Coded Arms in Secure Linear Bandits

• Coded Arms are deterministic linear combinations of original arms that enable secure best-arm identification by masking informative arm pulls in stochastic linear bandits.
• They employ a hierarchical subset-sum structure with internal decoding to retain statistical efficiency similar to elimination-based methods while ensuring observational security.
• The method achieves a near-optimal error exponent with only a logarithmic loss, balancing performance and security without relying on cryptographic primitives.

Searching arXiv for the primary paper and closely related linear bandit BAI work. arXiv search query: (Cohen et al., 25 Jul 2025) Coded arms are deterministic linear combinations of original arms used in a secure best-arm-identification procedure for stochastic linear bandits. In the formulation introduced in "Secure Best Arm Identification in the Presence of a Copycat" (Cohen et al., 25 Jul 2025), the learner receives rewards of the form $X_t = a_t^\top \theta^* + \eta_t$ for arms $a_t \in \mathcal{A} \subset \mathbb{R}^d$, must identify the best arm after $T$ pulls, and simultaneously must prevent an external observer, Copycat Chloe, from inferring the best arm from the observable action sequence. The central idea is to replace direct pulls of informative arms with subset-sums of arms, then decode virtual uncoded rewards internally. This preserves a high degree of symmetry in the observable play sequence while retaining most of the statistical efficiency of multi-round elimination algorithms (Cohen et al., 25 Jul 2025).

1. Definition and ambient problem

The setting is a stochastic linear bandit with a finite arm set

$$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$

satisfying $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$. Each arm $a(i)$ is a $d$-dimensional feature vector, and there is an unknown parameter $\theta^* \in \mathbb{R}^d$. At round $t$, Leah chooses $a_t$ and observes

$a_t \in \mathcal{A} \subset \mathbb{R}^d$0

For the main theorem, the noise is assumed Gaussian with $a_t \in \mathcal{A} \subset \mathbb{R}^d$1, although the recalled linear-bandit concentration inequality is stated for sub-Gaussian noise (Cohen et al., 25 Jul 2025).

The mean reward of arm $a_t \in \mathcal{A} \subset \mathbb{R}^d$2 is

$a_t \in \mathcal{A} \subset \mathbb{R}^d$3

Assuming the arms are indexed so that

$a_t \in \mathcal{A} \subset \mathbb{R}^d$4

the best arm index is $a_t \in \mathcal{A} \subset \mathbb{R}^d$5, with gaps

$a_t \in \mathcal{A} \subset \mathbb{R}^d$6

The fixed-budget best-arm-identification objective is to output $a_t \in \mathcal{A} \subset \mathbb{R}^d$7 after $a_t \in \mathcal{A} \subset \mathbb{R}^d$8 pulls with error probability

$a_t \in \mathcal{A} \subset \mathbb{R}^d$9

ideally exponentially small in $T$0. The hardness parameter used is

$T$1

The security model introduces Chloe, who observes the entire played-arm sequence $T$2, including time indices, but does not observe rewards. Chloe outputs a set $T$3 that she claims contains the best arm. The security constraint requires

$T$4

and Chloe’s equivocation is defined as

$T$5

The target equivocation is on the order of $T$6, not $T$7, because the paper treats the underlying statistical dimension as $T$8 (Cohen et al., 25 Jul 2025).

2. Tradeoff between unconstrained efficiency and observational security

The paper positions coded arms between two baselines: a minimax-optimal but insecure elimination algorithm, and a secure but statistically weak non-adaptive design (Cohen et al., 25 Jul 2025).

Yang and Tan’s OD-LinBAI is presented as a minimax-optimal fixed-budget best-arm-identification algorithm for linear bandits. It operates in $T$9 rounds, uses a G-optimal design in each round over the current surviving set, estimates arm values, and eliminates roughly half the arms after each round. Its error probability satisfies

$$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$0

However, because the procedure is elimination-based and later rounds concentrate play on a small set of promising arms, the observable arm frequencies reveal which arms Leah currently considers plausible. The paper notes that in many elimination algorithms, the final round compares only $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$1 and one other arm, leaving Chloe with uncertainty essentially on the order of one bit (Cohen et al., 25 Jul 2025).

