a set of covariates she controls. Correspondingly, their main research question is which covariates should be revealed to AI. In our framework, the decision-maker knows the distribution of AI's signals-uncertainty is only about AI's behavior in case of misalignment-and thus she would never optimally disclose her private information to AI. Overall, these papers focus on different (and complementary) aspects of the misalignment problem: Chen et al. (2024) ask how to test AI's alignment; Fudenberg and Liang (2025) ask how to provide information to a misaligned AI; and we ask how the decision-maker should combine advice from a misaligned AI with her private information.

More broadly, our framework is part of a rapidly growing literature trying to understand optimal human-AI interactions. Closest to our paper are Dreyfuss and Hoong (2025) and Agarwal, Moehring, and Wolitzky (2026) who also adopt an information-design approach; the latter ask how AI advice interacts with human decision-making in the presence of potential biases and when the decision-maker's effort in acquiring information is endogenous.


Robust Trust

## 2 Model

A state $\omega$ is drawn from a finite state space $\Omega$, with $|\Omega|=N$, according to a full-support prior distribution $\mu_{0} \in \Delta(\Omega)$. An adviser observes partial information about $\omega$, captured by a signal $s$ whose distribution is pinned down by a signal function $\pi: \Omega \rightarrow \Delta(S) .^{3}$ We will identify the adviser's information with the posterior belief about the state that a signal realization induces; let $S=\Delta(\Omega)$ and renormalize so that $s$ is equal to the posterior belief about $\omega$ induced by $s$. Let $\tau$ denote the unconditional distribution of the adviser's posteriors $s$, with $M=\operatorname{supp}(\tau)$.

An agent takes an action $a \in A$, where $A$ is a compact metric set. The agent observes a private type $\theta \in \Theta$, where $\Theta$ is a compact metric set, that captures the agent's own

[^3]information about $\omega$ and her preferences. The distribution of the type $\theta$ is determined by a signal function $f: \Omega \rightarrow \Delta(\Theta)$. We assume that, conditional on the state, $s$ and $\theta$ are distributed independently. The agent's ex-post payoff is given by a utility function $u(a, \omega, \theta)$, assumed continuous in $a$.

The adviser sends a message $m \in \Delta(\Omega)$ to the agent, where, without loss of generality, we take the message space to be the space of beliefs about the state. The agent chooses a strategy $\sigma: \Delta(\Omega) \times \Theta \rightarrow \Delta(A)$ that assigns a distribution over actions to each message-type pair. Let $\Sigma$ denote the set of all such strategies.

The adviser's strategy maps his beliefs into distributions over messages sent to the agent. With probability $\alpha$, the adviser is aligned and non-strategically reports his belief according to the identity function $\mathrm{id}: M \rightarrow M$ such that $\mathrm{id}(m)=m$ for all $m \in M .{ }^{4}$ With probability $1-\alpha$, the adviser is misaligned and sends a message according to some strategy $\beta: M \rightarrow \Delta(\Delta(\Omega))$. Let $\mathcal{B}$ denote the set of all such strategies.

Faced with non-Bayesian uncertainty about the form of misalignment, the agent adopts a cautious posture and aims to maximize her guaranteed payoff. Concretely, she evaluates each possible strategy $\sigma$ according to its worst-case payoff

$$
V(\sigma) \triangleq \alpha \mathbb{E}_{\mathrm{id}, \sigma}[u(a, \omega, \theta)]+(1-\alpha) \inf _{\beta \in \mathcal{B}} \mathbb{E}_{\beta, \sigma}[u(a, \omega, \theta)],
$$

where the expectations are taken with respect to the underlying distributions of the primitive variables $\omega, s$, and $\theta$, as well as the respective adviser's and agent's strategies. ${ }^{5}$ We will call any misaligned adviser's strategy $\beta$ that attains the infimum in expression (1) for a fixed strategy $\sigma$ of the agent an adversarial strategy against $\sigma$.

Our main goal is to characterize the agent's optimal strategy $\sigma^{*}$ that attains:

$$
V^{*} \triangleq \sup _{\sigma \in \Sigma} V(\sigma) .
$$

[^4]


Robust Trust

## 3 Main Results


Robust Trust

### 3.1 Trust Region Strategies

In what follows, it will be convenient to separate the dependence of the agent's strategy on the adviser's message and the agent's private information. To this end, we call a private strategy $\hat{\sigma}$ the mapping from types to actions $\hat{\sigma}: \Theta \rightarrow \Delta(A)$ that specifies how the agent uses her private information. We will refer to the agent's belief about the state prior to updating based on her private type $\theta$ as the interim belief. If the agent has an interim belief $\mu$ and uses a private strategy $\hat{\sigma}$, her expected payoff is:

$$
U(\hat{\sigma}, \mu) \triangleq \mathbb{E}_{\omega \sim \mu, \hat{\sigma}}[u(a, \omega, \theta)],
$$

where the expectation is taken with respect to the conditional distribution of $\theta$ and the distribution of agent's actions induced by $\hat{\sigma} .^{6}$ A private strategy $\hat{\sigma}$ is called Bayes-optimal for belief $\mu \in \Delta(\Omega)$ if it maximizes the agent's expected payoff when she holds an interim belief $\mu: \hat{\sigma} \in \arg \max _{\hat{\sigma}} U(\hat{\sigma}, \mu)$. The agent's strategy can be viewed as a specification of a private strategy for each possible message received from the adviser, $\sigma \sim(\hat{\sigma}(m))_{m \in \Delta(\Omega)}$.

Definition 1. $\sigma \sim(\hat{\sigma}(m))_{m \in \Delta(\Omega)}$ is a trust region strategy (TRS) if there exists a compact set $T \subset \Delta(\Omega)$ such that

1. if $m \in T, \hat{\sigma}(m)$ is Bayes-optimal for $m$,
2. if $m \notin T, \hat{\sigma}(m)$ is Bayes-optimal for $P(m)$, where $P(m) \in \arg \max _{m^{\prime} \in T} U\left(\hat{\sigma}\left(m^{\prime}\right), m\right)$.

Intuitively, under a TRS, the agent treats messages $m$ reported within the trust region $T$ "at face value," i.e., she takes an optimal action treating $m$ as her correct interim belief about the state. If a message $m$ does not belong to the trust region $T$, the agent maps $m$ to the trust region by acting as if her interim belief were $P(m) \in T$. The point $P(m)$ is chosen to maximize, over all beliefs in the trust region, the agent's expected payoff under distribution $m$ when the action is taken to be optimal for $P(m)$.

[^5]To provide further intuition, with slight abuse of notation, let

$$
U(\mu) \triangleq \max _{\hat{\sigma}} U(\hat{\sigma}, \mu)
$$

be the payoff to the agent when she uses the Bayes-optimal strategy at belief $\mu$. Note that $U(\mu)$ is a convex function on $\Delta(\Omega)$; moreover, it is differentiable on the interior of the belief simplex if there exists a unique Bayes-optimal private strategy $\hat{\sigma}_{0}(\mu)$ at every belief $\mu$. In that case, we can define $\nabla U(\mu)$ as the gradient of the indirect payoff function, viewed as a function on $\mathbb{R}^{N}$. It maps each belief $\mu$ into the $N$-dimensional vector of state-contingent payoffs associated with the Bayes-optimal strategy. ${ }^{7}$ In particular, $U(\mu)=\nabla U(\mu) \cdot \mu$, where • denotes the standard dot product in $\mathbb{R}^{N}$. Moreover, for a TRS $\sigma$ and any $m^{\prime} \in T$, $U\left(\hat{\sigma}\left(m^{\prime}\right), m\right)=\nabla U\left(m^{\prime}\right) \cdot m$. Thus,

$$
\arg \max _{m^{\prime} \in T} U\left(\hat{\sigma}\left(m^{\prime}\right), m\right)=\arg \min _{m^{\prime} \in T} \underbrace{U(m)-U\left(m^{\prime}\right)-\nabla U\left(m^{\prime}\right) \cdot\left(m-m^{\prime}\right)}_{D_{U}\left(m, m^{\prime}\right)} .
$$

The expression $D_{U}\left(m, m^{\prime}\right)$ is called the Bregman distance (associated with function $U$ ) between beliefs $m$ and $m^{\prime}$. Thus, under a TRS, messages outside of the trust region $T$ are mapped into the "closest safe interpretation"-the belief in the trust region $T$ that is closest in the Bregman distance. In particular, $P(m)$ always lies on the visible part of the boundary of $T$ from the perspective of point $m .^{8}$


Robust Trust

### 3.2 Optimality of Trust Region Strategies

We call two strategies of the agent equivalent if, together with some corresponding adviser's adversarial strategies, they induce the same joint distribution over states, types, messages, and actions. The importance of TRSs stems from the following key result.

[^6]Theorem 1 (Trust Region Solution). Any optimal strategy $\sigma^{*}$ is equivalent to a trust region strategy with a connected trust region $T$.

Proof. See Appendix A.1. $\square$

Theorem 1 states that any optimal strategy can be interpreted as a TRS for some connected trust region $T$. This result provides a sharp characterization of optimal robust behavior under misalignment risk. Messages in the trust region are taken at face value while messages outside the trust region are mapped into the closest safe interpretation within the trust region. Thus, the agent's problem reduces to choosing the trust region $T$.

If the adviser is always aligned, a TRS with the trust region equal to the entire belief space is trivially optimal. On the other extreme, if the adviser is always misaligned, the optimal TRS has a trust region equal to the prior belief-the agent always ignores the message of the adviser. In Section 3.4, we explore conditions under which the trust region is guaranteed to be non-trivial. In general, however, it is difficult to pin down the exact shape of the optimal trust region. A trade-off is created by two opposing forces: when the trust region expands, the expected payoff of the agent weakly increases conditional on the adviser being aligned but weakly decreases conditional on the adviser being misaligned. In Section 4, we study the binary-state case, in which the trust region is an interval; in Section 5, we look at the case of multiple states but binary actions, in which the trust region is either the prior belief or the entire simplex.

Theorem 1 shows that the trust region may be chosen to be connected. It need not, however, be convex in belief space. The reason is that convexifying the trust region by adding the line segment between two trusted beliefs may lead some types of the misaligned adviser to use those newly trusted intermediate reports; the resulting losses may outweigh the gains from additional truthful reports by the aligned adviser. Our proof instead establishes convexity in dual coordinates, that is, in the space of state-contingent payoff vectors. Each belief can be associated with the state-contingent payoff induced by a Bayes-optimal private strategy at that belief; when the optimum is unique, this payoff vector is given by the gradient $\nabla U(\mu)$ of the indirect utility function. Although the misaligned adviser's payoff is generally nonlinear in the reported belief, it is linear in the induced state-contingent payoff vector. In particular,
an adviser with belief $\mu$ chooses among trusted reports so as to minimize $\mu \cdot w$, where $w$ ranges over the state-contingent payoff vectors induced by beliefs in the trust region. Thus, the object that can be convexified is not the trust region itself, but the associated set of induced payoff vectors. Convexifying this dual set, in turn, connects the corresponding set of beliefs in the trust region.

