AC-IHT: Robust Sparse Recovery Methods

• AC-IHT is a family of robust sparse-recovery algorithms that combine iterative gradient-like updates with hard thresholding to counter adversarial contamination across various models.
• It is applied in settings like 1-bit compressed sensing, contaminated high-dimensional regression, and augmented compressed sensing, tailoring thresholding to both signal and corruption components.
• The methods achieve optimal or near-optimal sample complexities and error bounds, with proofs leveraging properties such as restricted isometry, contractive mappings, and debiasing techniques.

Searching arXiv for the cited AC-IHT-related papers and closely related context. I’m checking arXiv records for the specific papers and related work on robust IHT under adversarial contamination. Adversarial Contamination-resistant Iterative Hard Thresholding (AC-IHT) denotes a class of nonconvex sparse-recovery procedures that combine iterative gradient-like updates with hard thresholding in order to remain stable under adversarial contamination. Across the recent literature, the label has been used for several closely related constructions rather than for a single canonical algorithm: a robust Binary Iterative Hard Thresholding method for 1-bit compressed sensing with adversarial sign flips, a two-stage procedure for contaminated high-dimensional regression that jointly estimates a sparse coefficient vector and a sparse contamination vector, and an augmented IHT scheme for classical linear measurements corrupted by sparse gross errors (Matsumoto et al., 2023, Liu et al., 26 Jun 2026, Dhaliwal et al., 2019). In all cases, the central idea is to preserve sparsity by explicit thresholding while absorbing contamination either implicitly through a robust proxy update or explicitly through a second sparse variable.

1. Terminological scope and conceptual core

The term AC-IHT is not tied to a single statistical model. In the 1-bit compressed sensing setting, it refers to “BIHT with adversarial robustness,” where only the signs of linear measurements are observed and a fraction of those signs may be flipped arbitrarily (Matsumoto et al., 2023). In contaminated high-dimensional regression, AC-IHT is a two-stage hard-thresholding algorithm for the model

$Y = X\beta^* + \sqrt{n}\,\theta^* + \xi,$

where $\beta^*$ is $s$-sparse and $\theta^*$ is $o$-sparse (Liu et al., 26 Jun 2026). In the earlier compressed-sensing defense formulation, AC-IHT augments the signal with an explicit sparse attack vector $w$ and applies block hard thresholding to the concatenated variable $z=[x;w]$ under observations $y=\Phi x^*+w$ with $\|w\|_0\le t$ (Dhaliwal et al., 2019).

Despite these differences, the family has a consistent algorithmic template. Each iteration forms an update from residual information, applies coordinatewise or blockwise hard thresholding, and repeats until a contraction or threshold-limit regime is reached. This suggests that AC-IHT is best understood as a robust IHT paradigm specialized to different observation models rather than as a single fixed algorithm.

Setting	State variables	Contamination model
1-bit compressed sensing	$x^{(t)}\in S^{n-1}$, $\beta^*$0-sparse	Up to a $\beta^*$1-fraction of sign measurements flipped arbitrarily
High-dimensional regression	$\beta^*$2	Sparse contamination vector $\beta^*$3 in the response
Linear compressed sensing with gross errors	$\beta^*$4	$\beta^*$5-bounded attack vector $\beta^*$6 with $\beta^*$7

A common misconception is that AC-IHT always means “hard thresholding applied only to the signal.” The regression and augmented compressed-sensing variants explicitly threshold both the signal and a contamination component, whereas the 1-bit version keeps only a $\beta^*$8-sparse signal iterate and incorporates contamination through the sign-mismatch structure.

2. AC-IHT for 1-bit compressed sensing with adversarial flips

In 1-bit compressed sensing, the signal model is an unknown $\beta^*$9-sparse unit vector $s$0, measurement vectors $s$1 drawn i.i.d. from $s$2, noiseless signs $s$3, and observed signs $s$4 satisfying

$s$5

so that up to $s$6 entries have been flipped arbitrarily (Matsumoto et al., 2023). The objective is a universal recovery statement: for given $s$7 and $s$8, design a single Gaussian measurement matrix and an efficient decoder such that, with high probability over the matrix draw,

$s$9

for all $\theta^*$0-sparse $\theta^*$1 simultaneously, using $\theta^*$2 measurements.

The algorithmic form is Binary IHT. Starting from a $\theta^*$3-sparse unit-norm iterate $\theta^*$4, one computes

$\theta^*$5

then performs

$\theta^*$6

where $\theta^*$7 retains the largest $\theta^*$8 coordinates in magnitude. The stated recommended parameters are $\theta^*$9, $o$0, and random $o$1-sparse initialization (Matsumoto et al., 2023).

