Adversarial Information Resource Theory

• Resource Theory of Adversarial Information is defined by treating informational asymmetries and distortions as operational resources that convert insights into competitive advantages.
• It employs models such as Kelly gambling, Rényi divergences, and Gibbs posteriors to quantify how information mismatches affect wealth growth and decision-making.
• The framework has practical impact across communication, cybersecurity, and robust machine learning by linking information conversion to strategic outcomes.

Resource Theory of Adversarial Information is an emerging research program in which informational asymmetries, information-bearing distortions, and information-aggregation structures are treated as operational resources because they can be converted into wealth, win probability, robustness, or allocation advantage against an opponent. The most explicit formulation recasts Kelly gambling as a resource theory of adversarial information, where “having more information than the odds-maker” is quantified through attainable wealth growth, finite-shot success probabilities, and a hierarchy of Rényi divergences (Arcos et al., 9 Oct 2025). Closely related work shows that information-regularized decision-making can be rewritten exactly as a game against an imaginary adversary, thereby turning relative entropy from a prior into a priced model of adversarial influence (Ortega et al., 2014).

1. Formal idea and basic ingredients

In its most concrete current form, the subject is built on operational tasks rather than on a single universal axiom system. In the gambling formulation, the resource objects are probability distributions such as $P_X$, adversarial benchmark odds $Q_X^B$, and, in the distributed side-information setting, tripartite information structures $P_{XYZ}$. Free states are the product distributions

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$

because they can be created locally without communication. Free operations are local stochastic maps on Alice and Bob, together with deterministic relabeling on Charlie; by contrast, classical messages from Charlie are not free and are costed by their length. The formal monotones include the global Rényi-correlation quantity

$$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$

the correlation monotones $E_\alpha(X:Z)$, $E_\alpha(Y:Z)$, $E_\alpha(XY:Z)$, conditional negentropy quantities such as $E_\alpha(Z|X)$, and adversarial resource quantifiers

$$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$

This makes the resource explicitly task-dependent: the value of information is measured by what it enables against an adversary (Arcos et al., 9 Oct 2025).

A more abstract template comes from the information-based unifying resource-theory literature. There, information itself is taken as the primitive resource,

$Q_X^B$0

and resource-destroying monitorings are CPTP maps of the form

$Q_X^B$1

The key structural claim is that resource loss under monitoring can be written as information flowing into an external ancilla, through

$Q_X^B$2

Although this framework is not adversarial by itself, it supplies a ready-made language for adversarial probes, side-information harvesting, and partial attack strength $Q_X^B$3 (Costa et al., 2020).

2. Canonical operational model: gambling against an odds-maker

The gambling formulation is the clearest existing realization of a resource theory of adversarial information. A gambler chooses a betting distribution $Q_X^B$4, an odds-maker sets odds $Q_X^B$5, and outcomes are generated by the true law $Q_X^B$6. After $Q_X^B$7 rounds, wealth evolves according to

$Q_X^B$8

In the asymptotic i.i.d. regime, the Kelly result becomes

$Q_X^B$9

so the optimal strategy is $P_{XYZ}$0, and the maximal asymptotic growth rate is $P_{XYZ}$1. The basic resource is therefore informational mismatch between reality and the adversary’s odds: if the odds-maker’s benchmark coincides with the true distribution, no informational arbitrage remains (Arcos et al., 9 Oct 2025).

The finite-shot theory replaces asymptotic log-growth by the probability of meeting a target return after finitely many bets. Using the method of types, the realized type $P_{XYZ}$2 becomes the relevant posterior object, and the wealth ratio for any sequence of that type is

$P_{XYZ}$3

The optimal finite-shot strategy is an exponential interpolation between truth and odds,

$P_{XYZ}$4

with $P_{XYZ}$5 determined by the risk constraint. This yields a hierarchy in which risk tolerance selects a Rényi order, so that finite-shot operational value is characterized by Rényi divergences rather than only KL divergence. The one-shot regime coincides with expected-utility maximization under CRRA utility and with asymmetric hypothesis-testing tradeoffs, so economic and information-theoretic viewpoints collapse onto the same family of optimizers (Arcos et al., 9 Oct 2025).

The distributed side-information game extends the same logic to three parties. Alice observes $P_{XYZ}$6, Bob observes $P_{XYZ}$7, and the wagered outcome is $P_{XYZ}$8. In the asymptotic equilibrium,

$P_{XYZ}$9

and the payoff becomes

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$0

Informational advantage is thus the difference between Alice’s and Bob’s predictive compressibility of the same event. In the communication-game realization, bets and odds become prefix-free code lengths, and winnings become surplus bits. This makes adversarial information a communication resource, not merely a statistical descriptor (Arcos et al., 9 Oct 2025).