A naive secure approach is a single non-adaptive round: choose a distribution $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$2, pull according to $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$3 for all $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$4 rounds, estimate all arm values at the end, and never let action selection depend on observed rewards. This makes the play sequence independent of Leah’s intermediate beliefs, and therefore secure in the operational sense adopted by the paper. With a G-optimal design, the analysis yields

$$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$5

and, rewritten in terms of $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$6,

$$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$7

so the exponent is essentially

$$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$8

This incurs a linear dependence on $$\mathcal{A} = \{a(1),\dots,a(K)\} \subset \mathbb{R}^d,$$9 in the denominator, substantially worse than the $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$0 dependence of OD-LinBAI (Cohen et al., 25 Jul 2025).

The resulting comparison is the central motivation for coded arms.

Method	Security behavior	Error exponent
OD-LinBAI	Insecure; late-round play reveals top candidates	$\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$1
Single non-adaptive round	Secure; arm selection independent of rewards	$\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$2
Algorithm 1 with coded arms	Secure with equivocation $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$3	$\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$4

This suggests that coded arms are designed to break the apparent security-efficiency dichotomy by retaining the symmetry of non-adaptive play while recovering most of the elimination-based gain.

3. Coded arms as subset-sums and the logic of decoding

A coded arm is any linear combination

$\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$5

for a subset $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$6. When Leah plays $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$7, the reward is

$\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$8

Thus a coded arm is a subset-sum experiment whose expected reward is the sum of the expected rewards of the constituent arms (Cohen et al., 25 Jul 2025).

The paper emphasizes that there is no formal coding matrix written, but it is conceptually natural to view the coded arms as rows of a $\mathrm{span}(\mathcal{A}) = \mathbb{R}^d$9 matrix $a(i)$0, with each row indicating a subset whose arm vectors are summed. The algorithm itself uses precisely such subset-sums.

Decodability follows from linearity. If Leah previously observed coded rewards for subsets $a(i)$1 and $a(i)$2, and then observes the coded reward of $a(i)$3, subtraction yields the reward sum over the missing component: $a(i)$4 By recursively organizing subsets in a binary tree, Leah can isolate the contribution of a single arm through a sequence of such differences. The paper’s decoding lemma states that at round $a(i)$5, each decoded reward for an original arm is a sparse linear combination of at most $a(i)$6 coded rewards, and the effective noise variance is

$a(i)$7

The coding structure is hierarchical rather than arbitrary. In round $a(i)$8, the algorithm forms a multiset $a(i)$9 of subsets of size $d$0, with the number of coded arms equal to the number of active arms in that round. The subsets are built by random pairwise unions from the previous round so that each arm in the maintained pool participates symmetrically. This symmetry is the mechanism used to hide Leah’s preferences from Chloe (Cohen et al., 25 Jul 2025).

A common misconception would be to treat coded arms as cryptographic objects. The paper explicitly states the opposite: the algorithm does not require any key or cryptographic primitives. Security comes from equalized observable frequencies and from the fact that decoding occurs internally using rewards Chloe never sees.

4. Multi-round secure best-arm identification with coded arms

Algorithm 1 mirrors OD-LinBAI’s multi-round elimination structure but replaces direct pulls in rounds $d$1 with coded pulls. For simplicity, the presentation assumes $d$2 is a power of $d$3, so the number of rounds is

$d$4

The per-round budget parameter is chosen as

$d$5

following the same allocation logic used in Yang and Tan’s analysis (Cohen et al., 25 Jul 2025).

