It is easy to envisage that new defensive toxins might spread through prey populations in a straightforward manner, since the toxin can be beneficial to each individual that has it. This simple scenario however omits the wider effects that toxins can have, benefiting other potential victims by delaying and disabling enemies such as predators and thereby contributing to a “common good of protection”. Such a “common good” would disincentivise defence investment by individuals (Daly et al. 2012a). Furthermore it is possible that individuals do not gain a benefit of increased survival from their toxins, but rather close kin may be beneficiaries. The case for kin over individual selection for prey defences has been strengthened by a field study that failed to show individual benefits to chemical defence (Jones et al. 2013) in prey subject to predation by free-living birds. In our present experiment we use wild-caught birds as predators and insect larvae as prey hence we can gain some handle on how toxicity benefits individuals and other prey in more ecologically relevant conditions. This enables us to resolve the issue of individual benefits from defence. We discuss these results first. Subsequently we explore the application of experimental data to simple models of toxin evolution. We discuss ways that we might be able to predict the presence or absence and the frequency of “automimic” defence cheats.

Individual and common benefits from toxin investment

We demonstrated both a common good from toxin presence (lower attack probabilities on individuals) and strong survival benefits to defended individuals (higher likelihood of survival). The addition of the chemical defence substantially increased the probability of prey survival when an attack took place (by more than 65 %), irrespective of the frequency of nondefended cheats in the population (Lindström et al. 1997). The demonstration of individual survival contrasts with our fieldwork experiments in which individual survival benefits were not observed, probably because birds made decisions to ingest or reject prey hidden in trees and shrubs, away from the foraging site (Jones et al. 2013). A lack of effect of defence frequency on survival from attack contrasts with results from chick experiments (Gamberale-Stille and Guilford 2004; Skelhorn and Rowe 2007) where taste-rejection of prey was affected by the relative frequency as defended prey increased.

Chemical defence is sometimes associated with defensive aggregations because grouping leads to more rapid toxicosis in predators, and hence a higher, localised common good (Sillen-Tullberg and Leimar 1988; Curley et al. 2015). Hence we expected higher survival in aggregated than dispersed prey distributions. In contrast we found that aggregation tended to decrease survival probability (Fig. 1). One explanation is that our prey lacked aposematic colouration, and hence did not evoke the kind of phobic reactions that are associated with aposematic aggregation (Gamberale and Tullberg 1996; but see Alatalo and Mappes 1996; Riipi et al. 2001).

Overall then we can reproduce the general results of a field experiment (Jones et al. 2013) in the lab with ecologically relevant predators, these do show additionally however that individual survival is increased by chemical defence, making the results with ecologically appropriate predators consistent with those gained from studies with chicks. This experiment serves (importantly in our view) to verify publications using chickens as model predators (Gamberale-Stille and Guilford 2004; Skelhorn and Rowe 2007), as wild caught birds responded rapidly to variation in model frequency and showed taste-rejection behaviours similar to chicks. However our experiments used insect prey with experimentally added chemical defences (here “Chloroquinine”), so an important next step is to evaluate the effects of automimicry with real prey using their own chemical defences, for example including secretory chemical defences.

Though our data support the hypothesis that defensive toxins evolve to benefit individuals, we note that kin selection can none the less apply to toxin evolution if prey are localised in family groups. This may often be the case in chemically defended insect larvae, so that the optimal investment made by a prey is determined by both individual and kin selection. Kin selection has been arguably overlooked in studies of chemical defence evolution, since Fisher introduced the idea (Fisher 1958). Perhaps the most compelling example in the literature is the colonial grain aphid (Sitobion avenae) which uses cornicle secretions against enemies such as the parasitoid wasp (Aphidius rhopalosiphi). Wu et al. (2010) demonstrated that the secretion had no benefit for individuals, since aphids that used the defensive secretion were no more likely to survive the current attack, and were in fact less likely to survive a second attack in the same experimental trial. Smearing of the wasp with “aphid wax” however benefitted other group members because the wasp was diverted from attack behaviour by grooming behaviours to clean the wax off. A kin selection explanation predicts greater investment in defence if the family group size increases and indeed after statistically controlling for group size. Wu et al. (2010) found higher rates of smearing-secretion as the number of clone mates in the group increased.