To further understand the geometry of the optimal trust region, note that the misaligned adviser with belief $\mu$ will choose a message $m \in T$ to minimize $U(\hat{\sigma}(m), \mu)$, or equivalently, to maximize the Bregman distance between $\mu$ and $m$; in particular, the chosen message $m$ must lie on the boundary of the trust region (see Section 5.2 for an extended discussion). As a consequence, adding non-boundary points to a trust region can only weakly increase the agent's payoff. Formally, we say that a set $A \subset \mathbb{R}^{N}$ is non-hollow if it contains all points $x \in \mathbb{R}^{N}$ with the property that every line going through $x$ intersects $A$ on both sides of $x$.

Corollary 1. Theorem 1 remains true with the additional requirement that $T$ is non-hollow.
Note that being non-hollow is not implied by connectedness, although it is weaker than convexity. An example of a connected but hollow set is a sphere. If the trust region of some TRS is a sphere, then we can expand the trust region to the corresponding ball, since the misaligned adviser will never send messages in the interior of the ball.

The trust region is typically not unique and our results in this section emphasized that it can be taken to be a relatively large set. However, when the support $M$ of the adviser's beliefs is finite, it is also possible to construct an optimal discrete trust region $T$ with $|T| \leq|M|$. Intuitively, at most one belief in the trust region is needed for every possible belief of the aligned adviser. ${ }^{9}$ In such cases, a connected trust region can still be constructed but most beliefs in the trust region are never reported by the adviser. Uniqueness of the trust region can sometimes be established if the adviser's beliefs have full support, $M=\Delta(\Omega)$ (see Section 4).


Robust Trust

### 3.3 Robust Rationalizability

Our model assumes that the agent commits to a strategy at the outset of the game, not knowing the strategy adopted by the misaligned adviser. As we show next, neither the

[^7]commitment assumption nor the timing of moves matter for the value that the agent can achieve. This is because we can construct an optimal solution that is a saddle point of the zero-sum game between the agent and the misaligned adviser. For any strategy $\beta \in \mathcal{B}$ of the adversarial adviser, we let $\mathbb{P}_{\beta}(\cdot \mid m)$ denote the agent's interim belief induced by message $m$ given the adviser's strategy. ${ }^{10}$

Definition 2 (Robustly Rationalizable Strategy). A strategy $\sigma \sim(\hat{\sigma}(m))_{m \in \Delta(\Omega)}$ is robustly rationalizable if there exists an adversarial strategy $\beta^{*}$ of the misaligned adviser against $\sigma$ such that for all $m \in M, \hat{\sigma}(m) \in \arg \max _{\hat{\sigma}^{\prime}} U\left(\hat{\sigma}^{\prime}, \mathbb{P}_{\beta^{*}}(\cdot \mid m)\right)$.

The rationalizability condition means that the agent does not need commitment to follow the strategy. She can view the misaligned adviser as choosing an adversarial reporting strategy such that, after every message, the prescribed private strategy is myopically optimal.

Theorem 2 (Robust Rationalizability). Any robustly rationalizable strategy is optimal. If $M$ and $\Theta$ are finite, a robustly rationalizable strategy exists.

Proof. See Appendix A.2. $\square$

Assuming finite support of beliefs, ${ }^{11}$ Theorem 2 implies that there exists an adversarial strategy $\beta^{*}$ for the misaligned adviser such that the agent's optimal strategy is sequentially rational: the agent can simply observe the adviser's message, update her beliefs using Bayes' rule given $\beta^{*}$, and then use the Bayes-optimal private strategy for the resulting interim belief. In particular, implementing the optimal strategy does not require commitment by the agent.

In light of Theorem 1, the agent's equilibrium strategy can still be taken to be a TRS. Treating the problem as a zero-sum game between the agent and the misaligned adviser, we will call $\left(\sigma^{*}, \beta^{*}\right)$ a trust region equilibrium (TRE) if $\sigma^{*}$ is a TRS that is robustly rationalizable against the adversarial strategy $\beta^{*}$.

In a TRE, messages $m \in M$ in the trust region are taken at face value because they are only reported by the aligned adviser (thus, Bayes' rule implies that $\mathbb{P}_{\beta^{*}}(\cdot \mid m)=m$ ). Messages

[^8]$m \in M$ outside of the trust region are reported by both types of the adviser with probabilities such that $\mathbb{P}_{\beta^{*}}(\cdot \mid m)=P(m)$, where $P(m)$ is the mapping to the boundary of the trust region defined in Theorem 1. Messages $m \notin M$ are sent with probability zero. In other words, the mappings from messages to beliefs induced by (i) Bayes' rule and (ii) minimizing Bregman distance to the trust region, coincide on the equilibrium path of a TRE. In Section 4, we use this structural property to characterize the trust region in a binary-state setting.

From a technical perspective, Theorem 2 provides a practical way of certifying the optimality of solutions in applications, even with infinite belief and message spaces. To construct an optimal solution, it is sufficient to construct a saddle point of the zero-sum game between the agent and the misaligned adviser-verifying the mutual best-response property is often easier than evaluating the agent's objective for every possible strategy.

Finally, Theorem 2 implies that our problem is equivalent to a constrained persuasion problem for the misaligned adviser. When the misaligned adviser moves first, he is effectively choosing a Bayes-plausible distribution of the agent's interim beliefs subject to the constraint that the signal must be truthful in every state with probability at least $\alpha$; the constraint reflects the presence of the aligned adviser. Thus, the misaligned adviser is effectively attempting to "jam" the signal sent by the aligned adviser. We exploit this perspective in the next section to derive thresholds on $\alpha$ below which no TRE can sustain informative communication.


Robust Trust

### 3.4 Minimal Viable Alignment

In this section, we derive bounds on the alignment probability $\alpha$ above which the agent finds it worthwhile to consult the adviser. Equivalently, we characterize the threshold at which the agent's trust region becomes nontrivial.

Formally, define the value of an adviser as

$$
\Delta V \triangleq V^{*}-V_{0},
$$

where $V_{0} \triangleq \sup _{\sigma \in \Sigma} \mathbb{E}_{\sigma}[u(a, \omega, \theta)]$ is the agent's optimal payoff in the absence of the adviser. Since the agent can always ignore the adviser's messages, this value is non-negative, $\Delta V \geq 0$.

We ask when this value is strictly positive, $\Delta V>0$ (cf. the value of information by Blackwell (1951)).

To answer this question, we assume that the adviser's beliefs are finitely supported, $|M|=K<\infty$, and derive a bound on $\alpha$ that is independent of the agent's problem. If $\alpha$ is small enough, the misaligned adviser can use a strategy $\beta$ that "jams" the signal created by truthful reporting of the aligned adviser. In such a case, the distribution of interim beliefs $\mathbb{P}_{\beta}(\cdot \mid m)$ held by the agent is degenerate: the trust region contains only the prior belief. However, if $\alpha$ is large enough, there exists no strategy for the misaligned adviser that makes the equilibrium message uninformative. In such cases, as long as information is useful to the agent $(U(\mu)$ is strictly convex in the relevant range), $\Delta V$ must be strictly positive.

Definition 3 (Minimal Viable Alignment). The minimal viable alignment $\operatorname{MVA}(\tau)$ is the smallest upper bound on $\alpha$ for which there exists a strategy $\beta$ of the misaligned adviser such that the induced interim belief satisfies $\mathbb{P}_{\beta}(\cdot \mid m)=\mu_{0}$ for every $m \in M$.

MVA depends on the adviser's information $\tau \in \Delta(\Delta(\Omega))$. Define the rank of the matrix of the adviser's posteriors $\mu_{1}, \ldots, \mu_{K} \in \operatorname{supp} \tau$ :

$$
R(\tau) \triangleq \operatorname{rank}\left(\left[\begin{array}{llll}
\mu_{1} & \mu_{2} & \cdots & \mu_{K}
\end{array}\right]\right) .
$$

Roughly, $R(\tau)$ captures the richness of the adviser's information: the adviser's beliefs are located in an $(R(\tau)-1)$-dimensional subspace of the $(N-1)$-dimensional belief simplex $\Delta(\Omega)$. For any $\tau, R(\tau) \leq \min \{K, N\}$. The rank weakly decreases when the adviser's information is garbled. In what follows, we assume that the adviser has some information, $K \geq 2$, so $R(\tau) \geq 2$.

Theorem 3 (Minimal Viable Alignment). The agent strictly benefits from the presence of the adviser, $\Delta V>0$, in some decision problem (equivalently, in any decision problem with strictly convex $U$ ) if and only if $\alpha>\operatorname{MVA}(\tau)$. For any $\tau, \operatorname{MVA}(\tau) \in[1 / N, 1 / 2]$. Moreover, for any $\alpha \in[1 / N, 1 / 2]$, there exists $\tau$ such that $\operatorname{MVA}(\tau)=\alpha$. If $R(\tau)=K$, then $\operatorname{MVA}(\tau)=1 / K$.

Proof. See Appendix A.3. $\square$

The proof of Theorem 3 shows that, for any given $\tau, \operatorname{MVA}(\tau)$ can be computed as the solution to a finite-dimensional linear program. We establish bounds on this solution and then show that these bounds are tight by explicitly constructing adviser information structures that attain every MVA within the admissible range. In fact, the proof yields the stronger statement that, for any $\tau, \operatorname{MVA}(\tau) \in[1 / R(\tau), 1 / 2]$.

By Theorem 3, if the alignment $\alpha$ exceeds 1/2 (and information is strictly useful everywhere), then the agent always benefits from the presence of the adviser. Conversely, if the state is binary and $\alpha<1 / 2$, the agent cannot benefit from the adviser. In higher-dimensional problems, the adviser can be valuable at much lower alignment levels. In particular, if $R(\tau)=K=N$, then it suffices that $\alpha>1 / N$. Thus, when the state space is very rich, even a small amount of trust is enough for the agent to benefit from the advice of a misaligned adviser.


Robust Trust

## 4 Binary State

Consider the case of a binary state, $\Omega=\{0,1\}$ (we can intuitively think of the state as capturing whether a given statement is false or true). The belief is effectively one-dimensional: with slight abuse of notation, let $\mu \in[0,1]$ denote the probability of state $\omega=1$. For expositional clarity, we further assume that the agent's indirect payoff function $U(\mu)$ is strictly convex and twice differentiable, and the adviser's posterior is distributed over $M=[0,1]$ with a strictly positive probability density $\tau(\mu) .{ }^{12}$ In this case, each $\mu \in[0,1]$ can be associated with a unique Bayes-optimal private strategy $\hat{\sigma}_{0}(\mu)$.