3. Relative entropy as priced adversarial influence

A second major strand interprets information cost itself as adversarially meaningful. In information-theoretic bounded rationality, the agent chooses a posterior policy $\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$1 relative to a prior $\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$2 by maximizing the free energy

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$3

The optimizer is the Gibbs posterior

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$4

What makes this relevant to adversarial information is the exact equivalence

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$5

where an imaginary adversary chooses additive costs $\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$6 but pays an exponential penalty for doing so. The adversary’s best response is

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$7

and at equilibrium it equalizes net utilities,

$\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$8

The usual KL regularizer is therefore dual to a priced adversarial distortion model, and the Gibbs posterior is the mixed strategy that survives optimal adversarial equalization (Ortega et al., 2014).

This suggests a resource reading in which the prior $\mathfrak F=\{P_{XYZ}=P_XP_YP_Z\},$9 functions as a free reference object, the posterior $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$0 is resourceful insofar as it departs from the prior, the quantity $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$1 is the resource cost, and $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$2 is the exchange rate between information and utility. The paper itself does not define free operations, convertibility, catalysts, or composition rules, but it provides a mathematical backbone for interpreting informational steering power as resistance to adversarial taxation (Ortega et al., 2014).

4. Strategic asymmetry in games, allocation, and infrastructure

Several adversarial game models treat partial information as a directly usable strategic asset. In the one-battlefield General Lotto game with a binary sensor, the Breaker observes whether the Attacker’s realized allocation lies above or below a threshold $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$3. That one bit changes the Breaker’s action space from a single distribution $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$4 to a contingent pair $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$5, induces two posterior subgames, and changes the equilibrium payoff from the classical Hart value to a threshold-dependent piecewise formula $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$6. In the reported numerical study, with $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$7, $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$8, and $$M_\alpha(P_{XYZ}) := \inf_{Q\in\mathfrak F}D_\alpha(P_{XYZ}\|Q),$$9, the Breaker’s payoff rises from $E_\alpha(X:Z)$0 to $E_\alpha(X:Z)$1, about a $E_\alpha(X:Z)$2 improvement. The paper also reports that the signal is never harmful to the Breaker in the numerical study, and that value vanishes at the two uninformative extremes $E_\alpha(X:Z)$3 and sufficiently large $E_\alpha(X:Z)$4 (Diaz-Garcia et al., 2024).

Online strategic disclosure produces a different but closely related picture. There the sender chooses an information structure for a Gaussian state $E_\alpha(X:Z)$5, faces receiver types $E_\alpha(X:Z)$6 chosen adversarially over time, and pays an explicit signaling cost through the posterior error covariance $E_\alpha(X:Z)$7. Under entropy regularization, the sender’s objective takes the form

$E_\alpha(X:Z)$8

so lower posterior error is directly priced. Linear-plus-noise signaling is sufficient to realize any feasible posterior covariance, and with the strongly convex regularizer the full-information regret bound becomes

$E_\alpha(X:Z)$9

whereas the unregularized case has $E_\alpha(Y:Z)$0 regret and the bandit-feedback case has $E_\alpha(Y:Z)$1 regret. This turns informativeness into a costly, directional resource that must be allocated under adversarially shifting demand (Velicheti et al., 2024).

In cybersecurity, the relevant resource may be neither a posterior belief nor a one-bit sensor, but cross-context signal transfer. The multi-surface attacker–defender contest model defines the status-quo arms race ratio

$E_\alpha(Y:Z)$2

where $E_\alpha(Y:Z)$3 is signal breadth, $E_\alpha(Y:Z)$4 is signal cross-correlation, $E_\alpha(Y:Z)$5 is attack-surface count, and $E_\alpha(Y:Z)$6 controls signal dilution. With full cross-correlation $E_\alpha(Y:Z)$7, the model gives

$E_\alpha(Y:Z)$8

so at $E_\alpha(Y:Z)$9 the ratio is independent of $E_\alpha(XY:Z)$0; by contrast, under $E_\alpha(XY:Z)$1 and $E_\alpha(XY:Z)$2, per-surface defense effectiveness vanishes as $E_\alpha(XY:Z)$3. The paper interprets this as a dual inefficiency: overinvestment in private defense and underinvestment in shared signal correlation, which behaves like a non-rival informational infrastructure resource (Bono, 5 May 2026).

Distributed sensor fusion under Byzantine attack shows the same theme at the level of corrupted evidence. The exact MAP fusion rule treats reports from honest and Byzantine nodes differently through their distinct likelihood factors, and the best Byzantine strategy can shift from $E_\alpha(XY:Z)$4 to $E_\alpha(XY:Z)$5 when the fusion center has more prior information or larger observation windows, because once corrupted identities become inferable, full flipping leaves usable structure while $E_\alpha(XY:Z)$6 erases information. A near-optimal factor-graph message-passing algorithm reduces complexity from exponential in observation-window size $E_\alpha(XY:Z)$7 to linear in $E_\alpha(XY:Z)$8, showing that adversarially corrupted reports can remain conditionally useful resources rather than mere noise (Kallas, 28 Nov 2025). A related optimal-transport formulation casts hidden malicious conditions as Bayesian types, proves existence of Bayesian equilibrium, and uses entropic regularization plus asynchronous dual pricing to distribute computation over large source–target networks (Hu et al., 2024).

