Adversarial Hypothesis Testing

• Adversarial hypothesis testing is a framework for robust statistical decisions under adversarial data manipulation, focusing on worst-case error exponents.
• It employs sequential two-threshold SPRT, divergence projections, and martingale methods to optimize trade-offs between false alarm and missed detection rates.
• The approach underpins applications in cybersecurity, robust control, quantum testing, and privacy-utility trade-offs in complex adaptive environments.

Adversarial hypothesis testing refers to statistical decision-making in the presence of adversaries who can manipulate, perturb, or adaptively choose data with the aim of increasing detection error. Unlike conventional hypothesis testing, the error exponents and achievable performance are evaluated in worst-case regimes—incorporating game-theoretic or minimax perspectives where an adversary acts to degrade the statistical distinguishability between hypotheses.

1. Foundational Model: Sequential Adversarial Binary Testing

In sequential adversarial hypothesis testing, two competing composite hypotheses are specified by convex, disjoint sets of distributions $\mathcal{P},\,\mathcal{Q}\subset\Delta(\mathcal X)$. For each hypothesis, an adversary adaptively selects at each step a distribution from the corresponding set conditional on the full past, generating observations potentially designed to maximally confuse the detector. Formally, under $H_0$, the process is $X_i\sim\hat p_i(X^{i-1})$ with each $\hat p_i:\mathcal X^{i-1}\to\mathcal{P}$; under $H_1$, similarly $X_i\sim\hat q_i(X^{i-1})$ with $\hat q_i:\mathcal X^{i-1}\to\mathcal{Q}$. The detector employs a stopping time $\tau$ and a terminal decision $Z\in\{0,1\}$ based on the partial sample $X^{\tau}$ (Modak et al., 13 Nov 2025).

2. Error Exponents and Achievable Trade-offs

Define the worst-case error probabilities under all adversarial strategies:

• $$\alpha_n = \sup_{\mathcal{A}_n} \mathbb{P}_0[Z_n=1]$$, false alarm
• $\beta_n = \sup_{\mathcal{A}_n} \mathbb{P}_1[Z_n=0]$, missed detection

The (asymptotic) error exponents are

$$E_0 = -\liminf_{n\to\infty} \frac{1}{n} \log \alpha_n,\quad E_1 = -\liminf_{n\to\infty} \frac{1}{n} \log \beta_n.$$

For sequential adversarial testing with unbounded stopping times, the closure of the region of achievable exponent pairs $(E_0,E_1)$ is exactly

$$\mathcal{E}(\mathcal{P},\mathcal{Q}) = \{ (E_0,E_1) \geq 0 : E_0 E_1 \leq D(q_1^*||p_1^*) D(p_0^*||q_0^*) \}$$

where

• $$(p_0^*,q_0^*) = \arg\min_{p\in\mathcal{P},q\in\mathcal{Q}} D(p||q)$$,
• $$(p_1^*,q_1^*) = \arg\min_{p\in\mathcal{P},q\in\mathcal{Q}} D(q||p)$$, with $D(p||q)$ denoting KL divergence.

Every point on the boundary $E_0 E_1 = D(q_1^*||p_1^*) D(p_0^*||q_0^*)$ is achievable by a modified two-threshold sequential probability ratio test (SPRT). This characterization is sharp—improvements over fixed-length (non-sequential) settings are substantial: sequential sampling attains both Chernoff–Stein exponents $D(q_1^*||p_1^*)$ and $D(p_0^*||q_0^*)$ simultaneously, while fixed-length tests yield a strictly smaller trade-off curve (Modak et al., 13 Nov 2025).

3. Tight Variants and Constraints

Imposing additional constraints modifies the exponent region:

• Constraint on sample length tail: If $\mathbb{P}[\,\tau_n > n\,] < \varepsilon$ under both hypotheses, achievable exponents fill the rectangle $$0\leq E_0\leq D(q_1^*||p_1^*),~0\leq E_1\leq D(p_0^*||q_0^*)$$.
• Error-probability constraint: Fixing error levels and letting them tend to zero, the rectangle is reversed: $$0\leq E_0\leq D(p_0^*||q_0^*),~0\leq E_1\leq D(q_1^*||p_1^*)$$.

In both cases, the extreme corners (maximum exponents in both directions) are achievable (Modak et al., 13 Nov 2025).