The principal guarantee is that if $o$2 has i.i.d. $o$3 rows and

$o$4

then with probability at least $o$5, the AC-IHT output satisfies

$o$6

and this is universal in the sense that one draw of $o$7 works for all $o$8 with $o$9 (Matsumoto et al., 2023). The paper further emphasizes that BIHT “provides better results than all known methods for the noisy setting,” matches the optimal sample complexity $w$0 from the noiseless case, and remains agnostic to $w$1.

The 1-bit formulation is distinctive because the contamination is purely combinatorial at the observation level: the measurements are already quantized to signs, so adversarial corruption acts by sign flips rather than by additive analog noise. A plausible implication is that robustness in this regime depends less on classical residual magnitude control and more on geometry of sign patterns and invertibility of the induced proxy map.

3. Two-stage AC-IHT for contaminated high-dimensional regression

In the regression formulation, AC-IHT addresses contamination in the model

$w$2

with $w$3, $w$4, $w$5, and $w$6 (Liu et al., 26 Jun 2026). The coefficient vector $w$7 is $w$8-sparse, the contamination vector $w$9 is $z=[x;w]$0-sparse, the noise $z=[x;w]$1 has independent $z=[x;w]$2-sub-Gaussian entries, and the design has i.i.d. sub-Gaussian rows with covariance $z=[x;w]$3 satisfying

$z=[x;w]$4

The key sample-size condition is

$z=[x;w]$5

The hard-thresholding operator is defined by

$z=[x;w]$6

Stage 1 uses dynamic thresholding. With learning rate

$z=[x;w]$7

decay factor

$z=[x;w]$8

and initialization $z=[x;w]$9, $y=\Phi x^*+w$0, the updates are

$y=\Phi x^*+w$1

$y=\Phi x^*+w$2

followed by threshold shrinkage

$y=\Phi x^*+w$3

and hard thresholding

$y=\Phi x^*+w$4

Stage 2 then fixes the thresholds at their limiting values and iterates for $y=\Phi x^*+w$5 steps (Liu et al., 26 Jun 2026).

Up to constants depending on $y=\Phi x^*+w$6, the limiting thresholds scale as

$y=\Phi x^*+w$7

The initial thresholds satisfy

$y=\Phi x^*+w$8

and $y=\Phi x^*+w$9.

The stage-1 guarantees are non-adaptive: with probability at least $\|w\|_0\le t$0,

$\|w\|_0\le t$1

and

$\|w\|_0\le t$2

$\|w\|_0\le t$3

These bounds are stated to match the minimax $\|w\|_0\le t$4-rate for estimating $\|w\|_0\le t$5 alone, up to logs (Liu et al., 26 Jun 2026).

Stage 2 is signal-adaptive. Under the $\|w\|_0\le t$6-min signal condition

$\|w\|_0\le t$7

the sharper error bound becomes

$\|w\|_0\le t$8

whereas without a signal condition the stage-1-order rate remains valid (Liu et al., 26 Jun 2026). Under the additional $\|w\|_0\le t$9-min condition,

$x^{(t)}\in S^{n-1}$0

the algorithm attains exact support recovery, oracle $x^{(t)}\in S^{n-1}$1-rate

$x^{(t)}\in S^{n-1}$2

and an asymptotic normality statement for fixed contrasts of the recovered active coordinates (Liu et al., 26 Jun 2026).

A common misunderstanding is that the contamination vector is merely a nuisance variable used for proof. In this formulation it is an estimand of direct algorithmic relevance: thresholding $x^{(t)}\in S^{n-1}$3 is part of the mechanism by which the method isolates outlying observations and attains the stated oracle behavior.

4. Augmented AC-IHT for sparse gross errors in linear measurements

The 2019 compressed-sensing formulation treats adversarial contamination as an $x^{(t)}\in S^{n-1}$4-bounded attack vector in the classical linear model

$x^{(t)}\in S^{n-1}$5

with no further bound on the magnitudes of the nonzero entries of $x^{(t)}\in S^{n-1}$6 (Dhaliwal et al., 2019). The objective is recovery of a sparse or compressible signal up to the unavoidable $x^{(t)}\in S^{n-1}$7-term approximation error $x^{(t)}\in S^{n-1}$8.

The algorithm introduces the augmented variable

$x^{(t)}\in S^{n-1}$9

and the block matrix

$\beta^*$00

so that $\beta^*$01. AC-IHT then applies standard IHT in the augmented space:

$\beta^*$02

where $\beta^*$03 keeps the $\beta^*$04 largest-magnitude entries in the signal block and the $\beta^*$05 largest in the attack block (Dhaliwal et al., 2019). A common default choice is $\beta^*$06.