Round 1 is uncoded. Leah computes a G-optimal design $d$6 over $d$7, lets

$d$8

plays each arm in the support of $d$9 exactly $\theta^* \in \mathbb{R}^d$0 times, and forms

$\theta^* \in \mathbb{R}^d$1

She then estimates

$\theta^* \in \mathbb{R}^d$2

for all $\theta^* \in \mathbb{R}^d$3, keeps the top $\theta^* \in \mathbb{R}^d$4 arms as $\theta^* \in \mathbb{R}^d$5, and selects an additional set $\theta^* \in \mathbb{R}^d$6 of $\theta^* \in \mathbb{R}^d$7 dummy arms from $\theta^* \in \mathbb{R}^d$8. The multiset

$\theta^* \in \mathbb{R}^d$9

therefore contains $t$0 singleton subsets. This step is crucial: from this point onward, all arms in $t$1 will be used with exactly the same frequency across coded rounds (Cohen et al., 25 Jul 2025).

For each subsequent round $t$2, Leah computes a G-optimal design $t$3 over the current active set $t$4, sets

$t$5

and constructs $t$6 by random unions of subsets in $t$7. The family $t$8 contains $t$9 subsets, each of size $a_t$0, and each arm in $a_t$1 appears in exactly one subset of $a_t$2. For each active arm $a_t$3, Leah defines the coded arm

$a_t$4

where $a_t$5 is the unique subset containing $a_t$6.

When a coded arm is played, Leah applies the recursive Decode procedure to obtain a virtual uncoded reward

$a_t$7

Using the collection of decoded virtual pulls, she forms

$a_t$8

estimates

$a_t$9

computes $a_t \in \mathcal{A} \subset \mathbb{R}^d$00, and eliminates all but the top $a_t \in \mathcal{A} \subset \mathbb{R}^d$01 arms. After round $a_t \in \mathcal{A} \subset \mathbb{R}^d$02, the single remaining arm is output as $a_t \in \mathcal{A} \subset \mathbb{R}^d$03 (Cohen et al., 25 Jul 2025).

5. Security mechanism and equivocation guarantee

Chloe observes the coded-arm sequence, including time indices, and in round 1 also sees the uncoded G-optimal design over at most $a_t \in \mathcal{A} \subset \mathbb{R}^d$04 arms. She does not observe rewards $a_t \in \mathcal{A} \subset \mathbb{R}^d$05, decoded virtual rewards, or internal estimates. The security argument is therefore based entirely on the symmetry of the observable arm-use pattern (Cohen et al., 25 Jul 2025).

From round 2 onward, all $a_t \in \mathcal{A} \subset \mathbb{R}^d$06 arms in $a_t \in \mathcal{A} \subset \mathbb{R}^d$07 and all $a_t \in \mathcal{A} \subset \mathbb{R}^d$08 dummy arms in $a_t \in \mathcal{A} \subset \mathbb{R}^d$09 are used with exactly the same frequency in coded arms. In each round, the subset family $a_t \in \mathcal{A} \subset \mathbb{R}^d$10 partitions these $a_t \in \mathcal{A} \subset \mathbb{R}^d$11 arms into equal-size subsets, and the coding structure is symmetric across the entire pool. Leah continues to eliminate arms internally using decoded rewards, but Chloe cannot see the decoding layer. Consequently, arms that remain serious candidates for Leah and dummy arms that are merely frequency-balancing devices are observationally indistinguishable.

Lemma 3 in the paper states that Algorithm 1 achieves equivocation $a_t \in \mathcal{A} \subset \mathbb{R}^d$12. Equivalently, with probability at least $a_t \in \mathcal{A} \subset \mathbb{R}^d$13, Chloe must output a set of size at least $a_t \in \mathcal{A} \subset \mathbb{R}^d$14 if she wants it to contain the best arm with the required probability, so

$a_t \in \mathcal{A} \subset \mathbb{R}^d$15

The analysis is combinatorial and symmetry-based rather than information-theoretic: the paper does not frame the guarantee in terms of mutual information or differential privacy. Instead, the claim is that the action sequence alone does not allow Chloe to distinguish which members of the size-$a_t \in \mathcal{A} \subset \mathbb{R}^d$16 protected pool are truly promising (Cohen et al., 25 Jul 2025).

