What question did this study set out to answer?

This research aims to formalize and validate forensic evidence through a game-theoretic lens, identifying best practices against adversarial tactics.

May 4, 2026Open Access

Evidence Validation Under Adversarial Planting: A Game-Theoretic Framework for Distinguishing Authentic from Adversarially-Planted Forensic Evidence

Key Points

This research aims to formalize and validate forensic evidence through a game-theoretic lens, identifying best practices against adversarial tactics.
Simulated incidents (N=4500) examined under various adversary regimes (bounded, mid, high) and analyst strategies (content-only, cross-source, crypto-attestation).
Employs a coordinated multi-source strategy for validation assessments.
Content-only strategy outperformed cross-source strategy when adversaries coordinated at level k>=2.
Strategy ensemble achieved an average gain of +12.8 percentage points.
Budget analysis revealed that 3x content-only strategy is more effective than an ensemble when budget is equal.

Abstract

We formalize forensic evidence validation as a two-player zero-sum game. Three adversary regimes (bounded/mid/high-capability) x three analyst strategies (content-only/cross-source/crypto-attestation) on N=4,500 simulated incidents. Coordinated multi-source extension reveals that under coherent adversary at k>=2, content-only beats cross-source (a coordinated lie passes the correlation check). Strategy ensemble validates with +12.8pp avg gain. Cost-equivalent budget analysis: 3x content-only beats ensemble at equal budget. Adversary-budget Pareto: content-only doctrines never break within tested range. This paper is part of the AIACW (AI-Autonomous Cyber Weapons) ResearchProgramme, Wave 2 (papers P10-P20). Wave 1 (P1-P9) was deposited atpeer-review venues 2026-Q2 (NDSS, ACM CCS, IEEE S&P, USENIX Security,Oxford J. of Cybersecurity, ACM Computing Surveys). Wave 2 establishesthe empirical interior. P19 (cross-paper integration test) and P20(methodology meta-paper) provide programme-level validation anddocumentation.

Connected Papers

Building similarity graph...

Analyzing shared references across papers

Discussion

Authors

Hangyu Mei

Actions

References and Citations

Connected Papers

Building similarity graph...

Analyzing shared references across papers

Evidence Validation Under Adversarial Planting: A Game-Theoretic Framework for Distinguishing Authentic from Adversarially-Planted Forensic Evidence

Key Points

Abstract

Citation Network

Connected Papers

Discussion

Authors

Actions

References and Citations

Citation Network

Connected Papers

Discussion

Cite this study