Since any connected one-dimensional compact set is a closed interval, a straightforward corollary of Theorem 1 is:

Corollary 2. If $|\Omega|=2$, any optimal strategy $\sigma^{*}$ is characterized by a trust region $T=[\underline{\mu}, \bar{\mu}]$. If $m \in[\underline{\mu}, \bar{\mu}], \hat{\sigma}(m)=\hat{\sigma}_{0}(m)$; if $m<\underline{\mu}, \hat{\sigma}(m)=\hat{\sigma}_{0}(\underline{\mu})$; if $m>\bar{\mu}, \hat{\sigma}(m)=\hat{\sigma}_{0}(\bar{\mu})$.

If $\underline{\mu}=\bar{\mu}$, the agent effectively ignores the adviser, implying $\underline{\mu}=\bar{\mu}=\mu_{0}$. If $\underline{\mu}<\bar{\mu}$, the agent plays according to the Bayes-optimal strategy $\hat{\sigma}_{0}(\underline{\mu})$ if $m \leq \underline{\mu}$, and according to the

[^9]Bayes-optimal strategy $\hat{\sigma}_{0}(\bar{\mu})$ if $m \geq \bar{\mu}$.
Recall that the adversarial strategy of the misaligned adviser induces a belief from the trust region that maximizes the Bregman distance from his true posterior belief; when the trust region is an interval, its boundary consists of the two endpoints, and the adversarial strategy admits a simple threshold characterization:

Lemma 1. When the agent commits to a TRS with the trust region $T=[\underline{\mu}, \bar{\mu}]$, the misaligned adviser with belief $\mu$ finds it optimal to send any message $m \geq \bar{\mu}$ if $\mu \leq b(\underline{\mu}, \bar{\mu})$ and any message $m \leq \underline{\mu}$ if $\mu \geq b(\underline{\mu}, \bar{\mu})$, where

$$
b(\underline{\mu}, \bar{\mu})=\frac{\int_{\underline{\mu}}^{\bar{\mu}} \mu U^{\prime \prime}(\mu) d \mu}{\int_{\underline{\mu}}^{\bar{\mu}} U^{\prime \prime}(\mu) d \mu}
$$

Proof. See Appendix A.5. $\square$

Lemma 1 states that the misaligned adviser with high enough beliefs $\mu$ will induce the private strategy Bayes-optimal at the lowest belief in the trust region, $\underline{\mu}$, by reporting some message $m$ lower than $\mu$; similarly, the misaligned adviser with low enough beliefs $\mu$ will induce the private strategy Bayes-optimal at the highest belief in the trust region, $\bar{\mu}$, by reporting some message $m$ higher than $\bar{\mu}$. The threshold belief is given by the conditional expectation of a random variable whose distribution is determined by the curvature of the indirect utility function: $b(\underline{\mu}, \bar{\mu})=\mathbb{E}[\nu \mid \nu \in[\underline{\mu}, \bar{\mu}]]$, where $\nu$ is distributed with full support over $[0,1]$ according to probability density $U^{\prime \prime}(\cdot) / \int_{0}^{1} U^{\prime \prime}(\mu) d \mu$.

To characterize the trust region's boundaries, we will use the observation from Theorem 2 that it is sufficient to construct mutual best responses for the agent and the misaligned adviser. Lemma 1 characterizes the best response of the misaligned adviser. A best response of the agent must use the Bayes-optimal strategies at each interim belief induced by the adviser's strategy. A necessary condition is that the average interim belief induced by messages $m \leq \underline{\mu}$
is exactly $\underline{\mu}$, and the average interim belief induced by messages $m \geq \bar{\mu}$ is exactly $\bar{\mu}$ : ${ }^{13}$

$$
\begin{gathered}
\frac{\alpha \int_{0}^{\underline{\mu}} \mu \tau(\mu) d \mu+(1-\alpha) \int_{b(\underline{\mu}, \bar{\mu})}^{1} \mu \tau(\mu) d \mu}{\alpha \int_{0}^{\underline{\mu}} \tau(\mu) d \mu+(1-\alpha) \int_{b(\underline{\mu}, \bar{\mu})}^{1} \tau(\mu) d \mu}=\underline{\mu}, \\
\frac{\alpha \int_{\bar{\mu}}^{1} \mu \tau(\mu) d \mu+(1-\alpha) \int_{0}^{b(\underline{\mu}, \bar{\mu})} \mu \tau(\mu) d \mu}{\alpha \int_{\bar{\mu}}^{1} \tau(\mu) d \mu+(1-\alpha) \int_{0}^{b(\underline{\mu}, \bar{\mu})} \tau(\mu) d \mu}=\bar{\mu} .
\end{gathered}
$$

As it turns out, these conditions are also sufficient for a TRE:

Proposition 1 (Binary-State Characterization). An optimal strategy exists; it is unique and robustly rationalizable. Its trust region, $T=[\underline{\mu}, \bar{\mu}]$, is equal to the prior belief $\left\{\mu_{0}\right\}$ when $\alpha \leq 1 / 2$; otherwise, it is defined by the unique solution to the system (6)-(7) that satisfies $\underline{\mu} \leq \mu_{0} \leq \bar{\mu}$.

Proof. See Appendix A.6. $\square$

Note that while the structure of the trust region characterized by Proposition 1 is simple, the underlying strategy of the misaligned adviser is quite complex in a TRE. By Lemma 1, the misaligned adviser with belief $\mu \geq b(\underline{\mu}, \bar{\mu})$ is indifferent between sending all messages $m \leq \underline{\mu}$ since they all result in the same Bayes-optimal strategy $\hat{\sigma}_{0}(\underline{\mu})$. In a commitment solution, the misaligned adviser can send any of these messages; for example, he can always send $m=\underline{\mu}$. But in a TRE, the strategy $\beta^{*}$ of the misaligned adviser must be such that every message $m \leq \underline{\mu}$ induces the interim belief $\underline{\mu}$ via Bayes' rule. Since all messages $m \leq \underline{\mu}$ are sent on equilibrium path (the aligned adviser simply reports his belief truthfully), $\beta^{*}$ must rely on the misaligned adviser's indifference to put just enough probability mass on each of these messages to induce $\underline{\mu}$.

Proposition 1 fully characterizes the optimal trust region. A natural next question is how the trust region depends on the problem's parameters. We offer two comparative statics results, one related to the size of the trust region, and one related to its location.

First, higher alignment results in more trust:


Robust Trust

[^10]Proposition 2 (Change in Alignment). When $\alpha \geq 1 / 2, \underline{\mu}(\alpha)$ is strictly and continuously decreasing in $\alpha$ and $\bar{\mu}(\alpha)$ is strictly and continuously increasing in $\alpha$. At $\alpha=1 / 2,[\underline{\mu}, \bar{\mu}]=$ $\left[\mu_{0}, \mu_{0}\right]$. At $\alpha=1,[\underline{\mu}, \bar{\mu}]=[0,1]$.

Proof. See Appendix A.7. $\square$

Proposition 2 shows that the trust region gradually and monotonically expands from the prior belief, at $\alpha \leq 1 / 2$, to the entire belief simplex. For any $\alpha<1$, the trust region excludes the most extreme beliefs. Intuitively, the aligned adviser is unlikely to hold such extreme beliefs, whereas the misaligned adviser would be relatively likely to report them if they were included in the trust region.

Second, we show that the trust region tends to include beliefs at which the decision problem of the agent is less "information-sensitive." In other words, the agent will avoid expanding the trust region to beliefs where small changes in information lead to large changes in the optimal action. We formalize this notion via the indirect utility function $U(\mu)$, noting that its curvature reflects the sensitivity of the agent's optimal private strategy to her interim beliefs.

Definition 4 (Information Sensitivity). We say that the indirect utility function $U_{1}(\mu)$ is less information-sensitive at higher beliefs than the indirect utility function $U_{2}(\mu)$ if

$$
\frac{U_{1}^{\prime \prime}(\mu)}{U_{2}^{\prime \prime}(\mu)} \text { is decreasing in } \mu \text {. }
$$

The definition states that the convexity of the indirect utility function $U_{1}$ relative to the convexity of $U_{2}$ is smaller at higher beliefs $\mu$. Intuitively, under $U_{1}$, the decision of the agent is less sensitive to new information at higher beliefs. It turns out that in this case the trust region will be skewed towards higher beliefs.

Proposition 3 (Change in Information Sensitivity). Suppose that $U_{1}(\mu)$ is less informationsensitive at higher beliefs than $U_{2}(\mu)$. Then, the trust region $T_{1}$ corresponding to $U_{1}$ is higher in the strong set order than the trust region $T_{2}$ corresponding to $U_{2}$.

Proof. See Appendix A.8. $\square$

Proposition 3 shows that the trust region skews towards beliefs at which the agent's optimal action is less sensitive to new information. We illustrate the usefulness of the result in the next subsection, where we consider an application.


Robust Trust

### 4.1 Application: Medical Triage

The agent is a doctor deciding whether a patient should undergo additional testing, $a=1$, or not, $a=0$, based on an interview and a preliminary test result that can be analyzed by AI (e.g., an x-ray image; cf. Agarwal et al. (2025)). We model this by assuming a binary state, where $\omega=1$ means that the patient is sick and $\omega=0$ means that the patient is healthy, and with conditionally independent signals for the doctor and AI, both inducing a full-support uniform distribution of posterior beliefs. We let $\theta \in[0,1]$ denote the doctor's private belief and $\mu \in[0,1]$ denote AI's belief. The doctor's payoff is

$$
u(a, \omega)= \begin{cases}r \geq 1 & \text { if } a=1 \text { and } \omega=1, \\ 1 & \text { if } a=0 \text { and } \omega=0, \\ 0 & \text { if } a \neq \omega .\end{cases}
$$

Thus, the doctor would like to match the action to the state. When $r>1$, payoffs are more sensitive to taking the correct action when the patient is sick, that is, when $\omega=1$.

First best. As a benchmark, consider the case in which the doctor has direct access to $\mu$. By Bayes' rule, the posterior belief that the state is 1 after observing the realization $(\mu, \theta)$ is $p(\mu, \theta) \triangleq \mu \theta /(\mu \theta+(1-\mu)(1-\theta))$. The doctor chooses additional testing, $a=1$, when $p(\mu, \theta) \geq 1 /(1+r)$. The doctor's indirect payoff from interim belief $\mu$ is

$$
U(\mu)=1-\frac{(1-\mu)^{2}}{r \mu+1-\mu} .
$$

Note that $U$ is strictly convex: the doctor's rich but imperfect private information makes additional information locally valuable at all beliefs.

> [Figure omitted from this text-only corpus; refer to the source manuscript.]
Figure 1: Evolution of the optimal trust region as a function of alignment probability $\alpha$.