This security notion is operationally strong within its observational model. Even if Leah’s own error probability becomes exponentially small with growing $a_t \in \mathcal{A} \subset \mathbb{R}^d$17, Chloe’s uncertainty need not collapse correspondingly, because the action frequencies remain intentionally non-diagnostic.

6. Error exponent, sources of loss, and scope of the method

The main theorem states that under Gaussian noise of variance $a_t \in \mathcal{A} \subset \mathbb{R}^d$18, Algorithm 1 both satisfies the security constraint and achieves

$a_t \in \mathcal{A} \subset \mathbb{R}^d$19

Relative to OD-LinBAI’s

$a_t \in \mathcal{A} \subset \mathbb{R}^d$20

the coded-arm method loses one additional factor of $a_t \in \mathcal{A} \subset \mathbb{R}^d$21 in the denominator, but it is much better than the naive secure exponent

$a_t \in \mathcal{A} \subset \mathbb{R}^d$22

(Cohen et al., 25 Jul 2025).

The extra $a_t \in \mathcal{A} \subset \mathbb{R}^d$23 factor has two stated sources. First, the multi-round structure already distributes the budget across $a_t \in \mathcal{A} \subset \mathbb{R}^d$24 rounds. Second, decoding increases effective noise. At round $a_t \in \mathcal{A} \subset \mathbb{R}^d$25, the decoded reward of an arm is a linear combination of at most $a_t \in \mathcal{A} \subset \mathbb{R}^d$26 coded measurements, with

$a_t \in \mathcal{A} \subset \mathbb{R}^d$27

Because decoded rewards share underlying coded-arm noises, the effective noise terms are not independent. If $a_t \in \mathcal{A} \subset \mathbb{R}^d$28 denotes their covariance matrix, then the paper bounds

$a_t \in \mathcal{A} \subset \mathbb{R}^d$29

This yields the concentration inequality

$a_t \in \mathcal{A} \subset \mathbb{R}^d$30

which replaces the standard factor $a_t \in \mathcal{A} \subset \mathbb{R}^d$31 with $a_t \in \mathcal{A} \subset \mathbb{R}^d$32. Plugging this into the OD-LinBAI-style elimination analysis produces the $a_t \in \mathcal{A} \subset \mathbb{R}^d$33 denominator in the final exponent (Cohen et al., 25 Jul 2025).

The assumptions are specific. The linear reward model must be exact; $a_t \in \mathcal{A} \subset \mathbb{R}^d$34; $a_t \in \mathcal{A} \subset \mathbb{R}^d$35 is assumed known and, for simplicity, a power of $a_t \in \mathcal{A} \subset \mathbb{R}^d$36; and the horizon $a_t \in \mathcal{A} \subset \mathbb{R}^d$37 is known in advance so that $a_t \in \mathcal{A} \subset \mathbb{R}^d$38 can be set. The coding structure and G-optimal designs are computed offline, and the paper does not discuss computational complexity or scalability for very large $a_t \in \mathcal{A} \subset \mathbb{R}^d$39. The method is tailored to linear bandits: extending it to generalized linear models or non-linear reward mappings is explicitly described as nontrivial because the decoding procedure relies heavily on linearity of expectations (Cohen et al., 25 Jul 2025).

The broader significance of coded arms is therefore precise rather than generic. They are not merely compressed measurements of arm rewards; they are a specific hierarchical subset-sum construction that allows Leah to run a near-optimal elimination procedure in a hidden layer while ensuring that all potentially best arms appear equally often in the observable play sequence. A plausible implication is that the method identifies an intermediate regime between statistical optimality and full non-adaptivity: security is obtained without cryptographic primitives, but only by exploiting the structure of linear bandits and by paying a logarithmic penalty in the error exponent.