4. Proof Techniques: Minimax, Martingales, and Large Deviations

The fundamental technical ingredients include:

• Divergence projections: Worst-case adversarial distributions are obtained as unique minimizers in the closed convex sets, exploiting Pythagorean-type projections in KL space.
• Martingale and stopping-time arguments: For the log-likelihood sums, $S_{0,t}$ and $S_{1,t}$, associated to the worst-case distributions, submartingale properties under adaptive adversary strategies enable tight exponential concentration and error analysis.
• Sequential two-threshold test: Stopping at the first time either $S_{0,t}\geq \theta_0 n$ or $S_{1,t}\geq \theta_1 n$ and deciding accordingly ensures both high-probability termination and optimal error decay.
• Converse via data-processing bounds: Upper bounds on achievable exponents follow from applying binary-testing inequalities and data-processing bounds for i.i.d. adversary strategies.

The combination of these enables a full characterization of the exponent region and shows that adversarial adaptivity does not worsen exponent rates beyond what is captured by minimizing KL divergences over sets [(Modak et al., 13 Nov 2025); (Brandao et al., 2013)].

5. Relation to Classical and Quantum Adversarial Testing

The minimax exponents in adversarial classical hypothesis testing generalize directly to quantum composite settings. Brandão et al. (Brandao et al., 2013) showed that for closed convex $\mathcal{P},\mathcal{Q}$, even adaptive adversaries (selecting $p_k\in\mathcal{P}$, $q_k\in\mathcal{Q}$ based on past samples) cannot degrade the error exponent below $$E_\text{adv}(\mathcal{P},\mathcal{Q}) = \inf_{p\in\mathcal{P},q\in\mathcal{Q}} D(p||q)$$. Application to quantum Stein’s lemma under restricted measurement classes yields analogous adversarial exponent characterizations, reflecting that under block-coding, the worst-case adaptive adversarial quantum channel corresponds to a fixed classical divergence minimization step (Brandao et al., 2013).

6. Broader Impact and Generalizations

• Adversarial games and control: The sequential adversarial testing paradigm now informs robust control, deceptive inference in multi-agent systems, and cybersecurity, where Stackelberg games can embed sequential hypothesis testing directly in strategic dynamics (Zhou et al., 19 Feb 2025, Zhou et al., 3 Sep 2025).
• Adversarial channel discrimination: Extensions to transmission over channels under adversarial selection show that availability of randomness (private or shared), multi-letter coding, and determinism yield nontrivial separations in achievable exponents (Modak et al., 2023).
• Robust nonparametric and kernel testing: Minimax-optimal rates under adversarial corruption—e.g., for MMD, HSIC, or DP-permutation tests—rely on controlling test statistic sensitivity and recalibrating error quantiles (Schrab et al., 2024).
• Fundamental privacy-utility trade-offs: Non-stochastic and stochastic models quantify how the structure of the hypothesis and permitted adversarial manipulations fundamentally constrain distinguishability and thereby enable operational notions of privacy (Farokhi, 2019, Li et al., 2018).
• Quantum settings: Regularization phenomena and the role of entanglement renormalize the significance of adversarial knowledge—e.g., the "informed-vs-uninformed Bob" distinction in Stein exponents vanishes for QQ channels under entanglement but remains strict for CQ channels (Hayashi et al., 15 Jan 2026).

7. Summary Table: Error Exponent Regions under Major Regimes

Regime	Achievable Exponent Region	Key Characterization
Sequential adversarial, expectation-constrained	$$\{(E_0,E_1)\geq 0\,:\,E_0 E_1\leq D(q_1^*||p_1^*) D(p_0^*||q_0^*)\}$$	Hyperbola-type, two-threshold SPRT achieves boundary (Modak et al., 13 Nov 2025)
Fixed-length adversarial	Strict subset; convex, does not reach Chernoff points	Cannot attain both Chernoff–Stein exponents simultaneously
Add’l sample-size/probability constraint	Rectangle: $0\leq E_0\leq D(q_1^*||p_1^*)$, $0\leq E_1\leq D(p_0^*||q_0^*)$	Both maximum exponents achievable
Classical convex composite (non-sequential)	$$E_\text{adv} = \inf_{p\in\mathcal{P},q\in\mathcal{Q}} D(p||q)$$	Adversarial Chernoff–Stein lemma (Brandao et al., 2013)
Quantum (restricted measurements)	$$E_{\mathcal{M}} = D_{\mathcal{M}}(\mathcal{R}||\mathcal{S})$$	Block-coding, minimax over blocks (Brandao et al., 2013)

The adversarial hypothesis testing literature thus provides precise, minimax-exact exponents and identifies threshold and policy structures for optimal performance under adversarial data manipulations across classical, non-stochastic, and quantum settings, with consequences for information-theoretic security, privacy, and robust statistical inference [(Modak et al., 13 Nov 2025); (Brandao et al., 2013); (Farokhi, 2019); (Schrab et al., 2024)].