The recovery theorem is stated under a block restricted-isometry assumption. If $\beta^*$07 satisfies the $\beta^*$08-RIP with constant $\beta^*$09, its $\beta^*$10-RIP constant is $\beta^*$11, and

$\beta^*$12

then with

$\beta^*$13

AC-IHT with $\beta^*$14 satisfies after $\beta^*$15 iterations

$\beta^*$16

where $\beta^*$17 and $\beta^*$18 (Dhaliwal et al., 2019). Since the tail term arises from the signal’s compressibility residual, the eventual error is bounded by a compressibility term plus an arbitrarily small optimization term $\beta^*$19 after sufficiently many iterations.

This version differs sharply from the 1-bit formulation. There the corruption is applied to sign observations and the iterate remains a $\beta^*$20-sparse unit vector; here the contamination is explicitly modeled as an unbounded-magnitude $\beta^*$21-sparse vector and thresholded jointly with the signal. The relation is conceptual rather than identical: both are robust hard-thresholding methods, but they target different forward models and use different proof machinery.

5. Proof techniques and recurring theoretical mechanisms

The robust 1-bit analysis rests on restricted approximate invertibility (RAI) under adversarial sign noise, together with a geometric study of corrupted sign patterns (Matsumoto et al., 2023). For a sign-flip function $\beta^*$22 obeying the corruption budget and for sparse vectors $\beta^*$23, the adversarial gradient

$\beta^*$24

satisfies, for side-information sets $\beta^*$25 of size at most $\beta^*$26,

$\beta^*$27

The proof also requires control of the mismatch set

$\beta^*$28

showing that

$\beta^*$29

is $\beta^*$30 in $\beta^*$31. This is combined with a deterministic contraction relation derived from the proximal-gradient structure of the algorithm.

The regression analysis uses restricted isometry and incoherence properties for sub-Gaussian designs, induction over iterations, and a stage-2 “debiasing” mechanism (Liu et al., 26 Jun 2026). The induction maintains simultaneous support control and $\beta^*$32 control for both $\beta^*$33 and $\beta^*$34. The decomposition

$\beta^*$35

is then combined with concentration of $\beta^*$36 to eliminate extraneous coordinates and shrink errors. Once the contamination support is identified, the paper reduces to ordinary least squares on the remaining $\beta^*$37 observations, yielding the oracle analysis and asymptotic normality.

The augmented compressed-sensing analysis is closer to classical IHT theory. It uses a block-RIP assumption on the augmented matrix $\beta^*$38 and a contraction lemma adapted from the IHT literature, producing linear convergence toward the best sparse approximation plus a residual term due to signal compressibility (Dhaliwal et al., 2019).

Taken together, these proofs illustrate three recurring mechanisms in AC-IHT-type methods: sparse projection by hard thresholding, contractive behavior under appropriate restricted regularity, and explicit accounting for contamination either through combinatorial corruption sets or through thresholded nuisance variables.

6. Rates, optimality claims, extensions, and points of interpretation

The three AC-IHT lines make distinct optimality claims. In 1-bit compressed sensing, the robust BIHT result states that with $\beta^*$39 Gaussian measurements, the method returns an estimate within $\beta^*$40 error while maintaining universality of measurements (Matsumoto et al., 2023). In contaminated regression, the two-stage algorithm is described as minimax near-optimal up to logarithmic terms, signal-adaptive under proper signal conditions, and endowed with the strong oracle property (Liu et al., 26 Jun 2026). In the augmented compressed-sensing setting, the guarantee is framed in terms of RIP-based linear convergence and residual dependence on the $\beta^*$41-term compressibility error of the underlying signal (Dhaliwal et al., 2019).

The regression paper also provides explicit minimax lower bounds. For $\beta^*$42, under a sparse-eigenvalue condition and $\beta^*$43,

$\beta^*$44

and the selection lower bound shows that below the stated signal level any selector incurs support error of order $\beta^*$45 (Liu et al., 26 Jun 2026). These results clarify that adversarial contamination fundamentally modifies both estimation and support-recovery difficulty.

Several extensions are explicitly discussed. For contaminated regression, the procedure extends to generalized linear models by replacing the gradient with the canonical-link negative-log-likelihood gradient, and to heavy-tailed noise by truncating the noise and treating the uncompensated part as sparse contamination (Liu et al., 26 Jun 2026). For robust 1-bit compressed sensing, open questions include extensions to sub-Gaussian or structured measurement matrices such as partial Fourier, robustness to both bit-flips and analogue noise, $\beta^*$46-constrained logistic-loss variants for smoother gradient, and lower bounds on the $\beta^*$47 trade-off for universal recovery (Matsumoto et al., 2023).

One persistent point of confusion is whether adversarial contamination here means the same thing in every paper. It does not. In 1-bit compressed sensing, the adversary flips signs; in regression, contamination is encoded by a sparse vector $\beta^*$48 added to the response; in the augmented compressed-sensing model, an attack vector $\beta^*$49 is added directly to the measurements. The unifying principle is robust sparse recovery by iterative thresholding, but the observation model, nuisance parameterization, and proof architecture vary substantially across these uses of AC-IHT.