Explicit solution when $r=1$. Suppose that the signal $\mu$ is reported by an AI system that is aligned with probability $\alpha$. In the symmetric case $r=1$, we can solve the system of equations (5)-(7) and obtain a symmetric trust region $T_{\alpha}=[\underline{\mu}(\alpha), 1-\underline{\mu}(\alpha)]$, where

$$
\underline{\mu}(\alpha)= \begin{cases}\frac{1}{2} & \alpha \leq \frac{1}{2}, \\ \frac{\sqrt{(1-\alpha)(1+2 \alpha)}-(1-\alpha)}{2 \alpha} & \alpha>\frac{1}{2} .\end{cases}
$$

Figure 1 depicts the optimal trust region, and Figure 2 illustrates the resulting decision rule for the doctor as a function of the realized signals. In line with Proposition 1 and Proposition 2, the trust region is equal to the prior belief when the alignment probability is below 1/2. In that case, the doctor should not use AI and instead rely exclusively on her own signal, as shown in the left panel of Figure 2. When the alignment probability is above $1 / 2$, the doctor trusts moderate AI reports. Extreme reports, namely those with $m<\underline{\mu}(\alpha)$ or $m>1-\underline{\mu}(\alpha)$, are clipped at the endpoints of the trust region. The optimal decision rule is therefore sensitive to AI's recommendations only in the intermediate range of beliefs. In particular, the AI's signal alone is never sufficient to induce testing without corroboration from the doctor's information, as shown in the middle panel of Figure 2. Finally, as $\alpha$ approaches 1 , the trust region converges to the entire simplex (Figure 1), and the optimal decision rule converges to the first-best decision rule, as shown in the right panel of Figure 2.

> [Figure omitted from this text-only corpus; refer to the source manuscript.]
Figure 2: Optimal decision rule in three cases: $\alpha \leq 1 / 2, \alpha=3 / 4$, and $\alpha=1$.

Comparative statics with respect to $r$. When $r>1$, the system of equations (5)-(7) no longer admits a closed-form solution. However, it is easy to verify that, as $r$ increases, $U(\mu)$ becomes less information-sensitive at higher beliefs. Intuitively, when $r>1$, the objective function makes the doctor effectively place more weight on state 1, in which the patient is sick. As a result, she reacts less strongly to new information when she believes that state 1 is likely. By Proposition 3, increasing $r$ shifts the optimal trust region upward. The doctor therefore trusts higher reports more than before and becomes more skeptical of low reports.

Takeaways. The example resonates with how imaging AI is often deployed in practice. Many real-world systems are used as second readers or prioritization aids rather than as autonomous decision-makers. ${ }^{14}$ The same caution is also consistent with growing evidence on automation bias: when clinicians are shown incorrect AI suggestions, their decisions can deteriorate, including among experienced readers. ${ }^{15}$

Our analysis provides a simple economic rationale for such guardrails. Under the trust-

[^11]region protocol, intermediate probabilities should be used as reported, whereas extremely low or extremely high probabilities should be replaced by the corresponding boundary values of the trusted range. This caps the operational leverage of near-certain predictions: an output presented as almost conclusive is treated as strong evidence, but not as decisive on its own. A conclusion approaching certainty requires corroboration from other sources, such as clinical context and human judgment.


Robust Trust

## 5 Multiple States

In this section, we consider the general case $|\Omega| \geq 2$. First, we provide a full characterization of the robustly rationalizable solution in the case of binary private strategies. Second, we analyze the case of rich private strategies and develop the robustly rationalizable solution in a symmetric example.


Robust Trust

### 5.1 Binary Action

Consider the setting in which the agent has only two pure private strategies, i.e., $A=\left\{a_{1}, a_{2}\right\}$ and $|\Theta|=1$. Thus, the agent has no private information and we drop the type throughout.

Without loss of generality, we can normalize the agent's payoff from action $a_{1}$ to zero, $u\left(a_{1}, \omega\right) \equiv 0$, and denote the expected payoff from action $a_{2}$ when the adviser's posterior is $\mu$ by $v(\mu) \triangleq \mathbb{E}_{\mu}\left[u\left(a_{2}, \omega\right)\right]$. Denote by $\hat{\tau} \in \Delta(\mathbb{R})$ the distribution of $v$ when $\mu$ is distributed according to $\tau \in \Delta(\Delta(\Omega))$.

Define the absolute losses and gains from taking the second action relative to the first one:

$$
L(\hat{\tau})=\int_{-\infty}^{0}(-v) \hat{\tau}(d v), \quad G(\hat{\tau})=\int_{0}^{+\infty} v \hat{\tau}(d v)
$$

Also, define the following threshold:

$$
\hat{\alpha}(\hat{\tau})=\frac{\max \{L(\hat{\tau}), G(\hat{\tau})\}}{L(\hat{\tau})+G(\hat{\tau})} .
$$

To rule out trivial cases and to simplify the exposition of the optimal strategy, we make the
following assumption that holds in generic environments.
Assumption 1 (Genericity). $L(\hat{\tau})>0, G(\hat{\tau})>0, L(\hat{\tau}) \neq G(\hat{\tau}), \tau(\{\mu: v(\mu)=0\})=0$.
Proposition 4 (Binary Action Solution). Suppose that Assumption 1 holds. If $\alpha \neq \hat{\alpha}(\hat{\tau})$, then the optimal solution exists, is unique, and is robustly rationalizable. In particular, if $\alpha>\hat{\alpha}(\hat{\tau})$, then all messages are trusted, $T=\Delta(\Omega)$; if $\alpha<\hat{\alpha}(\hat{\tau})$, then no messages are trusted, $T=\left\{\mu_{0}\right\}$. If $\alpha=\hat{\alpha}(\hat{\tau})$, both full trust and no trust are optimal and robustly rationalizable.

By Proposition 4, generically, the optimal solution is stark: either all or none of the adviser's messages are trusted. This is in contrast to the binary-state case with a rich strategy space, where the trust region expanded continuously with the alignment probability (Proposition 2).

Notably, only the aggregate quantities $L(\hat{\tau})$ and $G(\hat{\tau})$ matter for the determination of the trust region; the detailed distribution of relative payoffs $\hat{\tau}$ is irrelevant. The threshold $\hat{\alpha}(\hat{\tau})$ is minimized at $L(\hat{\tau})=G(\hat{\tau})$, in which case $\hat{\alpha}(\hat{\tau})=1 / 2$. Hence, if $\alpha<1 / 2$, the agent never trusts the adviser, regardless of $\hat{\tau} .{ }^{16}$ By contrast, for a given $\alpha>1 / 2$, the trust condition $\hat{\alpha}(\hat{\tau})<\alpha$ is equivalent to $(L(\hat{\tau}), G(\hat{\tau}))$ lying in the cone defined by the two linear inequalities

$$
(1-\alpha) L(\hat{\tau}) \leq \alpha G(\hat{\tau}), \quad(1-\alpha) G(\hat{\tau}) \leq \alpha L(\hat{\tau}) .
$$

Thus, in binary decision problems, the adviser is beneficial only when the expected gains and losses of one action relative to the other are not too far apart.


Robust Trust

### 5.2 Rich Private Strategies

We now assume that the agent's indirect utility $U(\mu)$ is twice differentiable and strictly convex everywhere. Denote by $h\left(\mu \mid \mu^{\prime}\right)$ the value of the supporting hyperplane to the graph of $U$ at $\mu^{\prime}$ evaluated at $\mu$. Fixing the agent's TRS with trust region $T$, the set of messages

[^12]that the misaligned adviser might send at belief $\mu$ is given by
$$
M^{*}(\mu)=\arg \min _{\mu^{\prime} \in T} h\left(\mu \mid \mu^{\prime}\right) .
$$
As we have argued earlier, a simple transformation establishes the following fact:

Corollary 3 (Bregman distance). $M^{*}(\mu)$ is the set of maximizers of the Bregman distance $D_{U}\left(\mu, \mu^{\prime}\right)$ between the adviser's true belief $\mu$ and a report $\mu^{\prime}$ in the trust region.

By Corollary 3, $M^{*}(\mu)$ are the furthest points from $\mu$ in $T$ with respect to Bregman distance. Bregman distance always strictly increases along each ray from $\mu$ and thus the misaligned adviser always chooses points on the "opposite" boundary of $T$. Therefore, $U$ determines the geometry of the trust region. For example, if $U(\mu)=\|\mu-b\|^{2}$ for Euclidean norm and some vector $b$, then the Bregman distance between $\mu$ and $\mu^{\prime}$ coincides with the squared Euclidean distance between $\mu$ and $\mu^{\prime}$. In such cases, the trust region can be taken to be convex. ${ }^{17}$ However, in general, Bregman distance is not a (square of a) metric-it may not satisfy the triangle inequality or symmetry. Thus, the geometry of $T$ may be quite complex, and we do not expect a characterization of the trust region in full generality to be tractable.

The trust region can sometimes be found explicitly in symmetric environments-we illustrate this with an example.

Example 1 (Spherical Environment). Let $U(\mu)=\tilde{U}(\|\mu-b\|)$ for some $b$ and $\tilde{U}$. Let the adviser's belief be symmetrically distributed over a ball $C=\left\{\mu:\|\mu-b\| \leq r_{0}\right\}$ with the radial density $\tau(r)$. Then, there exists a robustly rationalizable solution in which the trust region $T$ is a ball centered at $b: T=\left\{\mu:\|\mu-b\| \leq r^{*}(\alpha)\right\}$.

We will show this result via Theorem 2 by explicitly constructing the corresponding TRE. The key observation, that we formalize and prove in Lemma 9 in Appendix A.10, is that the misaligned adviser with belief $\mu$ induces an antipodal belief on the boundary of $T$. This fact combined with the symmetry of the problem implies that the adversarial strategy is the

[^13]same on each ray going through the center of the ball, and hence analogous to the strategy constructed in Section 4.

The radius $r^{*}(\alpha)$ can be found via the balancing condition applied to any ray going through the center. Indeed, consider any line passing through $b$. Consider a coordinate system on that line such that $b$ is located at $r=0$, and the points on the boundary of $C$ are located at coordinates $-r_{0}$ and $r_{0}$. Then, the belief at $r=r^{*}(\alpha)$ will be induced by the misaligned adviser only when his belief is at negative coordinates, and by the aligned adviser only when his belief is at positive coordinates. Thus, the agent's interim beliefs satisfy the TRE property if and only if:

$$
r^{*}=\frac{\alpha \int_{r^{*}}^{r_{0}} r \tau(r) d r-(1-\alpha) \int_{0}^{r_{0}} r \tau(r) d r}{\alpha \int_{r^{*}}^{r_{0}} \tau(r) d r+(1-\alpha) \int_{0}^{r_{0}} \tau(r) d r} .
$$

Rearranging, we obtain:

$$
(2 \alpha-1) \int_{r^{*}}^{r_{0}}\left(r-r^{*}\right) \tau(r) d r=(1-\alpha)\left(\int_{0}^{r^{*}}\left(r+r^{*}\right) \tau(r) d r+\int_{r^{*}}^{r_{0}} 2 r^{*} \tau(r) d r\right)
$$

For $\alpha<1 / 2$, the equation does not admit a solution. At $\alpha=1 / 2, r^{*}=0$ is a solution. For $\alpha \in(1 / 2,1)$, the left-hand side is continuously and strictly decreasing in $r^{*}$, and the right-hand side is continuously and strictly increasing in $r^{*}$, with a derivative with respect to $r^{*}$ that is strictly positive. Therefore, the equation admits a unique solution $r^{*}(\alpha)$. As the left-hand side strictly increases in $\alpha$ and the right-hand side strictly decreases in $\alpha, r^{*}(\alpha)$ strictly increases in $\alpha$. Furthermore, $r^{*}(1)=r_{0}$.