5. Representation, leakage, and robustness

A complementary literature treats adversarial information as what must be removed or neutralized inside a learned representation. In attribute-obfuscation problems, data are drawn from a joint distribution over $E_\alpha(XY:Z)$9, where $E_\alpha(Z|X)$0 is the utility label and $E_\alpha(Z|X)$1 is a sensitive attribute. A representation map $E_\alpha(Z|X)$2 is trained jointly with a predictor for $E_\alpha(Z|X)$3 and an adversarial predictor for $E_\alpha(Z|X)$4. The empirical minimax objective is

$E_\alpha(Z|X)$5

and under rich probabilistic hypothesis classes the population problem reduces to

$E_\alpha(Z|X)$6

The paper then proves a lower bound on any adversary’s inference accuracy from $E_\alpha(Z|X)$7: if $E_\alpha(Z|X)$8, then

$E_\alpha(Z|X)$9

for adversaries satisfying $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$0. It also proves a utility–leakage trade-off,

$$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$1

showing that when label distributions differ across sensitive groups, reducing sensitive-attribute distinguishability necessarily constrains achievable utility (Zhao et al., 2019).

Adversarial robustness in deep learning produces a closely related but more explicitly information-theoretic decomposition. If an adversarial sample is written as $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$2, the model output on $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$3 depends both on the natural pattern $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$4 and on the adversarial pattern $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$5. The paper defines natural mutual information and adversarial mutual information as

$$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$6

and derives

$$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$7

under explicit assumptions. The proposed defense trains the model to maximize estimated natural MI and minimize estimated adversarial MI on adversarial inputs. Empirically, the paper reports that adversarial samples usually have larger adversarial MI and smaller natural MI than natural samples, and that this distinction improves robustness: on CIFAR-10 under PGD-40, Standard AT attains $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$8, WMIM $$F_f^{(n)}(P_{X^nY^nZ^n}) := \sup_{Q_A}\inf_{Q_B} \mathbb E\!\left[ f\!\left( \frac{Q_A(Z^n|X^n)}{Q_B(Z^n|Y^n)} \right) \right].$$9, and NAMID $Q_X^B$00; when combined with TRADES, PGD-40 improves from $Q_X^B$01 to $Q_X^B$02 (Zhou et al., 2022).

Taken together, these results support a two-coordinate interpretation in which one kind of information is useful and task-supporting, while another is adversarially exploitable or adversarially injected. The papers do not present a unified monotone calculus for these two quantities, but they do show that adversarial information is neither identical to total information nor reducible to simple compression.

6. Toward a general formalism and unresolved questions

The literature is converging on a common operational picture, but only partially on a common formal one. One branch already has an explicit resource theory, with free states, free operations, monotone families, and game values defined on adversarial tasks (Arcos et al., 9 Oct 2025). A second branch offers a generic information-based resource-theory architecture in which monitorings $Q_X^B$03 destroy resource and transfer information to an external system, a structure that is immediately suggestive for adversarial probes and leakage channels (Costa et al., 2020). Most other contributions, however, are best described as resource-theoretic precursors rather than complete theories.

The missing ingredients are repeatedly identified in the source literature. The bounded-rationality duality does not define free operations, convertibility preorders, catalytic transformations, or subsystem composition rules (Ortega et al., 2014). The General Lotto sensor model does not formalize Blackwell ordering or a complete preorder over information structures (Diaz-Garcia et al., 2024). The adversarial-disclosure framework does not axiomatize free operations, equivalence classes, or compositional conversion laws beyond its covariance-based Gaussian setting (Velicheti et al., 2024). The cybersecurity contest model does not axiomatize resources or solve a full multi-defender equilibrium with endogenous sharing institutions (Bono, 5 May 2026). The obfuscation framework does not give side-information-universal guarantees, DP-style composability, or finite-sample generalization theory for strong adversaries (Zhao et al., 2019). The transport model proves equilibrium existence, but not a general conversion theory for informational advantage (Hu et al., 2024).

What is stable across these formulations is the operational claim that adversarial information is not “information in the abstract.” It is information that changes what can be done against an opponent: a prior-to-posterior deviation that can be taxed by an implicit adversary; a thresholded signal that enlarges a defender’s contingent strategy set; a shared cross-surface correlation that defeats dilution; a representation component that leaks a sensitive attribute; or a side-information advantage that converts directly into wealth. A full resource theory would unify these cases by specifying free states, free operations, monotones, and conversion laws for informational asymmetries under adversarial interaction. The existing literature establishes the constituent mechanisms with considerable precision, but the general theory remains under active construction.