Aphids are an obvious (and excellent) case study for the study of kin selection in prey defence, because colonies are often clonal. More challenging, but no less interesting, are examples of aggregations of sexually reproducing prey. Here there can be a complex balance of direct individual benefit from defence versus indirect benefits from the defence protecting close kin. Though we used quinine as a way to generate controlled levels of toxicity, many species reserve their costly toxins until attack takes place, and then secrete toxins as a last resort of defence (Skelhorn and Rowe 2006a; Daly et al. 2012b). Hence an interesting (but challenging) extension of our modelling would be to include secretory defences and kin selection, as in for example in the large white butterfly (Pieris brassicae, Higginson et al. 2011; Daly et al. 2012a).

We note that our experimental work is complimentary to a wider literature on private and public goods in microbial systems (see examples and reviews in Driscoll et al. 2013, 2016).

Evolution of toxicity in our model

In the second part of our work we took parameters from our lab experiments, and predicted the stable evolutionary levels of toxin frequencies within prey populations. The model used is by design very simple, we hope that it serves to explain in a nontechnical manner how defence cheating evolves and is stable (Fig. 3). More rigorous analyses of automimicry are (rightly) mathematically complex (Broom et al. 2005; Svennungsen and Holen 2007a). Perhaps the simplicity of the underlying mechanism that makes toxin cheating stable is not sufficiently obvious to empirically focused researchers from these technical treatments. We hope that the simple treatment here is effective in this respect.

Using parameters from our experiments it is possible to make predictions about the evolution of toxicity, albeit without kin selection. We can predict the course of new, rare, defended mutants judging whether they are likely to invade, to reach fixation, or to remain at a stable level. We can see (Fig. 4) that our model predicts toxin conferring mutants do not invade when there are high costs of toxicity combined with short season lengths (or relatively short juvenile periods, of 1000 time intervals, e.g. blue line, residual fecundity on x axis = 0.7). Conversely the same defensive mutant (residual fecundity value = 0.7) would rise to fixation with long season lengths (or juvenile periods, black line). Between these extremes we have stable dimorphisms, with toxin frequency rising with season length and falling with costs (right to left on x axis).

Can we predict frequencies of cheating in natural populations?

An interesting point which emerges from our simple model is how few parameters might be necessary to enable a quantitative prediction of the equilibrium frequency of defended prey forms. Our model needs data on: (1) the frequency of attacks per unit time, which can be decomposed into probability of detection per unit time (p 1 ), probability of attack given detection (p 2 in Eq. 1); (2) frequency of survival from attack (p 3 ) (3) costs of defence (F o ) and (4) duration to reproduction (t, assuming a semelparous life history), and number of offspring. The important question is then (in our view), can each of these be measured so that the frequency of cheats can be predicted for a given population?

Some of these parameters are relatively tractable for some systems. Using laboratory methods like those reported here we can for example ascertain probability of surviving an attack. In our study there is conveniently no effect of frequency of defended prey on this parameter; but this is not necessarily the case (Gamberale-Stille and Guilford 2004; Skelhorn and Rowe 2007), and a parameterised function will have to be generated to account for variation in this parameter. Costs of chemical defence for a number of systems can be measured (see reviews in Bowers 1992a; Ruxton et al. 2004), these are most helpful for our purposes when they are expressed as reduced fecundity or survivorship (an additional term to the model above would be needed). Costs measured as reduced growth and reduced population growth would require a more complex model.

However estimating probability of attack per unit time in the wild is probably more challenging. Estimating frequencies each of detection and attack given detection in the field are very difficult, because prey can be detected (and subsequently ignored) from considerable distances by predators. This is (in our view) almost impossible to estimate. More tractably, experimental prey could be set out in the field and with the use of sufficiently sensitive camera traps, the rate of attack per unit time can be measured. This is not likely to be a trivial task because each prey would require its own camera trap, limiting the number of prey that can be assessed. In addition since attack probability (likely) changes with the frequency of defended prey, experimenters would need to present a range of frequencies of defended prey. They would also need to carefully assess the density of the naturally occurring prey species in the locality.

Given the many challenges of testing quantitative predictions of the model in natural systems, an alternative (and promising) approach to testing the validity of the model presented here (and indeed of more complex alternatives (Broom et al. 2005; Svennungsen and Holen 2007a) is to use an experimental evolution approach, in which for example, artificial prey evolve toxin traits across generations in which costs of defence and duration of the juvenile period are specified by the experimenter. Lab housed, or free living predators provide selection between prey generations. The key benefit of this approach is to test whether predator behaviour can drive toxin evolution in a manner predicted by a simple model.