This example features two notable properties. First, the MVA does not depend on $U$ or the number of states; the threshold alignment probability is always 1/2. Second, the shape of $\tilde{U}$, which captures the details of the decision problem, does not matter for the trust region $T$; the trust region is uniquely pinned down by $\tau(r)$. For example, if $\tau$ is uniform, $\tau \sim U\left[0, r_{0}\right]$, then $r^{*}(\alpha)=\frac{1-\sqrt{1+\alpha-2 \alpha^{2}}}{\alpha} r_{0}$. $\square$


Robust Trust

## 6 Concluding Remarks

Summary. We studied robust decision-making when an agent relies on an informed adviser who may be misaligned. We characterized the decision rule that maximizes the agent's expected payoff guarantee over all possible forms of misalignment. We showed that every optimal policy is equivalent to a trust region policy in belief space: the agent limits exposure to manipulation while preserving value from moderately informative advice. We proved that the optimal solution can be implemented as an equilibrium of a zero-sum game between the agent and the misaligned adviser and derived minimal alignment probabilities required for advice to be robustly valuable.

Implications for AI use. Our results support a cautiously optimistic view about deploying AI in high-stakes settings. Even if misalignment is serious and plausibly frequent, there are provably effective ways to limit the resulting harm while deriving value-provided that the human decision-maker retains final authority over actions. At the same time, our analysis makes clear that safe deployment requires concrete, pre-specified decision protocols rather than informal, case-by-case trust judgments.

The trust-region characterization translates into a simple design rule for AI-assisted choice under misalignment risk. The decision-maker should specify in advance a rule that maps model outputs into actions, separating a set of outputs that will be used directly from those that will be treated more conservatively. In some contexts, this can be implemented as a delegationstyle guardrail. The AI can effectively control decisions within an approved operating range, but recommendations that push toward unusually aggressive actions are automatically clipped to the nearest admissible recommendation or escalated into a higher-friction path (additional tests, second reads, or explicit human sign-off).

More broadly, if the adviser is one component inside a larger AI system, the same idea suggests an architectural and training choice: include an interpretable interface layer that enforces the trust-region mapping between modules. This limits the chance that rare errors or adversarial behavior upstream translate into extreme downstream actions, and it provides a well-defined target for auditing and stress-testing the system as a whole.

Future research directions. Our analysis points to at least two natural next steps. First, it would be useful to obtain comparative statics of the trust region with respect to the agent's decision problem, the adviser's informativeness, and alignment probability beyond the binary-state case, where the geometry of the trust region starts playing a central role. Second, with an eye toward applications, it is important to develop tractable computational methods for finding the trust region. Such methods would need to confront the fact that the value function mapping candidate trust regions into the agent's payoff is a convex combination of a supermodular and a submodular function, making many standard algorithms inappropriate. We leave these directions for future research.


Robust Trust

## References

Agarwal, N., A. Moehring, P. Rajpurkar, and T. Salz (2025): "Combining Human Expertise with Artificial Intelligence: Experimental Evidence from Radiology," Working paper.
Agarwal, N., A. Moehring, and A. Wolitzky (2026): "Designing Human-AI Collaboration: A Sufficient-Statistic Approach," Working paper.
Alonso, R., T. Gan, and J. Hu (2026): "Robust Delegation," Working paper.
Alonso, R. and G. Padró i Miquel (2025): "Competitive Capture of Public Opinion," Econometrica, 93, 1265-1297.
Amodei, D., C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and D. Mané (2016): "Concrete Problems in AI Safety," Working paper.
Benjamin, D. J. (2019): "Errors in Probabilistic Reasoning and Judgment Biases," Handbook of Behavioral Economics: Applications and Foundations 1, 2, 69-186.
Blackwell, D. (1951): "Comparison of Experiments," in Proceedings of the Second Berkeley Symposium on Mathematical Statistics and Probability, ed. by J. Neyman, Berkeley and Los Angeles: University of California Press, 93-102.
Chen, E. O., A. Ghersengorin, and S. Petersen (2024): "Imperfect Recall and AI Delegation," Working paper.

Crawford, V. P. and J. Sobel (1982): "Strategic Information Transmission," Econometrica, 50, 1431-51.
Doval, L. and A. Smolin (2024): "Persuasion and Welfare," Journal of Political Economy, 132, 2451-2487.
Dratsch, T., X. Chen, M. Rezazade Mehrizi, R. Kloeckner, A. Mähringer-Kunz, M. Püsken, B. Baessler, S. Sauer, D. Maintz, and D. Pinto dos Santos (2023): "Automation Bias in Mammography: The Impact of Artificial Intelligence BI-RADS Suggestions on Reader Performance," Radiology, 307, e222176.
Dreyfuss, B. and R. Hoong (2025): "Calibrated Coarsening: Designing Information for AI-Assisted Decisions," Working paper.
Dworczak, P. and A. Pavan (2022): "Preparing for the Worst but Hoping for the Best: Robust (Bayesian) Persuasion," Econometrica, 90, 2017-2051.
Frankel, A. (2014): "Aligned Delegation," American Economic Review, 104, 66-83.
Fudenberg, D. and A. Liang (2025): "Friend or Foe: Delegating to an AI whose Alignment is Unknown," Working paper.
Gale, D. and H. Nikaido (1965): "The Jacobian Matrix and Global Univalence of Mappings," Mathematische Annalen, 159, 81-93.
Gershkov, A., B. Moldovanu, and X. Shi (2025): "Order Independence in Sequential, Issue-by-Issue Voting," Mathematics of Operations Research, 50, 1635-1653.
Glazer, J., H. Herrera, and M. Perry (2020): "Fake Reviews," The Economic Journal, 131, 1772-1787.
Hurwicz, L. (1951): "Optimality Criteria for Decision Making Under Ignorance," Cowles Commission Discussion Paper.
Kamenica, E. and M. Gentzkow (2011): "Bayesian Persuasion," American Economic Review, 101, 2590-2615.
Lahr, P. and J. Winkelmann (2019): "Fake Experts," Working paper.
Levy, M. and B. Szentes (2025): "Information Design for AI Proxies under Imperfect Recall," Working paper.
Lipnowski, E., D. Ravid, and D. Shishkin (2022): "Persuasion via Weak Institutions," Journal of Political Economy, 130, 2705-2730.

Maslej, N., L. Fattorini, R. Perrault, Y. Gil, V. Parli, N. Kariuki, E. Capstick, A. Reuel, E. Brynjolfsson, J. Etchemendy, K. Ligett, T. Lyons, J. Manyika, J. C. Niebles, Y. Shoham, R. Wald, T. Walsh, A. Hamrah, L. Santarlasci, J. B. Lotufo, A. Rome, A. Shi, and S. Oak (2025): "The AI Index 2025 Annual Report," Tech. rep., AI Index Steering Committee, Institute for Human-Centered AI, Stanford University, Stanford, CA.

Min, D. (2021): "Bayesian Persuasion under Partial Commitment," Economic Theory, 72, 743-764.

Russell, S. (2019): Human Compatible: AI and the Problem of Control, Penguin UK.
Sion, M. (1958): "On General Minimax Theorems," Pacific Journal of Mathematics, 8, 171-176.

Sobel, J. (2020): "Lying and Deception in Games," Journal of Political Economy, 128, 907-947.

Wenderott, K., J. Krups, F. Zaruchas, and M. Weigl (2024): "Effects of artificial intelligence implementation on efficiency in medical imaging-a systematic literature review and meta-analysis," npj Digital Medicine, 7, 265.

Whitmeyer, M. (2026): "Blackwell-Monotone Updating Rules," Journal of Political Economy, forthcoming.

Wojtaszczyk, P. (1991): Banach Spaces for Analysts, vol. 25 of Cambridge Studies in Advanced Mathematics, Cambridge, UK: Cambridge University Press.


Robust Trust

## A Proofs


Robust Trust

## A. 1 Proof of Theorem 1

We begin with a key lemma.

Lemma 2. Any optimal solution $\sigma^{*}$ is equivalent to an optimal solution that uses Bayesoptimal private strategies for all $m \in \Delta(\Omega)$.

Proof. Consider the set of state-contingent payoff profiles that are feasible for the agent (cf. Doval and Smolin (2024)):

$$
W=\left\{\mathrm{w} \in \mathbb{R}^{N}: \exists \hat{\sigma}, \mathrm{w}(\omega)=\mathbb{E}_{\hat{\sigma}}[u(a, \omega, \theta) \mid \omega], \forall \omega \in \Omega\right\} .
$$

Since $\theta$ and $s$ are conditionally independent, if the adviser has posterior $s$ and the agent plays a private strategy that corresponds to payoff profile w, the resulting agent's expected payoff is $\mathrm{w} \cdot s$.

The set $W$ is convex, because a convex combination of the private strategies delivers a convex combination of their respective payoff profiles. The set $W$ is compact, because for any $\lambda \in \mathbb{R}^{|\Omega|}, \max _{\mathrm{w} \in W} \lambda \cdot \mathrm{w}$ exists and is attained by some $\mathrm{w} \in W$ by the boundedness and continuity of $u$ in $a$ and the measurable maximum theorem.

Denote the (weak) Pareto frontier of $W$ by $W^{P}$ :

$$
W^{P}=\left\{\mathrm{w} \in W: \nexists \mathrm{w}^{\prime} \in W, \forall \omega \in \Omega, \mathrm{w}^{\prime}(\omega)>\mathrm{w}(\omega)\right\} .
$$

Since $W$ is convex and compact, by the supporting hyperplane theorem, a private strategy $\hat{\sigma}$ is Bayes-optimal for some belief if and only if it delivers a payoff profile in $W^{P}$. Therefore, if $\hat{\sigma}$ is not Bayes-optimal, there exists a dominating $\hat{\sigma}^{\prime}$, which can be taken to be Bayes-optimal itself, such that for all $\omega \in \Omega, \mathbb{E}_{\hat{\sigma}^{\prime}}[u(a, \omega, \theta) \mid \omega]>\mathbb{E}_{\hat{\sigma}}[u(a, \omega, \theta) \mid \omega]$.

Take an optimal solution $\sigma^{*}$ and, for every message $m \in \Delta(\Omega)$, if $\hat{\sigma}^{*}(m)$ is not Bayesoptimal for some belief, replace it with a Bayes-optimal dominating strategy $\hat{\sigma}^{\prime}(m)$. The new strategy, which we call $\sigma_{0}$, must still be optimal. Indeed, the agent's payoff is

$$
\mathbb{E}_{\mu \sim \tau}\left[\alpha \mathrm{w}(\hat{\sigma}(\mu)) \cdot \mu+(1-\alpha) \inf _{m \in \Delta(\Omega)}\{\mathrm{w}(\hat{\sigma}(m)) \cdot \mu\}\right],
$$

which pointwise increases after the change. Moreover, the ex-ante expected payoff must stay the same since $\sigma^{*}$ was optimal to begin with; in particular, $\sigma_{0}$ makes changes to the strategy only for messages $m$ that have joint probability zero. Thus, $\sigma^{*}$ is equivalent to $\sigma_{0}$. $\square$

We can now finish the proof of Theorem 1. Pick any optimal solution $\sigma^{*}$. By Lemma 2, $\sigma^{*}$ is equivalent to an optimal strategy that uses only Bayes-optimal private strategies. Denote
by $\Sigma_{0}$ the set of those private strategies, and let $T_{0}$ be the closure of the set of beliefs at which those private strategies are Bayes-optimal. By continuity, taking the closure does not affect the expected payoff of the strategy $\sigma^{*}$ in the worst-case scenario.

Observe that the agent's expected payoff conditional on the adviser being misaligned is pinned down by the set $\Sigma_{0}$; it does not depend on how individual messages are mapped to different elements of $\Sigma_{0}$ (because the misaligned adviser can report any message). Thus, the mapping from messages to the private strategies in $\Sigma_{0}$ must maximize the expected payoff conditional on the adviser being aligned. Since the aligned adviser is non-strategic, maximization can be performed pointwise, message by message (without loss of optimality, also for messages that are sent with probability zero by the aligned adviser). In particular, for $m \in T_{0}$, we can set $\hat{\sigma}^{*}(m)$ to be the Bayes-optimal strategy for $m$; for $m \notin T_{0}$, we can set $\hat{\sigma}^{*}(m)=\hat{\sigma}^{*}(P(m))$ where $P(m) \in \arg \max _{m^{\prime} \in T_{0}} U\left(\hat{\sigma}^{*}\left(m^{\prime}\right), m\right)$. This way we have constructed a TRS (with the trust region $T_{0}$ ) that is equivalent to $\sigma^{*}$-and is hence optimal. ${ }^{18}$

We now show that for any optimal TRS $\sigma^{*}$, the trust region $T_{0}$ can be enlarged (while preserving the payoffs) to a connected trust region $T_{1}$. Assume that $T_{0}$ is not connected and take any $m_{1}, m_{2} \in T_{0}$ that belong to different connected components of $T_{0}: m_{1} \in T_{0}^{1}$ and $m_{2} \in T_{0}^{2}$. Consider the welfare profiles $\mathrm{w}_{1} \triangleq \mathrm{w}\left(\hat{\sigma}^{*}\left(m_{1}\right)\right)$ and $\mathrm{w}_{2} \triangleq \mathrm{w}\left(\hat{\sigma}^{*}\left(m_{2}\right)\right)$ induced by those messages in the considered solution. Define the subset of Pareto optimal welfare profiles (as in the proof of Lemma 2) that dominate some weighted average of those profiles $\mathrm{w}(\gamma) \triangleq \gamma \mathrm{w}_{1}+(1-\gamma) \mathrm{w}_{2}:$

$$
W^{D}\left(m_{1}, m_{2}\right)=\left\{\mathrm{w} \in W^{P}: \exists \gamma \in[0,1], \mathrm{w} \geq \mathrm{w}(\gamma)\right\} .
$$

Consider any $\mathrm{w} \in W^{D}\left(m_{1}, m_{2}\right)$ that dominates $\mathrm{w}(\gamma)$ for some $\gamma$. Since $\mathrm{w} \in W^{P}$, w is generated by a private strategy $\hat{\sigma}(\mathrm{w})$ Bayes-optimal at a set of beliefs $M_{1}(\mathrm{w})$. We enlarge $T_{0}$ by adding to it the messages in $M_{1}(\mathrm{w}) \backslash T_{0}$ together with the prescription to play $\hat{\sigma}(\mathrm{w})$ at those messages. Doing so does not decrease the payoff from the misaligned adviser because he could already send messages $m_{1}$ and $m_{2}$, and it weakly increases the payoff from the aligned adviser because the trust region increases (in the sense of set inclusion).


Robust Trust

[^14]Since $W$ is convex, $W^{D}\left(m_{1}, m_{2}\right)$ is connected. Furthermore, $M_{1}(\mathrm{w})$ is upper-hemicontinuous with connected (convex) values because it is a normal-cone correspondence. Therefore, the union $\bigcup_{\mathrm{w} \in W^{D}\left(m_{1}, m_{2}\right)} M_{1}(\mathrm{w})$ is connected and contains $m_{1}$ and $m_{2}$. Therefore, adding these beliefs to the original trust region connects the components $T_{0}^{1}$ and $T_{0}^{2}$, with the trust region weakly expanding and remaining optimal. Since this modification can be performed for all connected components of $T_{0}$, this modification results in a connected optimal trust region $T_{1}$.

Finally, by continuity of payoffs, we can without loss of generality consider the closure of the set of used private strategies, and hence the trust region can be chosen to be equal to $T=\operatorname{cl} T_{1}$, which is a compact and connected subset of $\Delta(\Omega)$. Call the new strategy constructed this way $\sigma_{1}$.

By construction, the strategy $\sigma_{1}$ is optimal. Moreover, the expected payoff must stay the same since $\sigma^{*}$ was optimal to begin with; therefore, the new strategy makes changes to the strategy only for messages that have joint probability zero in equilibrium. Thus, $\sigma^{*}$ is equivalent to $\sigma_{1}$.


Robust Trust

## A. 2 Proof of Theorem 2

Suppose $M$ and $\Theta$ are finite. For any given strategy of the misaligned adviser (which was assumed to only use messages in $M$ ) and the agent, $(\beta, \sigma)$, the agent's payoff is, with a slight overload of notation for $V$,

$$
\begin{aligned}
V(\beta, \sigma) \triangleq & \alpha \sum_{\mu \in M, \omega \in \Omega, \theta \in \Theta} \tau(\mu) \mu(\omega) f(\theta \mid \omega) \int_{A} u(a, \omega, \theta) \sigma(d a \mid \mu, \theta)+ \\
& (1-\alpha) \sum_{\mu, m \in M, \omega \in \Omega, \theta \in \Theta} \tau(\mu) \mu(\omega) \beta(m \mid \mu) f(\theta \mid \omega) \int_{A} u(a, \omega, \theta) \sigma(d a \mid m, \theta) .
\end{aligned}
$$

Clearly, $\mathcal{B}$ and $\Sigma$ are convex. Since $M$ is finite, $\mathcal{B}=\times_{m \in M} \Delta(M)$ is compact. Since $M$ and $\Theta$ are finite and $\Delta(A)$ can be equipped with the weak* topology, $\Sigma=\times_{m \in M, \theta \in \Theta} \Delta(A)$ is compact. $V(\beta, \sigma)$ is affine in $\beta$ and in $\sigma$; therefore it is concave-convexlike in Sion (1958)'s terminology. For each $\sigma \in \Sigma, V(\beta, \sigma)$ is continuous in $\beta$. For each $\beta \in \mathcal{B}, V(\beta, \sigma)$ is continuous in $\sigma$. Therefore, a minimax theorem applies in its infsup variation (e.g., Theorem 4.2', Sion (1958))
and

$$
\sup _{\sigma \in \Sigma} \inf _{\beta \in \mathcal{B}} V(\beta, \sigma)=\inf _{\beta \in \mathcal{B}} \sup _{\sigma \in \Sigma} V(\beta, \sigma) .
$$

Furthermore, for any given $\beta, \phi(\beta) \triangleq \sup _{\sigma \in \Sigma} V(\beta, \sigma)$ is attained because $\Sigma$ is compact and $V(\beta, \sigma)$ is continuous in $\sigma$. Similarly, for any given $\sigma, \psi(\sigma) \triangleq \inf _{\beta \in \mathcal{B}} V(\beta, \sigma)$ is attained because $\mathcal{B}$ is compact and $V(\beta, \sigma)$ is continuous in $\beta$. Because $V(\beta, \sigma)$ is continuous, $\phi(\beta)$ is lower-semicontinuous and $\psi(\sigma)$ is upper-semicontinuous. Thus, we can choose $\sigma^{*} \in \arg \max _{\sigma \in \Sigma} \psi(\sigma)$ and $\beta^{*} \in \arg \min _{\beta \in \mathcal{B}} \phi(\beta)$. Then, $\left(\beta^{*}, \sigma^{*}\right)$ form a saddle point:

$$
V\left(\beta^{*}, \sigma\right) \leq V\left(\beta^{*}, \sigma^{*}\right) \leq V\left(\beta, \sigma^{*}\right), \quad \forall \beta \in \mathcal{B}, \sigma \in \Sigma .
$$

Therefore, $\beta^{*}$ is an adversarial adviser's strategy to $\sigma^{*}$, whereas $\sigma^{*}$ is a best-response of the agent to $\beta^{*}$. Since $\alpha>0$ and all $m \in M$ are on-path, the latter implies that after any $m \in M$, the private strategy $\hat{\sigma}^{*}(m)$ is Bayes-optimal given $\beta^{*}$, and hence $\sigma^{*}$ is robustly rationalizable.

Conversely, for any $M$ and $\Theta$, consider $\left(\beta^{*}, \sigma^{*}\right)$ such that $\sigma^{*}$ is robustly rationalizable and $\beta^{*}$ is adversarial against $\sigma^{*}$, i.e., $\left(\beta^{*}, \sigma^{*}\right)$ form a saddle point with property (12). Then, for any $\sigma \in \Sigma$ :

$$
V(\sigma)=\inf _{\beta \in \mathcal{B}} V(\beta, \sigma) \leq V\left(\beta^{*}, \sigma\right) \leq V\left(\beta^{*}, \sigma^{*}\right)=\min _{\beta \in \mathcal{B}} V\left(\beta, \sigma^{*}\right)=V\left(\sigma^{*}\right),
$$

where the third comparison uses the saddle property and the fourth comparison uses the fact that $\beta^{*}$ is adversarial to $\sigma^{*}$. Therefore, $\sigma^{*}$ is an optimal solution.


Robust Trust

## A. 3 Proof of Theorem 3

Notation: In this section, we denote by $I_{K}$ a unit matrix of dimension $K$, by $1_{K}$ a vector of ones of dimension $K$, by $0_{N \times K}$ a matrix of zeros of dimension $N \times K$, by $e_{K}^{i}$ an $i$ th standard basis vector of dimension $K$, by $x_{i, k}$ a $k$ th element of vector $x_{i}$, by $\operatorname{diag} x$ a diagonal matrix with vector $x$ on the main diagonal, and by $X^{\top}$ a transpose of a matrix $X$.

Since $\mu_{0}$ has full support, we can equivalently identify adviser's information with a (row)
stochastic $N \times K$ matrix $\Pi$, where $\Pi_{i j}$ is the probability of the $j$ th signal observed by the adviser in the $i$ th state. Moreover, $\operatorname{rank} \Pi=R(\tau) .{ }^{19}$

We identify the strategy of the misaligned adviser with a stochastic $K \times K$ matrix $B$. Since the aligned adviser reports truthfully, the overall adviser's strategy can be written as a garbling of his information:

$$
G(B) \triangleq \alpha I_{K}+(1-\alpha) B .
$$

By Blackwell (1951), the MVA is a maximal $\alpha$ for which there exists a stochastic matrix $B$ such that $\Pi G(B)$ is Blackwell uninformative; we show below that it is attained. This also implies that MVA depends on $\tau$ only via $\Pi$, so we will write MVA( $\Pi$ ).

We start with preliminary observations. First, note that $G_{k k} \geq \alpha$ and $G 1_{K}=1_{K}$. Second, note that $\Pi G(B)$ is uninformative if and only if all of its rows are equal to each other, that is if and only if

$$
D(\Pi) G(B)=D(\Pi)\left(\alpha I_{K}+(1-\alpha) B\right)=0_{(N-1) \times K},
$$

where $D(\Pi)$ is the row-difference matrix of $\Pi$ :

$$
D(\Pi) \triangleq\left(\begin{array}{c}
\left(\pi_{2}-\pi_{1}\right)^{\top} \\
\vdots \\
\left(\pi_{N}-\pi_{1}\right)^{\top}
\end{array}\right),
$$

and $\pi_{i}^{\top}$ is the $i$ th row of $\Pi$. Consider the auxiliary finite linear program:

$$
\begin{aligned}
\Lambda(\Pi)=\max _{G \in \mathbb{R}^{K \times K}, \alpha \in \mathbb{R}} & \alpha \\
\text { s.t. } & G \geq \alpha I_{K}, G 1_{K}=1_{K}, \\
& D(\Pi) G=0_{(N-1) \times K} .
\end{aligned}
$$

[^15]Lemma 3. $\operatorname{MVA}(\Pi)=\Lambda(\Pi)$.
Proof. We need to show that there exists a stochastic matrix $B$ such that $\Pi G(B)$ is Blackwell uninformative if and only if $\alpha \leq \Lambda(\Pi)$.

Only if: For any given $\alpha$, if $B$ is such that $\Pi G(B)$ is Blackwell uninformative, then we showed that $G(B)$ must satisfy conditions (16-17). By the maximization nature of the problem, if $\alpha>\Lambda(\Pi)$, those conditions cannot be satisfied.

If: If $\alpha \leq \Lambda(\Pi)$, then there exists $G$ that satisfies conditions (16-17) (e.g., the argmax). If $\Lambda(\Pi)=1$, then $B$ can be arbitrary. Otherwise, set $B=\left(G-\alpha I_{K}\right) /(1-\alpha)$. It is straightforward that the so-defined $B$ is a stochastic matrix and by construction $\Pi G(B)$ is uninformative. $\square$

Lemma 3 provides a computationally tractable characterization of MVA for any given $\Pi$ and sets the stage for the rest of the proof, which we split into two lemmas.

Lemma 4. $\operatorname{MVA}(\Pi) \in[1 / R(\Pi), 1 / 2]$. If $R(\Pi)=K$, then $\operatorname{MVA}(\Pi)=1 / K$.

Proof. To ease notation, in the proof we omit the dependence of $R$ on $\Pi$.
1.) $\operatorname{MVA}(\Pi) \leq 1 / 2$.

If $\alpha$ and $G$ satisfy (16-17), then $B=\left(G-\alpha I_{K}\right) /(1-\alpha)$ is a stochastic matrix and

$$
D(\Pi) B=-\frac{\alpha}{1-\alpha} D(\Pi) .
$$

In other words, the rows of $D(\Pi)$ are left eigenvectors of $B$ associated with eigenvalue $-\alpha /(1-\alpha)$. Since $B$ is stochastic, its spectral radius equals 1. Thus, $|-\alpha /(1-\alpha)| \leq 1$ and $\alpha \leq 1 / 2$. It follows that MVA $(\Pi) \leq 1 / 2$.
2.) If $R=K$, then $\operatorname{MVA}(\Pi)=1 / K$.

If $R=K$, then $K \leq N$ and $\operatorname{rank} D(\Pi)=K-1$. Thus, rank $\operatorname{ker} D(\Pi)=K-(K-1)=1$ and, because $D 1_{K}=1_{N-1}-1_{N-1}=0_{N-1}, \operatorname{ker} D=\operatorname{span}\left\{1_{K}\right\}$. Thus, for $(G, \alpha)$ to satisfy (17), every column of $G$ must be a multiple of $1_{K}$. But since $G$ is stochastic, it follows that $\sum_{k=1}^{K} G_{k k}=1$ and $\min _{k} G_{k k} \leq 1 / K$. To further satisfy (16), it must be that $\alpha \leq 1 / K$. Thus, $\operatorname{MVA}(\Pi) \leq 1 / K$.

At the same time, if $\alpha \leq 1 / K$, then $(G, \alpha)$ satisfy (16-17) for $G=1 / K 1_{K} 1_{K}^{\top}$. In this case, $G$ is uninformative, not only $\Pi G$, so the misaligned adviser can make the signal to be uninformative about his estimate, not only about the state. It follows that MVA $\geq 1 / K$ and, therefore, $\operatorname{MVA}(\Pi)=1 / K$.
3.) $\mathrm{MVA} \geq 1 / R$.

Let $\alpha=1 / R$ (recall that $R \geq 2$ ). Consider the normed space ( $\mathbb{R}^{K},\|\cdot\|_{1}$ ) and its linear $(R-1)$-dimensional subspace $\mathbb{W}$ spanned by rows of $D(\Pi)$. By the Auerbach basis theorem, there exist vectors $w_{1}, \ldots, w_{R-1} \in \mathbb{W}$ and $x_{1}, \ldots, x_{R-1} \in \mathbb{R}^{K}$ such that ${ }^{20}$

$$
\left\|w_{i}\right\|_{1}=1, \quad\left\|x_{i}\right\|_{\infty}=1, \quad w_{i}^{\top} x_{j}=\delta_{i j}, \quad 1 \leq i, j \leq R-1 .
$$

Define the corresponding matrices $W \triangleq\left(w_{1}, \ldots, w_{R-1}\right), X \triangleq\left(x_{1}, \ldots, x_{R-1}\right)$. By construction,

$$
W^{\top} X=I_{R-1},
$$

and by properties of $D(\Pi)$,

$$
W^{\top} 1_{K}=0_{R-1} .
$$

Define the vector of weights of rows of $W, \bar{w} \in \mathbb{R}^{K}$, as $\bar{w}_{k} \triangleq \sum_{i=1}^{R-1}\left|w_{i, k}\right|$. Since $\left\|w_{i}\right\|_{1}=1$, we have

$$
\sum_{k=1}^{K} \bar{w}_{k}=\sum_{i=1}^{R-1}\left\|w_{i}\right\|_{1}=R-1 .
$$

We explicitly construct the desired strategy of the misaligned adviser $B$ as:

$$
B=\frac{1}{R-1}\left(1_{K} \bar{w}^{\top}-X W^{\top}\right) .
$$

[^16]Nonnegativity. For all $j, k$,

$$
B_{j k}=\frac{1}{R-1}\left(\sum_{i=1}^{R-1}\left|w_{i, k}\right|-\sum_{i=1}^{R-1} x_{i, j} w_{i, k}\right) \geq 0,
$$

because $\left|x_{i, j}\right| \leq\left\|x_{i}\right\|_{\infty}=1$.
Stochasticity. By (20) and (21):

$$
B 1_{K}=\frac{1}{R-1}\left(1_{K}\left(\bar{w}^{\top} 1_{K}\right)-X\left(W^{\top} 1_{K}\right)\right)=\frac{1}{R-1}\left(1_{K}(R-1)-0_{K}\right)=1_{K} .
$$

Uninformativeness. By (19) and (20):


Robust Trust

$$
W^{\top} B=\frac{1}{R-1}\left(\left(W^{\top} 1_{K}\right) \bar{w}^{\top}-\left(W^{\top} X\right) W^{\top}\right)=\frac{1}{R-1}\left(0_{R-1}-W^{\top}\right)=-\frac{1}{R-1} W^{\top} .
$$

Since by construction columns of $W$ form a basis in the row space of $D(\Pi)$, it follows that

$$
D(\Pi) B=-\frac{1}{R-1} D(\Pi) .
$$

As $\alpha=1 / R$, this corresponds exactly to constraint (17). The result follows. $\square$

Lemma 5. For any $N \geq 2$ and $\alpha \in[1 / N, 1 / 2]$, there exist $K$ and $\Pi$ such that $\operatorname{MVA}(\Pi)=\alpha$.
Proof. The proof is by direct construction. For $N=2$, the result is trivial. For $N \geq 3$, consider $K \in[4, N+1]$ and, for $\delta \in[0,1]$, the $N \times K$ matrix $\Pi$ such that

$$
\begin{aligned}
\pi_{i}^{\top} & =\frac{1}{K} 1_{K}^{\top}, \quad i=1 \text { or } i=K, K+1, \ldots, N, \\
\pi_{i}^{\top} & =\frac{1}{K}\left(1_{K}+e_{K}^{i}-e_{K}^{1}\right)^{\top}, \quad i=2, \ldots, K-2, \\
\pi_{i}^{\top} & =\frac{1}{K}\left(1_{K}+e_{K}^{i}-\delta e_{K}^{1}-(1-\delta) e_{K}^{K}\right)^{\top}, \quad i=K-1,
\end{aligned}
$$

where $e_{K}^{i}$ is the $i$ th basis vector of $\mathbb{R}^{K}$. By construction, $\Pi$ is a stochastic matrix. Consider MVA(П) that solves the corresponding problem (15).

The constraint $D(\Pi) G=0_{(N-1) \times K}$ reduces to:

$$
\left(e_{K}^{i}-e_{K}^{1}\right)^{\top} G=0, \quad i=2, \ldots, K-2, \quad\left(e_{K}^{K-1}-\delta e_{K}^{1}-(1-\delta) e_{K}^{K}\right)^{\top} G=0,
$$

which effectively states that the first $K-2$ rows are equal to each other and the $(K-1)$ th row is a convex combination of the 1st and the $K$ th rows with weight $\delta$. Thus, the effective variables are the 1st and the $K$ th rows of the matrix $G$. The constraints $G \geq \alpha I_{K \times K}$ and $G 1_{K}=1_{K}$ then reduce to those rows being probability vectors, such that

$$
G_{1 k} \geq \alpha, k=1, \ldots, K-2,\left(\delta G_{1, K-1}+(1-\delta) G_{K, K-1}\right) \geq \alpha, G_{K K} \geq \alpha .
$$

Therefore,

$$
\alpha \leq\left(\delta G_{1, K-1}+(1-\delta) G_{K, K-1}\right) \leq \delta(1-(K-2) \alpha)+(1-\delta)(1-\alpha)=1-\alpha(1+\delta(K-3)) .
$$

Rearranging yields

$$
\alpha \leq \alpha^{\dagger} \triangleq \frac{1}{2+\delta(K-3)},
$$

and thus MVA $(\Pi) \leq \alpha^{\dagger}$. Whenever $\delta \geq(K-4) /(K-3), \alpha^{\dagger} \leq 1 /(K-2)$ and the bound $\alpha^{\dagger}$ can be attained by $G$ with the 1st and the $K$ th rows being (the rest of $G$ is pinned down by condition (23)):

$$
\begin{array}{rlrlrl}
G_{1 k} & =\alpha^{\dagger}, k=1, \ldots, K-2, & & G_{1, K-1} & =1-(K-2) \alpha^{\dagger}, & \\
G_{K k} & =0, k=1, \ldots, K-2, & & G_{K, K-1} & =1-\alpha^{\dagger}, & \\
G_{K K} & =\alpha^{\dagger} .
\end{array}
$$

Thus, $\mathrm{MVA}(\Pi)=\alpha^{\dagger}$. At $\delta=(K-4) /(K-3), \alpha^{\dagger}=1 /(K-2)$; at $\delta=1, \alpha^{\dagger}=1 /(K-1)$.
This establishes that, for all $K \in[4, N+1]$, as $\delta$ spans $[(K-4) /(K-3), 1]$, the proposed $\Pi$ achieves MVA( $\Pi$ ) that spans $[1 /(K-1), 1 /(K-2)]$. Spanning $K$ from 4 to $N+1$, we obtain the result. $\square$


Robust Trust

## A. 4 On Strictly Convex Indirect Utility

In this section, we show that the indirect utility is strictly convex when the agent's private information induces a full-support distribution of beliefs.

Specifically, we assume that the agent's ex-post payoff is type-independent, $u(a, \omega)$, and identify $\theta$ with the belief it induces in the absence of any other information: $\Theta \subseteq \Delta(\Omega)$, $\theta(\omega)=\operatorname{Pr}(\omega \mid \theta)$. We denote by $\nu$ the final posterior belief that the agent forms, i.e., conditional on both the adviser's message and the agent's type:

$$
\nu_{\mu, \theta} \triangleq \operatorname{Pr}(\omega \mid \mu, \theta)=\frac{\mu(\omega) f(\theta \mid \omega)}{\sum_{\omega^{\prime} \in \Omega} \mu\left(\omega^{\prime}\right) f\left(\theta \mid \omega^{\prime}\right)} .
$$

A necessary and sufficient condition for a private strategy $\hat{\sigma}$ to be Bayes-optimal at any given interim belief $\mu, \hat{\sigma} \in \arg \max _{\hat{\sigma}^{\prime}} U\left(\hat{\sigma}^{\prime}, \mu\right)$, is that $\hat{\sigma}(\cdot \mid \theta) \in \Delta(A)$ is an optimal best-response with respect to $\nu_{\mu, \theta}$ : for all $a \in \operatorname{supp} \hat{\sigma}(\cdot \mid \theta)$,

$$
a \in \arg \max _{a^{\prime} \in A} \sum_{\omega \in \Omega} \nu_{\mu, \theta}(\omega) u\left(a^{\prime}, \omega\right) .
$$

Assumption 2. $A$ is finite and there exist $a_{1}, a_{2} \in A$ and $\mu \in \operatorname{int}(\Delta(\Omega))$ such that $\mathbb{E}_{\mu}\left[u\left(a_{1}, \omega\right)\right]=\mathbb{E}_{\mu}\left[u\left(a_{2}, \omega\right)\right]>\mathbb{E}_{\mu}[u(a, \omega)]$ for all $a \notin\left\{a_{1}, a_{2}\right\}$. In addition, for each $\omega \in \Omega$ either $u\left(a_{1}, \omega\right)>u\left(a_{2}, \omega\right)$ or $u\left(a_{2}, \omega\right)>u\left(a_{1}, \omega\right)$.

Lemma 6. Suppose $\theta$ has full support on $\Delta(\Omega)$ and Assumption 2 holds. Then, $U(\mu)$ is strictly convex in the interior of $\Delta(\Omega)$.

Proof. A sufficient condition for strict convexity of $U(\mu)$ in the interior of $\Delta(\Omega)$ is that for any $\mu_{1}, \mu_{2} \in \operatorname{int}(\Delta(\Omega)), \mu_{1} \neq \mu_{2}$,

$$
\arg \max _{\hat{\sigma}} U\left(\hat{\sigma}, \mu_{1}\right) \cap \arg \max _{\hat{\sigma}} U\left(\hat{\sigma}, \mu_{2}\right)=\emptyset .
$$

Fix any such $\mu_{1}, \mu_{2}$. Let $\mu \in \operatorname{int}(\Delta(\Omega))$ be the belief from Assumption 2 and define $d(\omega) \triangleq u\left(a_{1}, \omega\right)-u\left(a_{2}, \omega\right), r(\omega) \triangleq \mu_{2}(\omega) / \mu_{1}(\omega)$. By Assumption 2 and continuity of the expected payoff in belief, there exists an open neighborhood $O \subset \operatorname{int}(\Delta(\Omega))$ of $\mu$ such that for every $\nu \in O$, action $a_{1}$ is uniquely optimal whenever $\nu \cdot d>0$, and not optimal whenever
$\nu \cdot d<0$, because it is outperformed by $a_{2}$. Define

$$
R_{1} \triangleq\{\nu \in O: \nu \cdot d>0\}, \quad R_{2} \triangleq\{\nu \in \Delta(\Omega): \nu \cdot d<0\} .
$$

Bayes' rule implies that for every $\omega$ and $\theta, \nu_{\mu_{2}, \theta}=\Gamma\left(\nu_{\mu_{1}, \theta}\right)$, where $\Gamma: \operatorname{int}(\Delta(\Omega)) \rightarrow \operatorname{int}(\Delta(\Omega))$ is the map defined by

$$
\Gamma(\nu)(\omega) \triangleq \frac{\nu(\omega) r(\omega)}{\sum_{\omega^{\prime}} \nu\left(\omega^{\prime}\right) r\left(\omega^{\prime}\right)}
$$

Since $\mu_{1} \neq \mu_{2}, r$ is not constant; because $d(\omega) \neq 0$ for all $\omega$, the hyperplanes $\{\nu: \nu \cdot d=0\}$ and $\{\nu: \nu \cdot(r * d)=0\}$, where $*$ denotes the component-wise product, are distinct. As $\mu \in O \cap\{\nu: \nu \cdot d=0\}$, we can choose $\bar{\nu} \in O$ such that $\bar{\nu} \cdot d=0$ and $\bar{\nu} \cdot(r * d) \neq 0$. Without loss of generality, suppose $\bar{\nu} \cdot(r * d)<0$; otherwise swap the labels of $a_{1}$ and $a_{2}$. By continuity, there exists a nonempty open set $A \subset R_{1}$ such that $\nu \cdot(r * d)<0$ for all $\nu \in A$. For every $\nu \in A$,

$$
\Gamma(\nu) \cdot d=\frac{\nu \cdot(r * d)}{\nu \cdot r}<0,
$$

so $\Gamma(A) \subset R_{2}$. The map $\theta \mapsto \nu_{\mu_{1}, \theta}$ is continuous and onto $\operatorname{int}(\Delta(\Omega))$. Hence $\Theta_{0} \triangleq\{\theta$ : $\left.\nu_{\mu_{1}, \theta} \in A\right\}$ is nonempty and open; since $\theta$ has full support on $\Delta(\Omega)$, it has strictly positive probability.

For every $\theta \in \Theta_{0}$ we have $\nu_{\mu_{1}, \theta} \in R_{1}$ and $\nu_{\mu_{2}, \theta} \in R_{2}$. This means that the private strategies optimal at $\mu_{1}$ and $\mu_{2}$ must necessarily differ on $\theta \in \Theta_{0}$. The result follows. $\square$


Robust Trust

## A. 5 Proof of Lemma 1

The misaligned adviser with signal realization $\mu$ minimizes $U\left(\hat{\sigma}\left(\mu^{\prime}\right), \mu\right)$ over $\mu^{\prime}$ in the trust region. Recall that the function $U\left(\hat{\sigma}\left(\mu^{\prime}\right), \mu\right)$ is linear in $\mu$, and we assumed that $U(\mu)=$ $\max _{\hat{\sigma}} U(\hat{\sigma}, \mu)$ is strictly convex and twice differentiable in $\mu$. This means that $U\left(\hat{\sigma}\left(\mu^{\prime}\right), \mu\right)$ is the value at $\mu$ of the hyperplane supporting $U$ at $\mu^{\prime}$. Under our convention that $\mu$ is the
probability of state 1, this means that

$$
U\left(\hat{\sigma}\left(\mu^{\prime}\right), \mu\right)=U\left(\mu^{\prime}\right)+U^{\prime}\left(\mu^{\prime}\right)\left(\mu-\mu^{\prime}\right) .
$$

By convexity of $U$, this function is quasi-concave in $\mu^{\prime}$, and hence for all $\mu^{\prime} \in[\underline{\mu}, \bar{\mu}]$, $U\left(\hat{\sigma}\left(\mu^{\prime}\right), \mu\right) \geq \min \{U(\hat{\sigma}(\underline{\mu}), \mu), U(\hat{\sigma}(\bar{\mu}), \mu)\}$. Thus, the misaligned adviser's strategy takes a threshold form. The threshold $b(\underline{\mu}, \bar{\mu})$ is the intersection point of the supporting lines to $U$ at points $\underline{\mu}$ and $\bar{\mu}$ :

$$
U(\underline{\mu})+U^{\prime}(\underline{\mu})(b(\underline{\mu}, \bar{\mu})-\underline{\mu})=U(\bar{\mu})+U^{\prime}(\bar{\mu})(b(\underline{\mu}, \bar{\mu})-\bar{\mu}) .
$$

If $\underline{\mu}=\bar{\mu}=\mu, b(\underline{\mu}, \bar{\mu})=\mu$, coinciding with (5) by continuity. Otherwise, rearranging, we obtain:

$$
b(\underline{\mu}, \bar{\mu})=\frac{\bar{\mu} U^{\prime}(\bar{\mu})-\underline{\mu} U^{\prime}(\underline{\mu})-(U(\bar{\mu})-U(\underline{\mu}))}{U^{\prime}(\bar{\mu})-U^{\prime}(\underline{\mu})} .
$$

Applying integration by parts, the numerator equals $\int_{\underline{\mu}}^{\bar{\mu}} \mu U^{\prime \prime}(\mu) d \mu$ and the denominator equals $\int_{\underline{\mu}}^{\bar{\mu}} U^{\prime \prime}(\mu) d \mu$. The result follows.